Putting Scammers to Work for AI

I came across a fascinating AI startup case: Apate.ai, an Australian anti-fraud company.

In 2026, it raised US$8.15 million in a new funding round.

It deploys many AI agents to pose as potential victims and engage scammers. These conversations consume scammers’ time while collecting intelligence such as fraudulent accounts, websites, and scripts. The company uses this information to provide anti-fraud intelligence services to banks, telecom operators, and other clients.

The numbers speak for themselves:

  • ~350,000 AI bots
  • 2.5 million scam conversations collected
  • 250,000+ structured fraud intelligence records
  • 17 cumulative years of scammer time consumed
  • Longest single conversation: 2 hours, 12 minutes

How it works:

  1. Detect fraud activity — via suspicious calls, SMS, social media messages, or phishing sites
  2. Deploy AI agents as “victims” — to delay, probe, and extract clues
  3. Structure and enrich intelligence — URLs, accounts, scripts, wallets, relationship graphs
  4. Integrate with banks’ risk systems — enabling risk detection, account investigation, alerts, and transaction blocking
  5. Monetize sustainably — via subscription licenses, data asset licensing, and continuous agent capability upgrades

Doing this work with people would be very costly. AI makes scenarios like this much easier to implement.

GEOInflow

During Saturday night’s live stream, I introduced two systems: Liekan GEO and GEOInflow.

Liekan GEO is our internal commercial GEO operations platform, built to support our own GEO projects. It includes dashboards, reports, content management, and distribution management. Agents also improve efficiency and quality across operational stages.

GEOInflow, by contrast, is a brand-new open-source system—a dedicated GEO traffic analytics tool for websites. To our knowledge, no comparable open-source solution exists globally. GEOInflow fills a clear gap in the monitoring stack.

We are releasing it as open source jointly with Beijing Daily, with the official introduction planned for Monday.

After the demo, I spent around 30 minutes answering questions. I found this format valuable for explaining industry principles and methods, and hope to hold these interactive sessions more frequently.

Pay Attention

My daughter just started first grade. Lately, we’ve been playing chess together.

I let her win—just barely—near the end of each game. She feels accomplished. So much so that at breakfast this morning, she asked me to come home early for tonight’s match—and reminded me: “Pay attention!”

I said, “No problem.”

After the game, the three of us take a family walk in a nearby park. There, my daughter and I have two little challenges:

First: The pull-up bar. We race to see who can hang longer. I usually win—by 1–2 seconds. She always asks for a rematch.

Second: A sprint of about 200 meters. I run slightly slower to let her win, then gradually increase the pace over successive rounds. She told me that in PE class, she now outruns the fastest boy in her class, and her teacher keeps praising her.

“Does that make you the fastest in your class?” I asked.
“Yes!” she said.

By bedtime, she’s won two out of three contests—chess, strength, speed—and goes off to brush her teeth and sleep, completely satisfied.

A Minimalist Yangming Philosophy

Wang Yangming’s core ideas:

  • The mind is principle: Turn inward to ground judgment.
  • Knowledge and action are one: True knowing includes doing.
  • Realizing innate moral knowledge: Act on conscience—cut through self-deception.

For me, seven lines crystallize his teaching:

  1. The mind is principle: Seek the root of right/wrong within.
  2. Realize innate moral knowledge: Continuously examine your choices—what is good, true, just?
  3. Knowledge and action are one: Knowing begins action; action completes knowing.
  4. Temper yourself through practice: One must be forged in action to stand firm (“learning by doing”).
  5. My heart is luminous: When the heart is clear, no further words are needed.
  6. Easier to crush bandits in the mountains than thieves in the heart.
  7. Without resolve, nothing in the world can be accomplished.

At its core, Yangming’s philosophy is about preserving inner clarity amid complexity. That clarity translates into three daily questions:

  • Before deciding: Am I judging based on facts and duty—or rationalizing what I want?
  • After learning something: What small thing can I do today to put it into practice?
  • When facing failure: Will I admit my mistake—and bear the cost of change?

