Anyone can hack anything now! (This Week In AI)

Security had a rough week. Two old PHP bugs combined into a critical remote code execution flaw that leaked before the patch; GitLab disclosed a 12-year-old hole in self-managed servers; the private keys behind eight eMudhra certificates proved breakable; and LiteLLM shipped credential-stealing malware for the second time. Railway, which runs part of the Mastra platform, had a security incident that exposed environment variables, and Abhi explains what happened and what to do if you deploy there. The model releases kept coming too: GPT-6.1 Terra, DeepSeek V4.1 Flash, Kimi K3.1 Pro, MiniMax M3.1 Flash and Meta's Muse Spark Open. Shane and Abhi also cover Anthropic's S-1 filing, Claude Duet, Block's Dessa voice model, Thariq leaving Anthropic, Chroma joining Replit, and a round of quick hits. AI Agents Hour is a weekly livestream by Mastra CPO Shane Thomas and CTO Abhi Aiyer. Mondays at 12 PM Pacific. 📚 READ MORE Anthropic S-1: https://x.com/anthropicai/status/2114705042817110293 Anthropic Public Benefit Fund: https://x.com/anthropicai/status/2111881963657412903 DeepSeek V4.1 Flash 1017: https://x.com/deepseek_ai/status/2111375640717033777 DeepInfer: https://x.com/deepseek_ai/status/2112476496283775135 Kimi K3.1 Pro: https://x.com/Kimi_Moonshot/status/2113680705855373791 MiniMax M3.1 Flash: https://x.com/minimax_ai/status/2112150867868541221 Muse Spark Open: https://x.com/AIatMeta/status/2110779754274292212 Claude Duet: https://x.com/claudeai/status/2112984664256241837 Devin Oncall: https://x.com/cognition/status/2110790097369010292 Dessa: https://x.com/jack/status/2113697902916751661 Eleven Realtime: https://x.com/ElevenLabs/status/2112550782063247521 PHP security release: https://x.com/thephpf/status/2112633155631108544 AI agents in bank accounts: https://x.com/axios/status/2113268208371126348 Railway preliminary report: https://x.com/Railway/status/2113671961624682722 1Password for Agents: https://x.com/1password/status/2113276767582498943 Claude formal verification: https://x.com/AnthropicAI/status/2113390212911083894 Thariq leaves Anthropic: https://x.com/trq212/status/2113844051938054167 Sunil Pai leaves Cloudflare: https://x.com/threepointone/status/2113705370090905937 Chroma joins Replit: https://x.com/trychroma/status/2113677289334706274 tsc-ts: https://x.com/ctatedev/status/2111272070768185787 bun lint: https://x.com/bunjavascript/status/2110692261508079721 Flint: https://x.com/richardsocher/status/2112944385415426249 📚 MASTRA RESOURCES Mastra: https://mastra.ai Mastra on X: https://x.com/mastra_ai Mastra Discord: https://mastra.ai/community/discord Mastra GitHub: https://github.com/mastra-ai Learn Mastra: https://mastra.ai/learn Principles of Building AI Agents (Book): https://mastra.ai/books/principles-of-building-ai-agents Patterns for Building AI Agents (New Book): https://mastra.ai/books/patterns-of-building-ai-agents WHAT IS MASTRA? Mastra is an open-source TypeScript framework designed for building and shipping AI-powered applications and agents with minimal friction. It supports the full lifecycle of agent development—from prototype to production. You can integrate it with frontend and backend stacks (e.g., React, Next.js, Node) or run agents as standalone services. If you're a JavaScript or TypeScript developer looking to build an agentic or AI-powered product without starting from first principles, Mastra provides the scaffolding, tools, and integrations to accelerate that process. ⏱️ CHAPTERS 00:00 Cold open 00:25 Intro 00:44 Anthropic files its S-1 02:26 Anthropic's Public Benefit Fund 03:10 GPT-6.1 Terra 04:34 DeepSeek V4.1 Flash 05:13 DeepSeek open sources DeepInfer 06:35 Kimi K3.1 Pro 09:20 MiniMax M3.1 Flash 09:43 Meta's Muse Spark Open 10:51 Claude Duet and proactive agents 12:15 Devin Oncall 13:21 Dessa, a voice model without an LLM 15:19 Eleven Realtime 16:09 Security had a bad week 17:35 Critical PHP vulnerabilities 20:25 Someone is patching PHP servers with AI 20:58 Node and GitLab 21:33 eMudhra's broken certificate keys 21:57 LiteLLM compromised again 22:18 Rogue AI agents in bank accounts? 22:44 The Railway incident 26:00 Security agents 26:47 1Password for agents and formal verification 27:33 Qwen and the Alibaba bucket 29:12 Security tools you should be using 29:47 If you work in security, you're set 31:33 Thariq leaves Anthropic 32:08 Sunil leaves Cloudflare 32:22 Chroma joins Replit 32:45 Quick hits 34:11 Outro