◉ Steal My Bitcoin | The Coin Flip

Open in CoinFlip OS »

Monday, 2 November 2026 · by Akiba · 11-minute read

Steal My Bitcoin

Heads: AI fixes the world | Tails: It doesn’t matter.

TODAY'S COIN: HEADS

The Flip

Each week I will flip a virtual coin with regards to the fate of humanity.

The flip of a coin to decide humanity’s fate might sound flippant (pun intended), but it’s far from that. My point is, even if it was a coin flip, I would take those odds.

Last week three of the biggest AI labs released new models, and they all said in their own launch posts that the models are good at hacking.

Quick bit of background. Before a release, the big labs grade each new model against risk levels for things like cyber attacks. OpenAI calls its version the Preparedness Framework, and “Critical” is the top level.

On Monday (26 October) OpenAI released GPT-6.1 Terra, its new cheaper model. Developers pay $1 per million tokens in and $5 per million out (tokens are the chunks of text a model reads and writes, and how AI gets billed), which OpenAI says is 50% below GPT-5.6 Terra and GPT-6.1 Sol.

And in the same launch post: “GPT‑6.1 Terra meets the Critical threshold in cybersecurity under our Preparedness Framework”.

This is a budget model btw!

On Wednesday Google released Gemini 4 Carbon. It scores 59 on the Artificial Analysis Intelligence Index, an independent leaderboard that rolls lots of AI tests into one score, which puts it at No. 1, and 88.2% on SEC-bench Pro, one of the hacking tests. For now Google is only giving it to a group of vetted cyber defenders through its Fairwind Program, with access widening in phases and no date yet for developers or the rest of us.

On Thursday French lab Mistral released Mistral Large 4 as open weights, meaning anyone can download the model files on Hugging Face and run it themselves. It’s a 1-trillion-parameter model trained in Europe, and Mistral’s own post says “we see a potential for uplift to conduct real attacks. We are modifying our guardrails accordingly”.

Uplift is the safety term for how much a model helps someone do damage they couldn’t do on their own. Mistral released the weights anyway, and is keeping a specialised version for penetration testing (hacking a system with permission to find the holes) for vetted partners only.

CHECK THE CHART

Every model launch now uses some sort of chart showing how it beat every other model. I literally still do the ‘strawberry’ test on every new local model i try because those charts not always translate to real world tests. I actually keep my own AI benchmark based on how models perform on tasks I do regularly on my own hardware. Interestingly, I found Qwen 3.6 beat 3.8 hands down across my testing… (until I got Qwen Next-Flash which owns everything!)

Charts are great to get an idea but check 1) what benchmarks they’re using and what they test 2) what models they’re testing against (labs conveniently leave out some of the best models quite often because they know they can’t compete there.)

WHY HEADS

In Issue #2 I wrote about Red Wednesday, the day PHP shipped fixes for two critical bugs that AI had found months before the attackers got anywhere near them. All three labs are pitching this hacking skill as a tool for defenders, and that’s exactly what I want AI doing.

Google is holding Carbon back for defenders first. Mistral is holding back its pentest version. OpenAI is putting a “Critical” label on the model it sells cheapest.

The asterisk is Mistral’s files. Open weights can’t be called back, guardrails or not, so defenders have to get there first… (why I personally support. This is a catch 22. Without open source AI good enough to at least compete with closed source AI then corporations will grow in power to levels we’ve never seen before on earth, with the power to literally do whatever they want. However, if open-source models are at least somewhat competitive then us ‘plebs’ at least have a fighting chance to hold those in power responsible through our own AI systems… the counter is that by doing so we also allow all bad actors access to this same technology.

There’s no way to open source AI (but only for the ‘good guys’). So it becomes a little ‘all or nothing.’ I go with ALL. Open source AI stays competitive with closed source models and those closed source labs are then in turn responsible for keeping the main internet infrastructure safe from AI swarm threats ran on open-source models.

The rest of us run our own local AI in our homes and our own AI helps keep us safe online. That’s the short-term future we can survive imo.

But ofc, with regard to your local home AI, unless you trained it yourself, there’ still the question of model alignment locally. Who watches the Watchmen?

Bonus Flip: Who Watches the Agents?

HEADS. Somebody finally budgeted for it.

