The Rundown AI

The world’s largest AI newsletter keeping 2,000,000+ readers ahead of the curve. Get the latest AI news and how to apply it in 5 minutes. By @rowancheung

[The Rundown AI @TheRundownAI]

Today, we launched the Community AI Workflow Hub.

Our most requested feature of all time.

A place for builders, everyday knowledge workers, and the AI curious to learn from real people doing real work with AI 🤝

[The Rundown AI @TheRundownAI]

Pretty fascinating results here: Researchers wrote 50 short secret messages in 15 languages and asked Claude Fable 5.1 to hide each one inside a picture it drew.

It mostly used the same trick: height. In 33 of the 50 pictures, each building, star or blade of grass stood for one letter, and its height said which.

When letters alone weren't enough, Fable drew in clues, like a Kremlin tower = Cyrillic letters.

A fresh Fable session, handed just the image and asked whether anything was hidden in it, found 39 of the 50.
OpenAI’s GPT-6 Astra found 44.

Communication between advanced AI models may look entirely different from what we expect.

[Bryan Chan @cnm13ryan]

New blogpost: Fable-5.1 can hide secret messages in benign images.

We gave the image to another Fable in a fresh session and simply asked: "Is there a hidden message in this image?"

It recovered the exact message without being told how it was hidden.

[The Rundown AI @TheRundownAI]

Read more: https://t.co/MYRoid3EYa

[The Rundown AI @TheRundownAI]

Top stories in tech today:

- Palmer Luckey’s $1.2B war dog startup
- Meta loses $25B privacy trial
- SpaceX goes shopping for 80K cell towers
- Airbnb bans the checkout chore list

[The Rundown AI @TheRundownAI]

Read more: https://t.co/cF0uFHgFnR

[The Rundown AI @TheRundownAI]

Top stories in AI today:

- Banks crack down on AI agents’ account access
- Rowan’s Corner: Safeguard yourself from AI hacks
- Put your open Chrome tabs to work
- Microsoft’s AI out-diagnoses doctors on hard cases

[The Rundown AI @TheRundownAI]

Craft, Canva’s first in-house image model, just debuted at No. 4 on Design Arena’s rankings (behind only OpenAI’s three models).

It was trained on millions of Canva templates, and Canva says the model plans each layout before drawing it, so images convert easily into editable designs via its Magic Layers feature.

An impressive first release for Canva Research, the company’s newly unveiled 160+ person in-house AI lab.

[The Rundown AI @TheRundownAI]

AI was on both sides of this week’s cybersecurity chaos:

- OpenAI’s models helped find two bugs in PHP, the code behind much of the web, back in August. They stayed secret until PHP shipped a fix Wednesday

- Within 45 minutes of the announcement, Cloudflare counted tens of thousands of break-in attempts. The UK, the Netherlands, Finland and others pulled government sites offline, and the U.S. National Security Agency told anyone who couldn’t patch to do the same

- India’s eMudhra, which issues the certificates that vouch websites are real, is quitting that business after its secret keys proved guessable. One was simply the number 4, and a researcher says Claude cracked them with one prompt

- A China-aligned group turned ARTEX, a free AI tool built for security testing, on 2,250+ organizations’ Microsoft 365 accounts, according to Microsoft. In a few cases it reached admin access in under 3 hours

- Attackers using AI agents spent 48 hours attacking coding startup OpenCode. Its own AI models refused to help fight back, blocked by their safety filters, until it switched to OpenAI’s Daybreak

- Developer platform Railway told users to swap their API and cloud keys after a breach it says was part of a campaign aimed at companies that run AI models

- Big U.S. banks are finding AI agents they never approved inside customer accounts, per Axios

- Security firm Straiker says a Mexico-linked gang pointed Claude and Grok agents at 400+ banks and payment firms across Latin America

[The Rundown AI @TheRundownAI]

NEW: Ex-OpenAI product chief Kevin Weil raised $215M for Warp Sciences, which is building labs where AI designs experiments and robots run them 24/7.

