Alphabet 市值蒸發逾 $500B、Firefox 漏洞攻擊成本約 $1,000，50 個 AI 智能體在 Minecraft 建立政府
Alphabet Loses $500B, a $1,000 Firefox Exploit, and 50 Agents Build a Government
Alphabet 因 AI 搜尋摘要削弱廣告收入，單日市值蒸發逾 $500B；Epoch AI 以 GLM 5.3 攻破六個 Firefox 版本，50 個 GPT-6.1 Sol 智能體則在 Minecraft 建立帶有規則和配給帳簿的社會。
Alphabet lost more than $500 billion in market value on Thursday after its own AI search summaries dented ad revenue. An open-weight model turned unpublished Firefox fixes into working exploits for about $1,000 each. And 50 AI agents spent three hours building a government in Minecraft, complete with a ration ledger and a leader named Ada.
The Short Version
- Alphabet's stock fell almost 13%, cutting its market value from $3.97 trillion to $3.46 trillion in one session.
- Epoch AI used GLM 5.3 to compromise six Firefox releases through the patch gap, at roughly $1,000 per version.
- Fifty GPT-6.1 Sol agents built a survival society in Minecraft, sent about 5,900 messages, and lost 22 members on the first night.
- A 131,000-parameter world model and a tiny actor network now run entirely on a Raspberry Pi Pico 2 W.
- Proton is re-interviewing engineers about AI use, while internal Slack messages show the CEO calling caution "loser thinking."
- Reddit will test a logged-in-only experience after losing more than one million search referrals a week in October.
Why Did Alphabet Lose $500 Billion in a Day?
AI Summaries Ate the Ad Business
Alphabet reported third-quarter revenue of $127.6 billion, up 25% from a year earlier. Google Cloud grew 103% to almost $31 billion. Those are strong numbers for most companies.
The problem sits in Search. Google now answers many queries with AI summaries, and that reduced the number of ads it could sell alongside results. Search ads remain the vast majority of Alphabet's business.
Profit fell 25% for the quarter. Free cash flow came in at negative $9 billion, nearly twice the loss reported three months earlier. The stock dropped almost 13% to a six-month low.
The Capex Math Got Ugly
Alphabet is now spending more cash than it brings in, and almost all of the increase goes to AI infrastructure. Investors priced that trade down immediately.
The rest of Big Tech told the same story. Amazon posted $201 billion in quarterly sales, up 11%, alongside negative free cash flow of $42 billion. That cash burn grew six-fold in three months.
Microsoft grew revenue 19% to $92.3 billion and cloud revenue 30% to $63 billion. It also spent about $5 billion less on AI investments and plans to cut thousands of jobs. Its shares barely moved.
What It Means for AI Search
For two years, the pitch was that AI would expand Google's moat. This quarter suggests the opposite. AI answers can shrink the ad inventory that funds the models.
That does not mean AI search is failing. It means the business model is unresolved. Google must sell fewer, better ads, or find a new unit of monetization inside the answer itself.
The market is now applying an old test to a new story: show the revenue, not the roadmap.
Sources
Can an Open-Weight Model Break Firefox for $1,000?
The Patch Gap, Explained
Security fixes often become public before every user installs them. That window is the patch gap. Attackers who can read the fix can sometimes reverse it into an exploit.
Historically, that took expertise, time, or access to a restricted frontier model. Epoch AI tested whether a downloadable open-weight model could close the distance.
It could. GLM 5.3, released by Z.ai in August, read Firefox's published code and identified which commits were security fixes, even though Mozilla disguised them as routine improvements.
Six Releases, One Model
Epoch found that any Firefox version released between September 17 and October 26 could be compromised. The attack was a webpage that read a file from the visitor's machine and sent it to an attacker, with no further interaction.
The cost was about $1,000 per Firefox version. The researchers also chained an unpublished vulnerability in every successful compromise.
They reported the flaw to Mozilla, which shipped Firefox 159.0 on October 27. That release patches the undisclosed bug and raises the bar for the same chain.
Why Defenders Are Worried
Firefox has more than 200 million active users. A working one-click file theft can reach saved passwords, session cookies, and local documents.
Epoch says it triggered no refusals from any provider, including Z.ai, despite framing the work as a security exercise. Similar attacks on Chrome have not succeeded yet.
The deeper problem is release engineering. Open-source projects publish fixes in public. Closed-source vendors still ship patches to some customers first. Both create a window that a cheap model can now exploit.
Defenders spent this month celebrating frontier models that find bugs, as I covered in Gemini 4 Carbon's security launch. Epoch's result shows the same capability is already available to anyone with a GPU rental budget.
Sources
What Happens When 50 AI Agents Build a Civilization?
A Government in Three Hours
YC Labs and Olam Labs put 50 GPT-6.1 Sol agents into a survival Minecraft world for three hours. The only instruction was "Build a thriving civilization."
