An Exploded View publication

Reading Room

Vol. 1 · No. 70 Friday, November 6, 2026 aikansh.com

This week's theme

What AI costs, and who is paying for it

Today is about the price of AI: what it costs to find a security flaw or run a coding team, and when the big data center bets pay back.

A 15-minute read · 12 stories

In this issue

01 Front Page

OpenAI's AI found and patched 948 Linux security flaws

An AI pipeline found 948 ways to seize full control of a Linux machine, for about $1,279 each.

OpenAI built a pipeline where an AI model searches for, proves, and even drafts fixes for security flaws in the Linux kernel (the core software at the heart of most servers, many phones, and much of the internet), almost entirely on its own. That matters because it shows AI can already do security work at a scale that used to take teams of human researchers, and it cuts both ways: it can make software safer faster, or hand attackers a shortcut, depending on who uses it first.

In a run in mid-October 2026, the pipeline, powered by an upcoming AI model built for security work, looked at 2,308 candidate flaws in the Linux kernel, then actually reproduced 1,724 of them inside an isolated test environment to confirm they were real. From those, it built working proof demonstrations, meaning code that proves a flaw can really be exploited, for 291 flaws that leak information and 948 flaws that let a low level user grab full root control of the machine. These are called local privilege escalation flaws, or LPE, and 948 of them is a large number for one run. The whole exercise cost $1,213,430 in fees to run the AI model, or $1,279 per working exploit found. The test machines were running a normal, fully updated desktop setup, not a deliberately weakened target, under the same rules used in real cybersecurity competitions.

Those competitions, Pwn2Own and TyphoonPWN, have historically paid bug bounties of $20,000 to $70,000 for a single Linux kernel LPE exploit. Apply those historical prices to the 948 exploits this run found, and the hypothetical payout would be $18.9 million to $66.3 million, somewhere between 16 and 55 times what the run actually cost. On a second, tougher test called kernelCTF, a version of Linux with much of the easy attack surface already removed, the pipeline still found 25 information leak proofs and 21 full exploits, for about $32,936. For scale, the entire kernelCTF bounty program had accepted only 26 confirmed new exploits in all of 2026 before this test. One pipeline run nearly matched a full year of outside researchers' work, worth roughly $1.5 million in bounties if all were accepted.

The pipeline works in stages: it first finds the security relevant parts of the kernel, scans them for candidate flaws, reproduces the promising ones in an isolated environment, builds a working exploit to prove the flaw is real, drafts a patch, and only then hands the whole package, the root cause, the proof, the exploit, and the candidate fix, to a human security researcher for review before anything is reported. This grew out of OpenAI's Patch the Planet effort. Back in June 2026, an earlier version of the model had already found Linux kernel flaws and built 24 working exploits. OpenAI says its pipeline used at least 10 exploitation techniques nobody had documented before.

The open source community moved fast too. In the 10 days while this scan was running, outside volunteers had already patched or drafted fixes for more than 100 of the same flaws, with roughly 300 more under public discussion. Capability is also rising quickly: this October run, using a newer model, found more than five times as many new flaws as a similar run in July did, even though three months of community patching happened in between.

OpenAI's own conclusion is blunt: within a few years, if a piece of software has a security flaw, a top tier AI model will probably be able to find it, and even a weaker model may be able to build a working exploit once the flaw is made public. Their practical advice is to treat any account on a machine that is not fully patched as functionally equivalent to a full takeover for a well resourced attacker, and to lean on sandboxing and isolation tools, such as Firecracker and gVisor, which wall off programs from the rest of the machine, to limit the damage if something does get in.

via OpenAI →
02 Learnings

Revolut cut its AI coding bill by 90 percent

A fixed-cost model it runs itself replaced pay-per-use AI tools and sped up shipping by 70 percent.

You've been thinking about your own AI tool spend. Revolut, a banking app with more than 80 million customers, just gave a real-world playbook. It cut its AI coding bill by 90 percent. Its engineers also started shipping code 70 percent faster. It did this not by cutting back on AI, but by changing how it paid for it.

David Abitbol leads AI operations at Revolut. He described the change at a conference called AI Engineer New York. Revolut had already given about 2,000 engineers its best coding tools: Claude Code and Codex. Those are AI assistants that write and edit code. Revolut paid for them per use, through Anthropic and OpenAI. But giving everyone the best tool did not speed up delivery on its own. The real jump came when Revolut switched engineers to a model it runs itself. It is an open-weight model (the underlying files are public, so anyone can run a copy) called GLM, built by a company named Z.ai. Revolut hosts it on 56 Nvidia B200 chips (specialized hardware built to run AI models fast), rented through a company called Together AI.

