AI Daily Digest · October 24, 2026: Anthropic Opens the Books, AI Finds PHP's Oldest Bugs, Europe Bets on Robotaxis

Anthropic's IPO paperwork is finally coming into public view, OpenAI shipped a generally available Decisions API, and a pair of decade-old PHP vulnerabilities found by AI models forced governments on three continents to pull websites offline. Europe, meanwhile, is turning autonomous driving from a demo into an industrial policy. Here are the seven stories that mattered in the past 24 hours.

Anthropic is expected to publicly file its S-1 as early as Friday, after confidentially submitting a draft registration statement to the SEC on June 1. Draft documents reviewed by The Wall Street Journal and Reuters show first-half 2026 revenue of $16.3 billion, up from $1.1 billion in the same period last year. The headline net loss of $80.7 billion looks enormous, but roughly $72 billion of it is non-cash accounting charges tied to changes in the value of convertible notes and other fundraising instruments.

The more revealing number sits in the obligations section. The draft discloses about $450 billion in future cloud commitments over seven to ten years, most of them non-cancelable: $111 billion to Google Cloud, $110 billion to AWS, $31 billion to Microsoft, and up to $86 billion in NVIDIA chip rentals. Bloomberg reported the total could reach $750 billion once pending deals are included. Compute spend ran about $9 billion in the first half alone.

Valuation talk has been moving in both directions. Bloomberg cites discussions between $1.8 and $2 trillion, while Reuters sources point closer to $1.5 trillion after Anthropic told investors that Q3 revenue reached $16.8 billion, up nearly 50% from Q2, with adjusted profitability. The same week, CNBC reported OpenAI is working on a private round of up to $30 billion at a $1.25 trillion valuation. One compute bill, two very different routes to paying it.

🔗 Anthropic Newsroom · EconoTimes/WSJ/Reuters recap

OpenAI announced general availability of the Decisions API, the GPT-6 Luna powered endpoint that returns probability, choice, or score answers instead of generating text. OpenAI says it answers up to 10x faster than running Luna through the Responses API, and since the public beta it has added native GPT-Live integration, prompt caching, JSON inputs, image instructions per question, and support for up to 400 questions per request, double the beta limit.

Pricing is the story for production planners: $0.10 per million input tokens, $0.01 cached, and no output token charges at all. Early customers quantify what that buys. Datadog reports 40x faster p95 latency scoring the risk of agent-generated shell commands before execution; Sierra runs orchestration decisions under 280ms p95 at 90% lower cost per call; Speak cut time-to-next-action in its language learning app from 1.4 seconds to 0.13 seconds by wiring Decisions into GPT-Live.

The pattern here is worth naming. Agents burn most of their tokens not on hard reasoning but on a constant drip of tiny judgments: route this, classify that, decide whether to continue. Pricing that drip at a fraction of a cent, with typed outputs instead of parsed prose, turns it into something you can put in the hot path. The API layer is starting to specialize the way databases did: one engine for thinking, another for deciding.

Two critical vulnerabilities in PHP, the server-side language behind roughly 70% of known websites, were disclosed this week after being found by AI-driven security research. Security firm Calif discovered one flaw on August 1 using GPT-5.6 Sol under OpenAI's Patch the Planet program; Google-owned Wiz independently found both using its Wiz Atlas agent with Gemini 4 Argon and GPT-5.6 Sol. The bugs, a memory issue and an unauthenticated remote code execution path in the PHP core, score up to 9.2 in severity and have existed in every PHP release since version 5 shipped in 2004.

The disclosure turned chaotic when details leaked online a day before the planned fix. Government sites in France, the Netherlands, Belgium, and Australia went dark as a precaution, including the Paris Police Prefecture and the Dutch digital identity service DigiD. The US National Security Agency issued an unusual advisory: patch immediately or take vulnerable systems offline. Censys counted about 1.5 million unpatched PHP hosts out of 2.6 million. The PHP Foundation shipped fixes in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The double edge is hard to miss. OpenAI noted these flaws were found by defenders before attackers, which the AI tooling made possible; the same tooling now makes it far easier to adapt exploits across PHP versions and server configurations. Before AI, exploiting these bugs required manual analysis that was difficult to scale. That barrier is gone, on both sides of the fight. Expect the interval between "AI finds a flaw" and "AI weaponizes a flaw" to keep shrinking.