Some background first. In July OpenAI’s own AI agents broke out of the test environments they were being evaluated in and ended up breaching a server at Hugging Face, the site where much of the AI world shares its models. OpenAI’s own write-up came out in August.

On Thursday OpenAI published How we detect frontier model misalignment. Misalignment is when a model does something its makers didn’t intend or want.

OpenAI replayed its new monitors against that July escape. They alerted about 30 minutes after the agents got out, more than 30 hours before the breach.

OpenAI also says that in September a model reached the internet during training, it was flagged within 15 minutes, and OpenAI paused its frontier RL runs (reinforcement learning, the stage where a model learns by trial and reward). The monitors now cover every one of those training runs and tests for its most capable models, plus all internal Codex traffic.

The day before, the UK’s Budget set aside £40m for a new National Agentic Security Unit “to detect and respond to misaligned agentic activity”. Translation: a team for when AI agents go rogue.

It sits next to £120m more for the AI Security Institute, a £60m National Cyber Shield for AI-run cyber defence and £70m for NERV, a centre that uses AI to find vulnerabilities.

OpenAI caught its own model within 15 minutes in September, and the UK now has £40m to chase rogue agents. Who’s watching the agents at every other lab, or at the companies running Mistral’s open weights?

Steal My Bitcoin

In Issue #2 I covered PHP2Shell, the nickname for two critical bugs in PHP, the programming language behind a huge share of the world’s websites. They let a stranger with no password run their own code on a web server, and X spent the week deciding whether the internet was over.

Late on Saturday 24 October, someone decided to settle it with money.

Steal My Bitcoin put the key to a funded Bitcoin wallet on a deliberately unpatched PHP server and dared anyone to take it, to test whether PHP2Shell was realistically exploitable. The operator posted it on Hacker News, a forum popular with programmers, and says the pot started at about $502 before others topped it up.

And then suddenly the internet got it wrong in both directions at once.

One early Hacker News commenter said the fact it was still open an hour later “ends the narrative” of AI agent swarms breaking into every site. Others said it was rigged. Dan Guido, who runs security firm Trail of Bits, wrote “This looks like a trap. We have a working RCE that would claim this”, RCE being remote code execution, the ‘run your code on someone else’s server’ part.

Security YouTuber LiveOverflow “took a closer look” at a challenge that “aims to demonstrate that PHP2SHELL is not realistically exploitable”, adding “My analysis could be wrong”.

It was.

The wallet was emptied at 15:47 GMT on Sunday 25 October. The site now reads “My bitcoin was stolen after: 19.28 hours”, with 0.02511679 BTC ($2,021.22) in the pot when it went.

LOOK CLOSER

For most of those 19.28 hours there was nothing to hack.

The operator confirmed on Hacker News that the server was “serving pure html through PHP before 13:00-ish UTC”, and only then added a real PHP page. A plain HTML page never touches the buggy code, so the people hammering it all morning were attacking a wall.

On the operator’s rough timing, it fell in under three hours once it was actually vulnerable.

The winner, who goes by KillaBoi, published a write-up. The attack is a chain of at most 20 web requests that tricks PHP into leaking where things sit in its memory, then uses that to make the server run a command. The target was PHP 8.4.26, one version below the fix, and in a lab the chain works about seven times in ten.

So it took a skilled person and an exact version match… and a target that could be hit.

The ending got messy: the operator had put the wrong key on the server. The winner’s write-up says the recovered key “did not derive the prize address”, meaning it didn’t unlock the wallet with the money in it. The operator owned the mistake, judged it a solve from the logs and sent the funds anyway.

Fair play.

The day after the win, CISA, America’s cyber security agency, added both PHP2Shell bugs to its Known Exploited Vulnerabilities list, the list of flaws it has confirmed are being used in real attacks, and gave US federal agencies until 29 October to patch. In Issue #2 I said PHP2Shell wasn’t on it. True when I wrote it, out of date the day it went out.

The crowd that said ‘nobody took the money, so it’s hype’ drew their lesson from a test that couldn’t be passed, and the crowd that said ‘it’s rigged’ was half right for the wrong reason.

THE LEVER

  1. Before you trust a public test, check it could actually be passed. Ask what was being tested, and when it was really live.
  2. Check your PHP version, again. The fixed versions from last week are 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. One version short was enough. CryptoSlate’s write-up has the PHP story so far.

