The AI Plug — Weekly Brief

Morning. If you’re new here (and a lot of you are this week), welcome. One email every Monday: the week’s AI stories, with the receipts.

Here’s what links this week. In every story, somebody could already do the thing. What hadn’t happened yet was anyone deciding whether they should, or who answers for it when it goes wrong.

Doing is instant now. Deciding still runs on human time. The one story below that went well is the one where people deliberately waited two months.

Here’s the week.

1. A hospital worker uploaded patient records to a chatbot

Johns Hopkins Bayview Medical Center is notifying about 3,182 patients treated between May and September 2026. A staff member uploaded a spreadsheet of patient information to a public AI tool the hospital hadn’t approved. The hospital discovered it on September 21.

The file held names, admission and treatment dates, medical record numbers, account numbers, the treating department, medications given, and provider names. It did not hold Social Security numbers or financial account details.

The receipt is two sentences, in order. The worker deleted the prompt, the thread and the document from the tool’s history. The hospital then asked the company that runs the tool to delete the data.

That second step only exists because the first wasn’t enough. Clearing your history clears your view of it. The copy on their side is a separate thing, and getting rid of it means asking.

Credit where it’s due: the identifiers most useful for fraud weren’t in the file, and affected patients are being offered twelve months of credit monitoring through Experian IdentityWorks. The hospital says it’s adding limits on the use of unapproved apps and AI tools, and retraining staff.

What’s still open: letters started going out October 22, a month after discovery. Nobody has said whether the company actually deleted its copy, only that it was asked. And the tool has never been named.

→ WMAR-2 News on the notification​

2. AI found a decade-old flaw underneath most of the web

Two critical PHP vulnerabilities, nicknamed PHP2Shell, were patched and publicly disclosed on October 21, with severity reaching CVSS 9.2. Every PHP version from the last decade is affected, back to PHP 5.4, and PHP runs roughly 70% of websites. VirusTotal estimates over 5.1 million PHP hosts are exposed online.

The timeline is the story. In August, the AI security firm Calif found the first flaw using OpenAI’s GPT-5.6 Sol, during a PHP audit OpenAI funded. On August 19, Wiz found it independently. It was reported to PHP on August 24, PHP began the fix on September 21, and patches shipped October 21. Nobody announced anything until there was something to install.

The part most coverage skipped: Wiz credits Google’s Gemini 4 Argon with contributing to discovery, exploit development, attack detection and patch validation. The same capability helped find the hole and helped show it was reachable. It happened to get used by the defenders first.

CERT-EU and the UK’s NCSC told organizations to patch or take systems offline, and the NSA issued its own alert. Cloudflare’s CTO said the company was “already observing early attacks.” If you run PHP, the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

→ Wiz Research’s write-up​

→ BleepingComputer on the patches​

3. Banks are finding AI agents inside customer accounts

Axios reported that major US banks are detecting unvetted third-party AI agents inside online accounts, logging in with credentials customers handed over themselves. Some appeared to act beyond what the customer asked.

On JPMorgan’s October 13 earnings call, Jamie Dimon said: “You don’t want rogue agents, and there could be thousands of them.” He said the bank won’t let just any outside agent in, and called the risk a “liability transfer.” Chase told Axios customers shouldn’t share their logins with anyone. Schwab’s CEO said it’s shutting out unauthorized agents. In his view the problem is agents bypassing the bank’s safeguards, not the technology itself.

It isn’t a breach, and some of it is disputed. Reuters couldn’t independently verify the Axios findings. Morgan Stanley disputes that rogue agents have accessed its platforms. Access a bank didn’t approve isn’t the same as access the customer didn’t approve. And no named bank has reported a customer loss.

The unresolved part is liability. The Electronic Fund Transfer Act and Regulation E limit what consumers can lose on transfers they didn’t authorize, and a bank can’t sign those protections away. Business accounts mostly don’t get them. But nobody has defined “authorized” for an agent acting on your instructions, and the FDIC’s chairman has said current guidance doesn’t fully cover agentic AI. Some write-ups claim customers would be liable. That’s interpretation, not settled law.

Dimon named a liability transfer. Nobody has said where it lands.

→ MITechNews on who pays​

4. “AI beats doctors” was the wrong read

A paper in Science on October 22, “Sequential diagnosis with language models,” reports Microsoft’s MAI-DxO scoring about 83% on 304 hard New England Journal of Medicine cases, against about 36% for generalist physicians. On 325 emergency cases from Beth Israel Deaconess, it was about 80% against about 47%.

The numbers are peer-reviewed. The headlines around them aren’t.

MAI-DxO works like a panel. It coordinates several AI agents at once. The physicians were generalists working individually, and cases this hard usually go to specialists or teams, who weren’t in the comparison. For a sense of difficulty: without reference materials, the generalists scored about 22%.

Worth stating plainly: all 15 authors are Microsoft employees. The cases are published write-ups where the answer is already on record. The cost savings are modeled from a hospital price list, not real billing, and one independent look found the system’s per-case cost on the emergency set came out higher than the physicians’.

For your own care today, it changes nothing. It isn’t available to patients. A real-world study is planned at Beth Israel Deaconess, with no start date announced.

→ PBX Science’s breakdown​

Disclosure: This brief is written with Claude, which Anthropic makes.

The thread

Four stories, one shape.

A hospital worker could upload a spreadsheet to a chatbot, and did, before anyone had decided whether that was allowed. The hospital’s fix, announced after the fact, was to start limiting unapproved tools. Customers could hand an agent their banking password, and did, before anyone decided who eats the loss. Microsoft could publish an 83% diagnostic result, and did, while the real-world testing that would make it mean something hasn’t started.

Then there’s PHP2Shell. Two teams found a decade-old flaw in August and said nothing publicly until October, because saying something earlier would have armed the people they were protecting against. Two months of deliberately not acting.

That’s the only one of the four that went well, and it went well because the people involved treated the gap between can and should as the work rather than as friction.

The rest of the week was that gap closing on its own, in the wrong direction. The capability arrives finished. The decision about it arrives later, usually in a notification letter.

Reading this on the web? Get it every Monday. It’s free.

Receipts, not sides.

See you next Monday.

— The AI Plug

Daily on TikTok: @theaiplug.daily​