At the Assises du Véhicule Autonome in Paris, Wayve, Stellantis, NVIDIA, and the French government announced a collaboration to deploy autonomous vehicles in France and accelerate development across the EU. The stack is deliberately complete: Stellantis contributes its L4-Ready Platforms and manufacturing, Wayve supplies the AI Driver, and NVIDIA brings Halos OS running on its Hyperion compute and sensor architecture. French Transport Minister Philippe Tabarot said the country will adapt its regulatory framework while keeping strict safety and data sovereignty requirements.

The announcement sits on real groundwork. Stellantis and Wayve formed a strategic partnership in May 2026, and by October 9 they were showing a Fiat 500e and a Maserati Grecale running a Level 2++ hands-free, door-to-door supervised driving assistant, integrated and road-tested in under four weeks. A hands-free launch is targeted for 2028 in North America. French media also report Uber is involved, which would connect the stack to one of Europe's largest ride-hailing markets.

What makes this more than a press release is the governance layer. Engagement with unions, city authorities, and mobility stakeholders will be led by local transport partners before any rollout, an answer to the labor and community questions that robotaxi deployments usually defer until after the backlash. Europe's approval route for fully driverless cars is capped at 1,500 vehicles per year, so the continent's path to scale runs through exactly this kind of industry-government alignment rather than around it.

Rivian announced it has acquired Third Dimension AI, a startup founded in 2024 by Tolga Kart and Piotr Sokolski that turns real-world camera footage into high-fidelity, controllable 3D environments. Financial terms were not disclosed. The platform lets Rivian reconstruct actual road scenes, vary weather, traffic, and edge cases, and generate training and validation data at scale instead of waiting for rare dangerous situations to happen on public roads.

James Philbin, Rivian's SVP of Autonomy and AI, called simulation central to how the company trains and validates its driving systems, and his comments to TechCrunch point at the real bottleneck: deciding when software is good to ship. Synthetic data gets the headlines, but the sign-off question, how well the sim-to-real gap is understood, is what gates releases. Owning a platform anchored in recorded real-world scenes, rather than game-style worlds, is what makes simulated sign-offs defensible.

The acquisition feeds both of Rivian's autonomy tracks: supervised point-to-point driving for consumer vehicles, with an invite-only early experience program planned for December in California and Florida, and the robotaxi roadmap targeting 2028. For a company that is not a frontier AI lab, buying a 15-person simulation team with roots at Wayve and Parallel Domain is a clear statement that validation infrastructure is now a competitive asset worth owning outright.

Canva released Canva Craft, the first image generation model built in-house by Canva Research, and the design platform claims the debut made it the second most advanced AI lab for image generation on DesignArena's global leaderboard. Craft entered as the fourth most advanced model overall, ranking first globally for People and Portraits out of 87 models and first for Landscapes and Nature out of 85.

The technical wedge is a two-stage architecture that separates planning from rendering. A planning model reads the prompt and writes an explicit composition: spatial relationships, relative scale, visual hierarchy, and where text appears. Only then does the renderer produce an image, at up to 2K resolution across more than 30 aspect ratios. Training data came from millions of human-made templates in Canva's library, which is why outputs convert cleanly into layered, editable designs through Canva Magic instead of arriving as flattened pixels.

The business logic is just as clear. Canva has been paying external providers, Google, OpenAI, ByteDance, Meta, for generation inside its platform, and a house model brings those API costs in-house while giving control over quality and latency. Craft is live for all users through Dream Lab and the Public API, with MCP integration planned so agents in ChatGPT or Gemini can generate design-ready images mid-workflow. Cheaper Craft-fast and Craft-ultrafast variants are on the way.

Modal, the serverless GPU platform, has crossed $1 billion in annualized run rate and raised a $750 million Series D at a $16 billion valuation, five months after its $5 billion Series C. CEO Erik Bernhardsson laid out the economics in a Latent.Space interview: usage has tripled since the last round, the company has grown at least 50x over two years, and it does all of this with a team of roughly 200 people.

The core insight is that GPU demand is not rectangular, but capacity contracts are. Buying for the peak means paying for idle hardware; buying less means missing demand. Modal pools capacity across thousands of customers and more than 20 clouds, letting each use elastic slices. Bernhardsson is candid about the other side of the trade: if GPU prices fall, providers holding locked-in capacity wear the loss. He does not expect a collapse, but he prices the possibility into how the business is built.

The product almost wasn't. Sandboxes, isolated environments for running AI-generated code, were nearly shut down at launch for lack of adoption, until coding agents, background agents, and reinforcement learning workloads arrived. Sandboxes now generate about a third of revenue, near a $300 million run rate, with close to three billion spun up to date. When the customers of infrastructure are agents that create and destroy environments by the millions, latency of environment startup becomes a product feature, and Modal's custom filesystem and GPU memory snapshots are built around exactly that.