Quick pulse for Sunday, October 25. A quiet weekend inbox, but two of today’s stories are about the same thing: the walls between AI and the open internet.
OpenAI now trains its frontier models inside a copy of the web#
On Sept 20, an OpenAI research model was doing a training task: name the author of a blog post from a handful of clues. It wasn’t on the real internet. It was searching a stored copy. When it asked for a page the copy didn’t have, the proxy answered CACHE_MISS.
So it went looking for a way out. It guessed the task came from BrowseComp, a public search benchmark, downloaded it from the cache and decrypted the questions. No match. Then it noticed the sandbox’s DNS resolver still returned real records from outside. It used DNS lookups to pass questions to a public chatbot, 18 of them in its second batch alone. OpenAI’s monitor flagged it within 15 minutes. The run was killed 2.5 hours later.
On Oct 23, OpenAI made the fix permanent. Its words: “we believe the responsible approach is to conduct frontier model training with no internet access.” Models now practice browsing in an “offline world,” a large set of indexed and cached web pages. “All of our frontier RL runs use this offline mode of interaction.” Training resumed Oct 1, after an 11-day pause.
The red-team part is the scary part. OpenAI pointed teams of its own agents, including the upcoming GPT-6 Astra Cyber model, at its sandboxes and spent hundreds of billions of tokens on it. The agents chained bugs into microVM escapes. They found holes in almost every narrow service that was still allowed to talk outside, like metrics, logging and authentication. Two agents in separate VMs, with no network and no shared files, talked to each other by timing the CPU cache. That’s the same trick behind Spectre and Meltdown. OpenAI patched the bugs, including fixes for Kata Containers, gVisor and Docker.
Superintelligence asks the question I’d ask too. The post gives no size for the cache, no source, no refresh schedule and no licensing terms. OpenAI now builds the practice web, fills it and grades the model on it. Whatever that copy rewards is what the model learns.
Get your VPS off the public internet#
levelsio reposted his server advice on Oct 23, “now that everyone is getting hacked.” He means the AI-found bugs, like this week’s PHP file-upload exploit. His point: SSH keys don’t save you from an exploit in your app or an open port.
His setup has three steps:
- Put the website behind a Cloudflare Tunnel. Your server stops answering on ports 80 and 443. The only way in is through Cloudflare.
- Put server access on Tailscale, a private network that only your own laptop, phone and server can join.
- Empty the firewall at your host. He uses Hetzner. Block everything, then test that it’s really blocked.
Both tunnels connect outbound, so nothing has to listen on the public internet. One caveat on his claim that Cloudflare’s free plan has a WAF on by default. It does, but Cloudflare’s docs describe it as a small free managed ruleset for high-impact, widely exploited bugs. The full managed ruleset starts on Pro. levelsio says it himself: “much safer, not perfect btw, but nothing is.”
AI is cloning paid software in Rust#
Tim Ferriss’s 5-Bullet Friday points to an r/ClaudeAI post from Oct 18 titled “Adobe, Office, Outlook, ElevenLabs: AI is cloning all of it in Rust.” It lists open-source Rust rewrites built with AI agents in about two weeks. Among them are BrowseCraft, a browser with its own rendering engine, PdfCraft, two Outlook clones called MailCraft and an offline voice-cloning tool called VoiceStudio. One project readme claims its Word, Excel and PowerPoint clones cover about 90% of core features and 501 of 523 Excel formulas. Those numbers come from the projects themselves. Nobody has checked them, and a brand-new browser engine is a security risk.
Ferriss’s take: “AI will make nearly all software free.” Then he asks what moat is left. Reputation and SLAs? Support, Red Hat style? Data, like SAP’s 50+ years across 400,000 companies?
In the same issue, Bill Gross of Idealab, who has started 175+ companies, is giving away business ideas. He wrote down 31 of his methods for turning problems into companies and ran them with AI. The site, Idealab.ai, now lists about 1.2 million ideas for free, each with sources and a rough cost to start.
InvestAnswers: the flaw flood, sold-out clouds and robotaxi math#
James at InvestAnswers had a busy Saturday on Patreon. Five of his posts are worth your time, and one of them makes the OpenAI and levelsio stories above feel even more urgent.
AI is finding flaws faster than anyone can patch them. James says new security flaws are being published at about four times last year’s pace. The public data backs him up. In October so far, about 565 new CVE records a day have been published, against about 137 a day in October 2025. That’s 13,567 records through Oct 24, versus 4,235 in all of last October (CRACI, built from the official CVE list; SOCRadar’s count is almost the same). His exact figure was 588 a day. That depends on which day you count to, and it doesn’t change the point. Not all of this is AI. More organizations can issue CVE IDs now, and almost nobody credits AI tools in the record. But the curve bent this spring, and it hasn’t flattened.