If Yangming’s path were distilled into a lifelong practice, it would be three things:

  1. Resolve: Know why you began.
  2. Confrontation: Name the inner “bandits” you must overcome.
  3. Luminosity: Live so your life itself answers why it matters.

Tencent’s GEO

The AnswerBit team from Tencent visited us for over an hour of deep discussion about their GEO product. Their thinking offered several useful insights:

  1. Positioning: A SaaS platform with two core capabilities: GEO data monitoring and GEO content generation. It focuses on tools, with distribution, services, and operations outside its scope.
  2. Data advantage: Data is an important strength. Like other mainstream approaches, they collect it using crawlers they built themselves.
  3. Rich metrics layer: They’ve built multi-dimensional, hierarchical dashboards with unusually granular data points.
  4. User-intent mining: They use data collected from various AI search platforms, together with AI or algorithms, to identify user-intent questions. The strategy is broad coverage of questions across many target-user scenarios.
  5. Commercial model: Standardized “credit packages”—every feature consumes credits priced against actual infrastructure cost.
  6. Ecosystem vision: They explicitly seek complementary partnerships—especially with service providers and GEO agencies—offering API access to their data and tooling.
  7. Strategic framing: Tencent sees AnswerBit as an important entry point into AI marketing and plans to expand its products around that broader field.
  8. UX challenge: They acknowledged that the current product has strong engineering but can be difficult for beginners. They hope to add agents so users can operate its functions through conversation.

PHP Vulnerabilities

This week, AI uncovered two critical PHP vulnerabilities—shaking the global web security community.

OpenAI disclosed them; PHP released emergency patches. Both flaws carry a CVSS 4.0 severity score of 9.2—“critical.”

Their impact is broad: websites using affected PHP runtimes may allow attackers to execute malicious code without logging in to the website’s administration area, or steal sensitive information.

Urgent recommendation for site owners: Immediately check your PHP version and apply official or vendor-provided security updates. Then verify core functionality.

What are the vulnerabilities?

CVE-2026-109618 (Memory Exhaustion Handling Flaw)
An attacker sends specially crafted HTTP requests that trigger memory exhaustion during PHP request processing. In some cases, PHP incorrectly handles uninitialized memory—opening the door to remote code execution.

CVE-2026-109619 (Global State Residue Flaw)
After handling one request, PHP fails to fully reset certain memory states. When the same worker process handles the next request, it may reuse stale, already-freed memory—allowing attackers to manipulate execution flow.

Impact

Successful exploitation could let attackers:

  • Control the PHP runtime environment and install backdoors or malicious programs
  • Steal database credentials, user data, and API keys
  • Deface or redirect website content
  • Use your server to attack other systems
  • Cause downtime or data leaks

Which sites are affected?

Any site running vulnerable PHP versions—including WordPress, GEOFlow, Drupal, Joomla, and custom PHP apps.

How to check

Use OpenAI’s free detection tool:
php2shell-checker

How to fix

Upgrade PHP to a patched version.

  • If using official PHP builds: upgrade to the latest supported patch release.
  • If using Baota, Ubuntu, or cloud hosting: install your provider’s security update.

Will upgrading break my site?

  • Security patches within the same PHP release branch usually make compatibility risk easier to manage.
  • Upgrades across major PHP versions may affect older code, plugins, and extensions.
  • Always back up files, databases, and configs before upgrading.
  • After upgrading, test homepage, login, forms, file uploads, DB connections, and payment flows.
  • If the site was exposed for a long time, also review access logs, unusual processes, suspicious files, and account activity. Patches address further exploitation of the vulnerabilities; any malware from an earlier compromise requires separate investigation and removal.

Resources

  1. OpenAI’s disclosure (Chinese):
    openai.com
  2. PHP official announcement:
    php.net
  3. CVE-2026-109618 advisory:
    php-src
  4. CVE-2026-109619 advisory:
    php-src
  5. Wiz technical deep dive:
    wiz.io
  6. Self-check tool:
    php2shell-checker