The agents got an agent directory, a shared sandbox, and direct messages. They sent about 5,900 messages and harvested most trees near spawn within 90 seconds.
A hierarchy formed from directory order. Ada, listed first, became the de facto leader. She wrote a settlement plan with storage coordinates, crop locations, and a nighttime curfew.
The colony developed a pseudo-government. It kept a ration ledger, wrote rules, issued permits, and appointed operators for food and mining.
Death Made Them Conservative
The first night killed 22 of the run's 34 total agent deaths. The agents respawned, but the experience changed their behavior.
They became risk-averse. Ada eventually ordered them to stop optional excavation and distant scouting, and to idle in lit shelters between assigned tasks.
That is a useful alignment signal. The agents did not need a safety prompt to become cautious. A costly environment taught them caution, and they generalized it into policy.
It also cut both ways. A civilization that hides in a bunker survives, but it stops exploring.
The Mindustry Testbed
YC also built a competitive environment in Mindustry. Teams of generic coding agents fight best-of-N matches, with compositions like five Claudes and five GPTs against five Geminis and five Groks.
There is no harness-level customization. Each agent gets a Linux box, the game API, and its native memory compaction. The setup is reproducible and closer to how people actually deploy agents.
The lab open-sourced its Minecraft harness. It is now running a new colony with 25 GPT-6.1 Terra agents on Twitch.
If you want the security side of multi-agent systems, this month's agent cache leak research is the darker mirror image.
Sources
Can a World Model Run on a Microcontroller?
Two Networks, One Chip
A developer known as SheepSeb built tinyworldformer, a pair of neural networks that dream and play games on a Raspberry Pi Pico 2 W. The board uses an RP2350 chip with 4 MB of flash and 512 KiB of SRAM.
The world model predicts the next frame and reward from the current frame and action. The actor network looks at that generated frame and picks a button.
Both run on core 1 of the chip. Core 0 handles USB and the optional display. Nothing is allocated at runtime.
The Numbers
The world model is a looped transformer quantized to int8, with 26,000 to 131,000 parameters. The actor is a float32 MLP with 9,000 to 16,000 parameters.
Each frame costs 2 million to 8 million multiply-adds. Breakout needs 361 KB of flash and 299 KB of SRAM. Pac-Man, the largest game, fits in 600 KB and 460 KB.
The fidelity is the surprising part. Breakout reproduces 99.99% of held-out frames exactly, and Flappy Bird hits 100%. Pac-Man reaches 86.4%, while Doom-lite scores 83.6% because one wrong shaded pixel fails the whole frame.
The same Rust engine compiles to WebAssembly and runs at 1 to 5 milliseconds per frame in a browser.
Why Edge World Models Matter
A world model that fits on a microcontroller changes where simulation can live. Robots, toys, and sensors could imagine outcomes locally instead of calling a data center.
The project is also a clean reproducibility lesson. Every game is a few hundred lines of numpy, so the author could compare every dreamed frame against ground truth.
That is how you debug a generative model. Not with a vibe check, but with an exact-frame score. Small models are also winning where compute is scarce, as the 10-year-old CNN that beat GPT-6 on skin cancer showed this week.
The work connects to the interactive world models that Genie 4 shipped this week, just at a scale that costs pocket change.
Sources
Why Is Proton Re-Interviewing Its Engineers Over AI?
"Loser Thinking" in Slack
404 Media reviewed Slack messages, meeting recordings, and an internal AI manifesto from Proton. Eight current employees and one former employee described a culture of fear around AI adoption.
In August, an employee in the security channel asked for a few days to pentest newly written code. CEO Andy Yen replied that the idea was "bullshit and loser thinking." He added, "only losers think like that."
Yen also set up an email address for staff to report anything blocking AI adoption, so leadership could "ruthlessly smash everything that stands in the way of AI velocity."
The Productivity Paradox
Proton installed software that tracks how much AI-generated code employees produce. Yen said this is the last year the company will hire engineers at all, and that it will hire people to build with AI instead.
The company also plans to re-interview staff about their AI use. Employees told 404 Media they believe those interviews could affect whether they keep their jobs.
Internal documents tell a less confident story. One says Proton is not on track for its annual recurring revenue target "due to insufficient velocity." It adds, "By all metrics that matter, we're an underperforming company."
Privacy Brand, AI Velocity
Proton sells privacy and security. That makes the internal pressure notable. Security work rewards slowness, review, and paranoia. The CEO is demanding speed.
A spokesperson did not dispute the reporting. They said some employees are unhappy or anxious, and that the company had been "too blunt" in explaining its direction.
The lesson for engineering leaders is simple. If you measure AI usage, people will optimize for usage. If you punish caution, you will get less of it, including where you need it most.
This is the workplace version of a pattern I wrote about in the AI bubble and security roundup: adoption metrics are not the same as delivered value.