The blended cost works out to $0.30 for every million tokens (chunks of text, roughly three quarters of a word each) the model processes. That is about one tenth of what Revolut paid before. After the switch, the time from an engineer picking up a feature to having code ready to merge fell by about 70 percent. Revolut also tuned the setup, rather than just buying more chips. The same 56 GPUs ended up handling 76 percent more work than when they started. Abitbol has a blunt label for one wasteful default setting in this kind of system: he calls it 'a scam.'

The numbers carry extra weight because of who is reporting them. Revolut sold shares in July 2026 at a valuation of $115 billion. That made it Europe's most valuable private company. It reported more than $6 billion of revenue in 2025, up 46 percent, from over 80 million customers. It also built its own banking-specific AI model, called PRAGMA, with Nvidia, and runs an in-house research lab called Revolut Research. A company with that much of its own AI expertise choosing to move off the big paid AI providers is a signal worth watching, not just a cost-cutting story. One gap: the newsletter is itself a teaser for a longer paid report, so some promised detail, like exactly how a European Union-regulated bank cleared a Chinese-developed model through compliance, is not included here.

A report on AI spending by the investor a16z found that 69 percent of S&P 500 companies run AI in production. Only 2 percent of them track any AI metric over time. Revolut is in that 2 percent, with nearly two years of data across 2,000 engineers. That is part of why Abitbol's numbers are worth more than the usual conference claim.

The blended cost is $0.30 per million tokens, and the invoice is 1/10 of what it was.
via Linas's Newsletter →
03 Key News

Anthropic's own IPO filing shows a supply gap

Anthropic, the company behind Claude, the tool he builds on, just showed in its own public filing that it cannot supply enough AI capacity to match demand, and that gap is now the single biggest risk to its 1.5 trillion dollar IPO (initial public offering, the first sale of a company's stock to the public).

Anthropic filed an amended S-1 (the official filing a company submits before its stock starts trading) on November 2, 2026. It disclosed third quarter revenue for the first time: nearly 17 billion dollars for Q3 2026. In that same quarter, though, the company swung from a 974 million dollar operating profit to a 567 million dollar operating loss. The cost of running its models, compute (the chips and the time it takes to run them), climbed to 58 percent of revenue. The filing also spelled out, in full for the first time, 895.4 billion dollars in compute commitments: money Anthropic has already promised to spend on chips and data centers.

Part of that swing to a loss traces to a 5 billion dollar cost line tied to a contract with SpaceX. That contract carries a 90 day exit window, so either side can walk away from it starting around early 2027. Investors weighing the IPO are reportedly pricing the company between 1.4 and 1.6 trillion dollars, close to the 1.5 trillion target Anthropic wants but not yet settled.

The source for this is a paywalled newsletter teaser, so the deeper math behind the valuation model and the exact warning signs it flags are locked behind a subscription and cannot be reported here without guessing. What is confirmed: a real swing from profit to loss in one quarter, a cost base now majority compute, and a large one-sided exit clause sitting on the books right before a public listing.

Worth watching: whether the IPO roadshow (the run of investor meetings before the stock starts trading) holds near 1.5 trillion, or whether the newly disclosed compute costs and the SpaceX exit risk push that number down before Anthropic actually lists.

via Linas's Newsletter →

Analysts say AI spending's real test comes in 2028

Analysts quoted by MarketWatch say the real proof that the AI building spree paid off will not show up until 2028. It is a reminder that today's AI stock swings are mostly a bet on a payoff that is still years away.

via MarketWatch →

Stock market jitters over AI spending costs

NBC News covered live stock market moves as investors grew nervous about how much money is going into AI data centers and chips. It is a sign the mood around AI spending is getting jumpy, which can feed into funding and pricing for the AI tools he relies on.

via NBC News →

Public backlash could delay Anthropic's IPO, investors say

Reuters reports that potential investors warn growing public pushback against AI could delay the timing of Anthropic's stock listing. A delayed or rockier listing for Anthropic could ripple into pricing and stability for the Claude tools he depends on.

via Reuters →

Mystery seller offloads $500 million in AI data center loans

Someone, reportedly the bank ING, is quietly selling off about a dozen loans tied to AI data centers, including debt linked to operators Vantage Data Centers and CyrusOne. One 25 million dollar slice backs Project Jupiter, a huge data center campus in New Mexico that's part of Stargate, the AI venture from OpenAI, Oracle, and SoftBank, and Oracle already warned in September it might delay payments there by citing force majeure (a contract clause that excuses a company from a deadline when events outside its control get in the way).

via Reddit r/ArtificialInteligence →
04 Insights

Opinion piece ties Anthropic's AI warning to a power question

An opinion piece in Crain's Chicago Business argues that Anthropic's own warnings about AI risk are really a case for taking control of AI away from a handful of Silicon Valley companies, not just a safety statement. The piece frames the debate as one about who holds power over AI, not only whether it is dangerous.

