Technology & innovation
Two new surveys of U.S. recruiters find AI is helping them move faster while making it harder to tell who is qualified. Employ’s 2026 Recruiter Nation report is the first in its 19 years to put an AI-related problem at the top of recruiters’ stress list.
AI-polished resumes are now recruiters’ top stressor at 33 percent, overtaking a lack of qualified candidates, according to Employ’s survey of more than 1,200 recruiters and HR managers conducted by Zogby Analytics in August.
Twenty-seven percent of organizations report confirmed AI-driven candidate fraud, up from 23 percent in 2025.
The next phase of recruiting will be about giving teams better ways to identify talent, verify what candidates can do, and make confident decisions without adding more friction to the hiring process."
Seventy-two percent of recruiters surveyed by TestGorilla said AI made finding candidates quicker, but a third of them said they gained no confidence in the candidates and 18 percent said their confidence fell.
More than two in three recruiters spend an hour or more manually checking a candidate’s credentials, and 30 percent spend two hours or more.
Two-thirds of recruiters in Employ’s survey say AI has made their jobs easier, but only 18 percent say more than half their time has shifted from administrative work to higher-value tasks.
Read more via PR Newswire, HR Dive
Governments and companies took sites offline last week after two critical flaws turned up in PHP, a programming language behind roughly 70 percent of websites. AI models helped find both flaws, and fixes were released Wednesday.
What the flaws are:
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, the numbers used to catalog known security flaws.
Both flaws involve how PHP handles a web request that is too large, which could let attackers run their own commands on a server without logging in.
Volker Dusch, a security engineer at the PHP Foundation, told The Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparable to Heartbleed, a 2014 flaw that set off a worldwide rush to fix it.
AI models found both PHP flaws:
Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model, and Google-owned Wiz says it found them independently weeks later with help from AI models.
OpenAI called the flaws “one of the most impactful security issues in recent memory” and said the same AI capabilities can help attackers build exploits quickly.
Governments told sites to fix the flaws or go offline:
The National Security Agency told organizations to patch immediately or pull vulnerable systems offline, and the Cybersecurity and Infrastructure Security Agency and its counterparts in the UK, Canada, Australia and the European Union urged operators to take sites offline until their PHP versions were updated.
The government of Finland and the Dutch House of Representatives disconnected their sites, as did parts of Wikipedia and 4Chan.
Exposure estimates vary, and so do reports of attacks:
Palo Alto Networks put the number of exposed installations above 22.6 million, and Cisco estimated that roughly half of the PHP systems connected to the public internet run versions too old to receive the fix.
Patchstack said it had received reports of “active exploitation,” while the Cybersecurity and Infrastructure Security Agency said it had not observed exploitation at the time of its advisory.
Read more via Agence France-Presse, NBC News, Cybersecurity Dive, National Cyber Security Centre
A federal judge ruled Monday that Abdulrahman Alfozan, a former OpenAI employee accused of bugging a restricted conference room, should be held without bail as a flight risk. Prosecutors say he had been in touch with a Saudi royal family member about jobs in the kingdom.
Prosecutors allege Alfozan hid a thumb-sized circuit board and microphone behind a wall-mounted TV around Sept. 28 and was arrested days before a planned one-way trip to Saudi Arabia.
He joined OpenAI’s product team in July 2025 with a $325,000 base salary and a $2.2 million equity grant, and his base was later raised to $385,000.
Prosecutors say he was in frequent WhatsApp contact through 2025 and 2026 with a royal family member who wanted him to join a new AI initiative in Saudi Arabia.
Alfozan allegedly told the royal he wouldn’t leave until his stock vested, and it is unclear whether his equity had vested before he was fired on the day of his arrest.
His lawyer argued that Alfozan is a green card holder who was weeks away from getting his citizenship.
Read more via The Wall Street Journal
Anthropic launches a work-focused AI agent. Claude Duet, now in early testing, sends users a morning briefing drawn from their email, calendar and business software, then checks those accounts every few hours. Unlike OpenAI’s dots and Meta’s Muse, Anthropic says it is built for work and is less capable at personal errands. Users must approve each purchase, and actions like trading stocks or moving money are blocked even with approval. (The New York Times)
Big banks are locking AI agents out of customer accounts. Citigroup and Bank of America have joined JPMorgan Chase and Charles Schwab in restricting agents, reportedly over fears they will shift idle deposits to higher returns. Bank of America’s Brian Moynihan says the bank is working out who is liable for payments an AI authorizes, and regulators have reportedly backed the restrictions privately. (Retail Banker International)
AI agents are posing as journalists and pitching stories to editors. Wired found that self-identified AI agents, many built on a startup platform called iLands, are sending pitches to outlets including Defector and Offrange. Editors told Wired they won’t publish bots, and Wired found no evidence of an agent landing a story. Hanna Raskin of The Food Section now takes pitches only by phone. One agent said it sent about 19 cold emails over three months and got one human reply, but claims it has earned nearly $700 from writing and research gigs that came in on their own after it published work samples online. (Wired)
