Anthropic's public benefit fund and Claude auto mode lead AI chatter on X

We’re committing a portion of Anthropic’s shares to the Anthropic Public Benefit Fund, a new wholly owned entity dedicated entirely to the public benefit. It will start off with 5% of our shares. For every 50% increase in the company’s value over a set baseline, we can contribute up to an extra 2%, subject to our board’s discretion. In total, this means that roughly 20% of Anthropic’s shares are committed to the public good. Our co-founders have already pledged to donate 80% of their equity, and around half our employees are donating a portion of their equity as part of a donation matching program we’ve run since our founding. In the post below, we share more details about our new fund. https://t.co/XzDntVH0vH

Starting next week, sessions across Claude web, desktop, and mobile apps will run in auto mode by default on Pro, Max, and Team plans. Rather than asking you to approve each step, an automated check blocks risky actions. Switch back to manual anytime.

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP. Here is the short version of what happened and who got hit. 1. eMudhra (Trusted CA compromise) eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs. One of the intermediate CA private keys was literally the number 4. The other seven: 56, 66, 115, 155, 156, 230, 237. Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket. • Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs. • Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10). • 10-second check on any server: curl https://t.co/vhiGLxNhIS (TLS error = safe. 200 OK = still vulnerable.) 2. PingCAP / TiDB Cloud (10.6 TB breach) Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents. Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets. Who is affected in the leaked records: • Live credentials exposed in support tickets: - Pinterest: AWS keys for their pingcap-logs S3 bucket - CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets - DeBank: 38 presigned S3 URLs - An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys) • Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed: - Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap - E-comm & Travel: https://t.co/C512KFOEq5, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook - Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM - Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life - Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase • Developer profiles leaked (from a purchased https://t.co/28tjHqd5Wr table in PingCAP's BigQuery): - 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash. If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket. 3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619) Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch. Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c). Because C-level multipart parsing runs before line 1 of index.php: • App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it. • Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1). • Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

I just deployed an AI agent that will send $15 worth of Solana every 5 minutes to a winner. 200 Total Winners This will cover the subscription for existing members or allow new users to join for free. Proof of winners in the comments. Like, Repost & Drop your SOL address. 👇 https://t.co/KHUTu6KGRO

This is what we need AI for. I’m about to clean up 2 old MacBooks and turn them into servers

Terafab will be the most epic chip-building exercise ever, producing one terawatt of SI compute annually Join us https://t.co/Y3ZgjARgZj https://t.co/btpMDwNvnP

Vibe your way to 50K. The 2026 Epic AI MegaJam begins Nov 12: https://t.co/aAXEqj7zmE https://t.co/h3Kgs9Y5zH

AI is an intelligence lever. Meaning the smarter you are, the smarter it makes you.

Planning a trip to Paris? 🇫🇷 Good news! Paris City Tours is now offering 50% off. Same iconic sights. Slightly different experience. My latest AI satire. Enjoy and Vive La France! 🇫🇷 Tools used: 🧠 Prompt Architect — ChatGPT 🖼️ Image generation — GPT Image 2.5 / Nano Banana 2.1 🎥 Video — Seedance 2.5 🎵 Music — Suno v6 ✂️ Edit & post-production — Adobe Creative Cloud

We’ve spent the past year developing new primitives for GPUs. We believe this enables new algorithms to change how machines learn, open new markets, and dramatically reshape AI’s cost structure. We have raised a $1 billion Series A, co-led by Index and Lux. https://t.co/VUkQ68gL3U

Hey @grok can you do better than this 3? https://t.co/31wuqBqrsF

this is actually your first decision when downloading muse in japan https://t.co/7k9gbgEbO9

🚨🚨ALERT: ANTHROPIC IS A/B TESTING USAGE LIMITS Many users on X are reporting LOWER usage limits right now. THEY ARE NOT WRONG. We detected an A/B test going on that DECREASES your monthly API-value by ~20% while INCREASING your 5h usage limits by ~20%. This only affects SOME accounts. (1/2)🧵

💥 Introducing Warp Sciences, a new company applying AI and robotics to help the world develop new medicines faster. We’ve raised a $215M Series A led by @lightspeedvp to bring frontier AI out of the browser and into the lab, and build scientific capacity here in America. I co-founded Warp with my long-time friend @dpatil, FAIR co-founder @manohar_paluri, and drug hunter Sol Reisberg. The early team is full of incredible people like @bkspears9, who helped achieve Q>1 fusion at LLNL.