Worth tracking because rules shaped over the next year or two, on who gets to build and control AI, could affect how he and others build with it.

via Google News →

A reddit post predicts a PC hardware price crash by 2027

One redditor's bet against the AI spending boom, with a 2027 timeline.

Why it is here: a useful counterweight to the bullish AI infrastructure stories he keeps running into, even though this is one person's opinion on reddit, not research backed by data.

A poster on r slash ArtificialInteligence argues that today's drop in chip and PC hardware maker stock prices is just the first crack. They claim the huge sums poured into AI data centers and chips (the computers that run AI models) are no longer backed by real financial returns, so a much bigger price collapse is coming. The poster is specific about timing: they do not expect the crash to hit full force until late 2027, because long term corporate supply orders already placed, and new chip production lines already scheduled, are propping prices up for now.

Once those props run out, the poster expects two problems to hit at once: the current pricing cannot be sustained, and looming energy shortages plus the high cost of power needed to run data centers will force prices down hard, potentially below where they stood before the current chip shortage years. They call the whole boom hype mixed with institutional ignorance, and predict that ordinary PC builders and gamers, the market big manufacturers deprioritized to chase corporate AI orders, become the main buyers again once prices fall.

The caveat: this is one person's prediction with no data, model, or named analyst behind it, posted to a general AI subreddit. There is no report or firm backing the 2027 date. Worth tracking as a contrarian marker against the bullish AI spending stories, not as a forecast to act on.

Hold your wallets, guys.
via reddit r/ArtificialInteligence →

A tradesperson says small jobs are AI's next target

Leaky taps and plug sockets look safe from AI. He argues they are not.

Why it is here: a sharp counterpoint to the idea that only desk jobs are exposed to AI. This poster, a tradesperson, argues manual labor is not the safe harbor people assume.

Posting to r slash ArtificialInteligence, the poster says blue collar trade work is at risk from AI, and not for the reason people expect. It is not that robots will physically replace plumbers and electricians. It is that most everyday trade calls, a dripping tap, a boiler that will not fire, moving a plug socket six feet, putting up a few shelves, are really knowledge and diagnosis problems wrapped around simple physical work. AI can now supply the diagnosis and the how-to instantly, which removes the main reason someone used to need to call a professional for a small job.

The poster estimates, from their own country's trade market, that these small, low ticket jobs make up around 14 percent of total trade revenue but 25 to 30 percent of total trade jobs. That gap matters: it is a large share of the entry level work in the trades, even though it is a small share of the money. AI, plus a bit of a do it yourself mindset, removes the real barrier to doing this work yourself, which was never the physical skill. It was knowing what is wrong and which tool or part fixes it. YouTube partly solved this before, the poster says, but when a tap is actively leaking, people want the fix now, and AI gives an instant answer rather than a video to search through.

The poster draws a direct comparison to how AI is already squeezing entry level software engineering jobs: cutting out the low ticket work removes the bottom rung new workers use to enter a trade and build experience, which over time thins out the whole profession from the bottom up.

AI isn’t taking the tradesman’s labour in exchange for payment, it’s taking their knowledge and tools leaving them as simply the labourer.
via reddit r/ArtificialInteligence →
05 Tools & Craft

A Dutch bank app blocks phones running privacy-focused Android

Outside your usual reading: ASN Bank, a Dutch bank, blocks its app from working on phones running privacy focused Android alternatives like GrapheneOS, even when the phone itself works fine, by requiring Google's own verification service to log in. It is a small, clear example of how software gatekeeping can lock people out of devices they fully own, a pattern worth recognizing in other apps.

via GitHub →

A Mac app turns the whole Earth into a flyable 3D globe

Outside your usual reading: Kugelblitz is a new Mac app that renders the Earth and its neighboring bodies as a smooth 3D globe you can fly over like a pilot, built entirely from free, openly published map data such as OpenStreetMap, with no account needed. It runs smoothly even on an older M1 Mac and can stream the view straight into a Vision Pro headset. A nice example of a small, well built tool doing something big companies usually charge for.

via Metaebene Applications →
The Last Word
Everyone is putting a price on AI. Only the bug hunter showed a receipt.
The Desk Report

How this edition came together — from bookmarks and feeds to the page.

233links gathered
40read by the desk
13made the edition

Where they came from

On the cutting-room floor — 27 links read but not run this week

Quality over volume: most links get a second look and a pass. The ones that made it earned their place.

Reading Room — every Sunday

The week's AI signal in 15 minutes — what happened, why it matters, and what to do with it. Curated by someone who actually builds, not a feed algorithm.