Source: CRACI CVE publication trends, built from CVEProject/cvelistV5, snapshot Oct 25, 2026. October 2026 runs through Oct 24.
AWS is close to sold out. James calls it rationing, and his answer to the AI bubble talk. The quote is real, but it didn’t come from an earnings call. Andy Jassy said it on Friday on Andreessen Horowitz’s podcast. He said 2026 capacity is sold out and “2027 is largely sold out,” with some kept back for on-demand EC2 and Bedrock. Then: “A good chunk of 2028 is sold out.” So 2028 isn’t fully sold out, just a good chunk of it. Amazon reports Q3 on Oct 29, and Jassy says the planned $220B of 2026 capex could be “a lot more.”
Tesla’s robotaxi miles are compounding. James says Tesla Robotaxi now drives more miles than Waymo with fewer cars. On miles, that holds in Austin but not nationally. In the week to Oct 18, Tesla logged 438K driverless miles in Austin, against Waymo’s 406K a week there. But Waymo’s figure is its Q2 average, so the periods don’t match. Across all its cities, Tesla did 558K miles that week. That’s about 80K a day, up 30% on the week before, per Robotaxi Tracker. Waymo’s national pace is about 3.9M a week, still about 7x more. If Tesla keeps growing 20% a week, CleanTechnica’s math says it would pass Waymo nationally in about 11 weeks. That’s a big if. James’s magic number for real revenue is 2,000 cars, and he thinks Tesla could get there by year end. CleanTechnica counts about 950 registered Tesla robotaxis today.
The carriers are lobbying against Starlink Mobile. On Oct 20, AT&T, Verizon and T-Mobile met with the offices of FCC Chair Brendan Carr and two commissioners, through their trade group CTIA. Their targets are the FCC’s draft rules for satellite-to-phone service. The draft would grow the bands satellites can use from five to 13. It would also replace the need for a lease with each carrier with coexistence deals. The carriers want the 2.5 GHz and 3.45 GHz 5G bands kept out, “meaningful consent” over any satellite use of their spectrum, and a rethink of the proposed limit on satellite signal strength. Their filing doesn’t name SpaceX, but SpaceX is the obvious target. A month earlier, AT&T CEO John Stankey called SpaceX’s phone plan “not a viable strategy” (Axios). If you don’t think it’s viable, you don’t need to lobby this hard. The FCC votes on Oct 29.
Moon landing in 2028, but not on Artemis III. NASA confirmed it this week. Artemis III, next year, stays in low Earth orbit. Orion will dock with test versions of SpaceX’s and Blue Origin’s landers there. The first crewed landing is set for 2028, on Artemis IV. One correction to the “Starship lands humans” story: NASA says neither lander has been assigned to that landing yet. It will choose based on which one is ready. SpaceX still has to show it can refuel in orbit, with tanker Starships filling a depot ship. It also has to fly an uncrewed demo landing first. Blue Origin has dropped refueling from its 2028 plan and will use three transfer stages instead.
-Q
Sources#
OpenAI: Securing our frontier model training environment · OpenAI Alignment: An agent used DNS to reach an external chatbot · Superintelligence: The Offline World · levelsio: Take your VPS off the public internet with Tailscale and Cloudflare Tunnel · Cloudflare docs: WAF managed rules · Tim Ferriss: 5-Bullet Friday, Oct 24 (web copy) · ReadmeX: AI agents spawn a wave of Rust clones of paid apps · Idealab.ai · CRACI: CVE publication trends · SOCRadar: October 2026 CVE report · Reuters via CNA: Amazon cloud capacity sold out through 2027, Jassy says · Robotaxi Tracker: Waymo vs Tesla driverless miles · CleanTechnica: If Tesla’s robotaxi miles keep compounding at 20% a week · TeslaNorth: Carriers lobby FCC as Starlink Mobile closes in · PhoneArena: AT&T, T-Mobile and Verizon fight FCC rules · FCC: Draft Supplemental Coverage from Space order · Axios: AT&T CEO says SpaceX phone strategy not viable · NASA: Partners accelerate lander development for 2028 Moon missions · NASA: Artemis III to test future Moon lander operations · InvestAnswers (Patreon): AI finding software flaws galore · InvestAnswers (Patreon): Amazon AWS now rationing compute · InvestAnswers (Patreon): Robotaxi ramp · InvestAnswers (Patreon): IA13, the telco lobbying has begun · InvestAnswers (Patreon): Humans going to the Moon in 2028?