This week offered a tidy snapshot of where the AI industry actually stands in late 2026: still spending at a staggering clip, still racing to ship autonomous agents, and increasingly turning its own models into security tools that can find bugs humans missed for two decades.

Meta doubles down — and creates a new kind of stock to pay for it

Meta's third-quarter earnings on Wednesday gave investors a lot to chew on. The company narrowed and raised the lower end of its 2026 capital expenditures guidance to $135 billion to $145 billion, up from a previous baseline of $130 billion. That money is funding the unglamorous but essential plumbing of the AI race — chips and data centers — while also going toward AI infrastructure, meaning the chips and data centers needed to train large models, as well as funding development of Muse, Meta's consumer AI agent.

More striking than the number itself was the mechanism Meta chose to help pay for it. The board approved a new class of publicly listed, non-voting Class C common stock, set to take effect in January 2027, distributed as a one-time stock dividend of one Class C share for each Class A or Class B share held, effectively acting like a 2-for-1 stock split without altering existing voting control. It's a financial-engineering move reminiscent of Alphabet's own non-voting share class, and it signals that Mark Zuckerberg intends to keep writing enormous checks for AI without ever loosening his grip on the company. Analysts, meanwhile, are still probing whether the spending will pay off: Wall Street voices have noted that AI is quickly becoming more of a base-level commodity than a premium product due in part to the proliferation of open-source models, fueling doubts about whether trillions in capex are justified.

Anthropic's Claude gets a proactive sidekick

On the product side, Anthropic opened a research preview of Claude Duet, a standalone app in which the AI acts as a proactive personal agent for professionals and small business owners, powered by the Opus 5.5 model, monitoring Slack, email, and calendars, surfacing urgent items, and supporting over 6,000 connectors for tools like invoicing and payroll. Unlike a conventional chatbot, Duet is designed to message users first — delivering a morning brief and then working quietly on a hosted machine even when a phone is off — while still requiring approval before anything consequential happens. The launch places Anthropic squarely alongside Meta's Muse and OpenAI's reported "Dots" project in a fast-forming category of always-on personal agents, though for now it's limited to a waitlist for US subscribers on paid plans.

AI as a security researcher

A less flashy but arguably more consequential story came from the security world. Wiz Research, working with frontier models from OpenAI, uncovered two unauthenticated remote-code-execution flaws in PHP's upload-progress unserializer and fatal-error backtrace handling — both rated CVSS 9.2 and reaching every PHP build back to version 5.4. The PHP Foundation moved quickly, and released emergency patches the same day. It's a vivid illustration of how AI-assisted vulnerability research is becoming a genuine double-edged sword: the same pattern-matching capability that finds decades-old bugs for defenders is just as easily aimed at writing exploits for attackers — a tension cybersecurity researchers are grappling with openly this month.

Taken together, these three threads — infrastructure spending, agent products, and AI-powered security research — show an industry simultaneously maturing its offerings and still working out, in real time, how much of its own power it can safely automate.

Sources

AI AgentsAnthropicArtificial IntelligenceCybersecurityDaily AI UpdateMeta