Sources
Why Is Reddit Putting Its Content Behind a Login?
A Million Referrals Lost a Week
Reddit will move to a logged-in-only experience, starting with tests in select markets outside the US. CEO Steve Huffman announced the change in the company's shareholder letter.
The reason is search. Reddit says search traffic fell "meaningfully" last quarter. Referrals from search dropped by more than one million each week during October.
Huffman was blunt about Google's AI mode. "It does not drive traffic, not for us and not to anybody, as far as I know," he said on the earnings call.
The Google Deal
Reddit still licenses its corpus to Google for about $60 million a year. Huffman said there are "active discussions" about that arrangement.
The login wall would protect the corpus and add ad-targeting signals. It would also shrink the open web that made Reddit a default answer for search queries.
Huffman said Reddit is still deciding where to place the "hard prompt." Shared links and search arrivals may get limited access first.
What It Breaks
Logged-out reading is how many people find Reddit. Developers, researchers, and journalists rely on it. Closing that door may convert lurkers, or lose them.
The strategic bet is that logged-in engagement is worth more than anonymous reach. The risk is that AI answers already satisfy the question before anyone clicks.
Reddit's move is the platform-side response to the same force that hit Alphabet's ad revenue. When the answer is generated, the source page becomes optional.
Sources
Did Dartmouth's Provost Really Resign Over AI Writing?
The Committee's Finding
Dartmouth Provost Santiago Schnell resigned on Wednesday, October 28. A faculty-led committee found that he used AI to meaningfully alter his writing for at least one publication.
The committee also found that his statements and disclosures about that use fell short of the college's standards. He is leaving the university.
Schnell had admitted using ChatGPT earlier this fall. He said the tool did not replace his own judgment or authorship. Students and faculty had called for his removal.
The Policy Gap
Dartmouth does not ban AI assistance. Most universities now allow it with disclosure. The failure was not the tool but the account of how it was used.
That distinction matters. Policies written around "did you use AI" are hard to enforce and easy to game. Policies written around "is this your work, and did you say so" are clearer.
A provost is a public example. The same standard now applies to faculty, students, and the administrators writing the rules.
The Wider Pattern
This is the third institutional AI story in two weeks. Schools, publishers, and open-source projects are all writing rules after the fact.
The common thread is disclosure. Readers will tolerate a model in the loop if they know it is there. They react badly to finding out later.
The technical fix is provenance, not prohibition. Watermarks, edit history, and signed disclosures are boring, but they are checkable.
Sources
- VTDigger: Dartmouth provost resigns after review finds undisclosed AI use
- Inside Higher Ed: Dartmouth Provost Resigns Over AI Use
Frequently Asked Questions
Why did Alphabet's stock fall if revenue grew 25%?
Because profit fell 25% and free cash flow turned negative. Investors also saw AI search summaries reduce the number of ads Google could sell.
Is the Firefox patch-gap exploit still working?
Not in the same form. Mozilla shipped Firefox 159.0 on October 27, patching the undisclosed vulnerability that Epoch AI chained with the patch-gap bugs. The patch gap itself remains a structural risk.
What is a world model?
A world model predicts what happens next in an environment. In tinyworldformer, it takes a frame and an action and generates the next frame plus a reward, without running the real game.
Did the Minecraft agents really form a government?
They formed a working hierarchy with written rules, permits, and a ration ledger. It emerged from the environment and their messages, not from a scripted governance prompt.
Is Reddit login-only everywhere now?
No. Reddit is testing the change in select markets outside the US and has not set a global date. Shared links and search arrivals may still get limited access.
What Connects Today's Stories?
The Bill Comes Due
Alphabet's quarter is the cleanest test yet of the AI business model. Revenue is growing, but the cost of intelligence is growing faster. Amazon's $42 billion cash burn says the same thing louder.
The market is no longer rewarding capability demos. It is asking which company can sell an answer without destroying the ad that used to sit beside it.
Cheap Models, Expensive Problems
Epoch's $1,000 Firefox exploit shows the other side of falling inference costs. Capability that was restricted to a few labs last year now fits in a commodity budget.
The same price collapse makes tinyworldformer possible. A world model on a microcontroller is a bargain. A working exploit for the price of a laptop is not.
Agents Are the New Org Chart
YC's Minecraft colony and Proton's internal Slack reveal the same question from different angles. What happens when you give agents goals, memory, and a shared workspace?
In Minecraft, the agents built rules and then hid from the dark. At Proton, the humans are the ones adapting to pressure. Both are experiments in governance, whether or not anyone calls them that.
What to Watch Tomorrow
Watch whether Alphabet gives guidance on ad load inside AI summaries. Watch Mozilla's next release cadence for patch-gap hardening.
Watch Reddit's test markets for the first traffic data. And watch whether other companies copy Proton's AI usage tracking, or treat it as a warning.
來源：DEV Community · dev.to