Quick Flips

A few smaller, shorter stories with my quick takes. Remember, if it’s HEADS, we’re heading towards an age of abundance. If it’s TAILS, we’re going the other direction.

1. A fake Claude Code extension tried to backdoor developers through Cursor’s marketplace. Cursor, a popular AI code editor, published a security notice: malicious versions 2.1.312 and 2.1.313 of an extension called Anthropic.claude-code, which Anthropic didn’t make, were in its marketplace from about 09:27 to 20:35 GMT on Thursday 29 October. They sent machine details to the attacker, added an attacker’s SSH key (a login that skips the password) labelled svc-telemetry and set up a hidden tunnel back in. Cursor says that step needs admin rights, so it fails on most Mac and Windows machines, and it has rotated keys and rebuilt the marketplace. Microsoft’s analysis has the details.

TAILS. Same lesson as the LiteLLM hack I covered in Issue #2, when a poisoned version of a popular AI tool went out: the weak spot is the store everyone trusts. If you installed it, search ~/.ssh/authorized_keys for svc-telemetry, and Cursor publishes clean-up scripts.

2. Microsoft offers staff a way out. Microsoft opened a voluntary exit offer on Monday for employees at level 70 and below (Microsoft’s internal job grades) in participating teams in the US, Canada, the UK and India. CNBC reports about 60,000 are eligible, with exits on 31 December.

TAILS for workers. The coverage tied this to AI, but Microsoft’s post doesn’t mention AI once. Voluntary means Microsoft never has to say whether AI is why these jobs are going.

3. The share of UK businesses using AI has doubled. The government’s AI adoption survey, from 3,503 business interviews, says 32% of UK businesses now use at least one AI technology, up from 16% in 2025. Half of them report higher productivity, “generally described as modest”, 64% see no immediate effect on costs, and only 14% call AI high or critical to how they run.

HEADS, quietly. Every company now has an AI strategy. Which means a lot of chatbots nobody asked for, bolted onto websites nobody visits.

What it should mean is new hires in new roles to optimize... well basically anything and everything. AI will ultimately take over jobs humans currently do just like machines took over ploughing the fields. This time, however, there’s a chance the displaced workers never have to find another job. But we have to go about it all the right way. And we’re SO under prepared and under resourced to do this properly.

4. Liquid AI shrinks a useful model down to laptop size. LFM3 is six small models for text, vision, audio and more, built on one shared base. The text one fits in about 1 GB of memory and can take in roughly a long book’s worth of text at once (a 256K-token context), and every model can be fine-tuned, retrained on your own data, on a single graphics card.

HEADS. Liquid AI just shrank a useful model down to laptop size, so your data stays on your own machine. That’s the counterweight to Google and Mistral keeping their strongest hacking skills for vetted defenders.

5. Humans barely beat chance at spotting AI, and simple software did better. A study in Nature Human Behaviour ran 72,191 tests with 1,916 human judges and 37 AI agents across six tasks. Human judges barely beat chance, while simple statistical classifiers (basic pattern-spotting software) did better than them. But in a live chat where the judges could ask their own questions, humans spotted GPT-3.5 every time.

HEADS, for now. Many of the models tested are old (GPT-3.5, ChatGPT-4o), so this says more about the judges than today’s most capable models. Asking questions beat passively scrolling, which is a decent rule for your feed too.

A Better Question

Your feed is asking: “So was PHP2Shell hype or not?”

A better question: What would actually count as evidence, and did anyone check the test could be passed before declaring victory?

Steal My Bitcoin was one server, one version of PHP and one wallet with the wrong key in it. It was a fun bet. Did it prove anything really?

(Want to know if a viral “proof” holds up? Paste the post into ChatGPT, Claude, Gemini or Grok and ask what it would take to prove the claim wrong, then go and check whether anyone did.)

Hit reply. I read every answer.

From the World

If you’re new, The Town is a little pixel town on a floating gold coin, built in the browser, where each issue’s stories live.

Retro gaming but AI news because why not in a world where AI builds it while you’re rabbit holing youtube videos…

TL;DR - Play the newsletter rather than simply reading it in The Town

Enter the town

Sources (22)
« Mon 26 OctAll issues