Two outlets, one breathless. The exploit details are still missing.
An OpenAI frontier model apparently helped surface a vulnerability affecting millions of PHP-based web servers, and two outlets are covering it with very different registers. Futurism calls it 'stunning' in the headline; WaPo calls it a scramble. Neither piece, based on available excerpts, names the CVE identifier, the specific model involved, or how many servers have been patched. The story may be real and serious. The coverage isn't there yet.
OpenAI frontier model exploit leaves millions of web servers vulnerable to attack
2 sources · hover a dot to see coverage
What happened
A security vulnerability connected to an OpenAI frontier model has been reported to affect millions of web servers, apparently those running PHP. The Washington Post framed it as an active response effort, with sites working to patch the flaw. Futurism described it as an exploit that 'leaves millions of web servers open to attack.' No available excerpt names the specific OpenAI model, the attack vector, the CVE designation, the researcher or organization that discovered it, or the timeline of disclosure. The scope claim — millions of servers — appears in both outlets but without a sourced figure behind it. That is the wire version. Two outlets have it, and the gap between what the headlines promise and what the reporting delivers is the story worth watching.
WaPo treats it as a patch story; Futurism treats it as a catastrophe
The Washington Post headline puts the action on website operators: 'scramble to fix.' That framing assumes a known fix exists and that the response is underway, which is the more reassuring read. Futurism's headline calls the exploit 'stunning' and says servers are 'open to attack,' present tense, with no patch implied. Both outlets use the 'millions of web servers' figure, but neither excerpt attributes it to a researcher, a scan, or a security firm. One outlet is covering a response. The other is covering a threat. They may both be right, but they cannot both be complete.
What one side told you that the other didn't
Neither outlet names the model, the CVE, or the researcher.
The central claim — that an OpenAI frontier model is implicated in a web server vulnerability — appears in both headlines and in neither set of details. No excerpt identifies which model, which version, or what role it played: did it discover the exploit, generate the exploit code, or something else? No CVE number appears. No security firm or independent researcher is credited. A vulnerability affecting millions of servers is a significant disclosure event with a paper trail. That trail is not in this coverage.
Right-leaning outlets are not covering this at all.
A story about an AI company's model being linked to a mass internet vulnerability is exactly the kind of AI-risk story that travels across the political spectrum — when it involves, say, Chinese state actors or regulatory failure. Here, with OpenAI as the named party, conservative and right-leaning outlets have published nothing in this story set. That absence doesn't prove editorial choice over editorial bandwidth, but it is a clean gap: two left-of-center outlets, zero from the right, on a story with obvious implications for AI accountability.
What to watch
If a CVE is formally published or a major security firm (Rapid7, Tenable, Qualys) issues an advisory in the next 48 hours, watch whether right-leaning tech and policy outlets pick it up then — and whether they frame OpenAI's role as negligence, a capability demonstration, or bury the company name in favor of the vulnerability itself.
This kind of gap — where one side reports a fact and the other doesn’t mention it — shows up in about 40% of major stories.