The startup is focused on drug discovery first, with the overarching goal of "scientific superintelligence."

[The Rundown AI @TheRundownAI]

Read more: https://t.co/2wtp01R7LG

[The Rundown AI @TheRundownAI]

Top stories in robotics today:

- This $20K robot butler is up for reservations
- Unitree H2-X plays action hero
- Tesla fires up Optimus production
- Waymo wants 20K robotaxis by 2027

[The Rundown AI @TheRundownAI]

Read more: https://t.co/jXMtOMYU0M

[The Rundown AI @TheRundownAI]

Top stories in AI today:

- OpenAI’s model helps catch critical PHP flaws
- Nate’s Notebook: If it’s copy-paste, let AI do it
- Let Town prepare your next meeting brief
- Anthropic joins the personal agent game with Duet

[The Rundown AI @TheRundownAI]

LAUNCHED: Anthropic is previewing Claude Duet, a new proactive agent app powered by Opus 5.5.

Now in a U.S. waitlist preview for Pro and Max users.

[The Rundown AI @TheRundownAI]

Unitree: "Please use the robot safely and in a friendly manner."

The robot, in a junkyard at night:

[The Rundown AI @TheRundownAI]

An OpenAI model just helped find what the company calls "one of the most impactful security issues in recent memory."

The target was PHP, the language behind WordPress and nearly 70% of websites.

Security firm Calif pointed GPT-5.6 Sol at PHP’s code, and it found a critical flaw that could let attackers take over a server without logging in. Wiz found the same bugs independently.

OpenAI then spent two months coordinating the response with PHP’s maintainers, Wiz and Cloudflare.

Patches dropped this morning after details leaked early, but any server that hasn’t updated is still exposed.

The National Security Agency told organizations that can’t update yet to take their systems offline.

[OpenAI @OpenAI]

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.

Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.

Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.

This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
https://t.co/TW3jrSbB3f

[The Rundown AI @TheRundownAI]

Read more: https://t.co/5uVw1r7A58

[The Rundown AI @TheRundownAI]

Top stories in AI today:

- Sam Altman details the AI industry’s endgame
- Ex-OpenAI research chief’s Arda debuts at $1.5B
- Make Claude Code check its work after each edit
- Anthropic’s Claude takes on scorpion antivenom

[The Rundown AI @TheRundownAI]

Full post: https://t.co/Rq3KQF2VdE

[Justin Mast @justinmast]

1/ Today we’re unveiling Bombadil, @electricplantco's foundation model that reads the electrical signals of living plants and turns them into a continuous view of their physiology.

Trained on 7M+ hours of plant electrical signal across 125+ species. That makes Bombadil the most species-diverse model of directly recorded electrical biosignals in existence. The animal equivalent would be one model that reads the brainwaves of blue whales, horseshoe crabs and fruit flies.

[The Rundown AI @TheRundownAI]

The Electric Plant Co. built an AI that reads a plant’s electrical signals to tell how it’s doing, minute by minute.

Its Bombadil model was trained on over 7M hours of data from 125+ species, and can spot plant stress days before it actually shows in the leaves.

Co-founder @justinmast says farming and forestry are "the largest use of fresh water on Earth," yet nearly all of it is "managed from the outside in."

"We need planetary gardeners."

[The Rundown AI @TheRundownAI]

Full article via Variety: https://t.co/n4whfr7tkW

[The Rundown AI @TheRundownAI]

Runway CEO Cristóbal Valenzuela was asked on stage if AI could replace human actors. “Yeah, absolutely. I think it’s already happening in a way.”

Valenzuela spoke at Turin's VIEW Conference last week, in a session titled "Every Pixel Will Be Generated."

Nvidia’s Richard Kerris argued Marlon Brando improvising with a cat in 'The Godfather' could never be prompted.

Valenzuela: “Not now, but I think models are going to get probably to a point where you can probably direct them in a very similar way."