Tag: ai

I give up.

I’m sitting on my balcony. A translucent plastic bag is caught in the tangled nest of power lines in front of the main road. It has been there for three weeks, flapping rhythmically in the humid, smog-choked exhaust. It’s tattered, sun-bleached, and utterly fucking useless, yet it refuses to disintegrate. It is, in every sense, the perfect atavistic metaphor for the “Open Web” in 2026: a piece of trash that everyone sees, no one fixes, and that will eventually cause a short circuit that burns the whole block down.

Then WordPress 7.0 was officially released on May 20th, 2026.

As a plugin developer, I had received the announcement a week in advance, at 02:12 – unfortunately, my most productive time in this timezone –, the “WordPress Release Squad” (a title that suggests tactical precision but delivers the soul-crushing optimism of a municipal dental convention) slid into my inbox. The subject line read: “WordPress 7.0 is imminent! Are your plugins ready?”

If I only had known at this point, since this whole thing had already started at least half a year ago. The first alpha version was out on November 12, 2025.

In the email, the “Squad” announced that version 7.0 is shipping on May 20th, 2026, which is what happened, after a delay of the initial release date in April. They announced a “fresh coat of paint” called the Modern admin theme. And, buried in the bullet points like a landmine in a sandbox, they announced the new “AI Client” and “Abilities API”.

This is where the story stops being a software update and becomes a eulogy.

The Thirty-Hour Joke

To understand the sheer, crystalline – though private – absurdity of this moment, you need to know what I’ve been doing over the last few weeks. I am a Senior Full Stack Developer. My time is expensive, and my patience for repetitive manual labor is nonexistent.

So, I built a plugin. I didn’t vibe-code it. I built it.

Its purpose was simple, elegant, and necessary: it hooked into the WordPress upload pipeline (wp_handle_upload_prefilter, for the nerds) and used a vision LLM by Groq, which for a long time churned out free API keys as if it hadn’t heard of the buzzing datacenters that could keep entire countries running, to look at the entropic filth of a file named DSC_8291_FINAL_v2.jpg and automatically rename it to sunburnt-foreigner-drinking-cheep-beer.jpg. It also generated alt="..." – a notoriously important detail for SEO, as we all know. It was a clean solution to a problem that has plagued the internet since the invention of the digital camera.

I called it “AI Image Renamer.” You know, because that’s what it did.

I spent thirty hours of my life writing this. Not generated hours. Actual, linear, human hours. The kind you do not get back. I burned through a nontrivial amount of my own LLM API credits to run test after test after test. I built a damn VitePress documentation site. I designed a landing page for a future PRO version. The code was pristine, if I may be so bold as to say this about my own creation.

Then, I submitted it to the WordPress Plugin Review team.

“Too Generic”

Now, if you have never dealt with this specific cabal of open-source bureaucrats, imagine a DMV run by people who think reading PHP codebase diffs is a substitute for a personality. They sent me an email listing a Kafkaesque array of demands. They forced me to change the name because “AI Image Renamer” was apparently too “generic” and violated their brand guidelines. I was not allowed to use my @gmail account and had to create one for my real website, kolja-nolte.com. I think you can imagine the level of absurdity we’re talking about here.

It was reviewed by the reviewers, who seem to guard the WordPress repository with the same misplaced heroism as a mall security guard defending a Cinnabon. The name was apparently “too generic”; it failed to meet their highly specific, utterly arbitrary nomenclature guidelines. But I gave in; all these hours, they shouldn’t have been for nothing. So I renamed it Viscribe. You know, something between “vision” and “scribe”. I jumped through every pedantic hoop. I submitted the final, sanitized, perfectly compliant version literally hours before I received the WordPress 7.0 announcement email.

And what does WordPress 7.0 introduce natively, baked right into the core?

“Alt Text Generation” via vision models.

Cool.

They didn’t just move my cheese. They paved over the farm, built a state-sponsored cheese factory, and invited 43.5% of the internet to come and get it for free.

Please, do not mistake this for whining. I don’t care about Viscribe’s death. My ego will survive the loss of a freemium plugin that I can still use on one of my many websites, including this one. The tragedy here is not my wasted weekends; the tragedy is what WordPress has actually built, how they built it, and what it is about to do to human knowledge. So, let’s get to that.

The Vault is Open, the Guards are Dead

Let’s look at the technical architecture of this impending disaster. WordPress 7.0 introduces the “Connectors API”. The idea is that you go into your dashboard, select the AI provider of your choice (OpenAI, Anthropic, or Google), and paste in your API key. Suddenly, your CMS has a brain. Or, if you prefer the more accurate description: a very advanced autocomplete.

Here is the punchline, and I want you to read this carefully: There is no encryption.

Sitting here, having installed WordPress 7.0 on this very blog, there is no pull request in the core repository (to be fair, there is one in the plugin version) that proposes encrypting these API keys in the database. Your digital API key – the alphanumeric string that is directly tethered to your actual, real-world credit card – is stored in the wp_options table in plain, readable text.

Let that sink in.

WordPress, a platform so notoriously insecure that getting hacked is considered a rite of passage for small business owners, has decided that the best way to handle billing-enabled API keys is to just leave them under the digital doormat. It’s a level of architectural negligence that borders on the avant-garde. If a script-kiddie compromises a forgotten dental practice blog running a vulnerable slider plugin on WordPress 7.0, they don’t just get to deface the homepage anymore. They get to harvest an Anthropic API key and run their own crypto-scam LLM farm on the dentist’s dime.

Because releasing a version worldwide with unencrypted API keys in the database is so dumb that all these months seem to have not be enough to address this cause. That’s why I have no shame in giving you the SQL syntax to query them:

SELECT
	*
FROM
	`wp`.`wp_options`
WHERE
	(BINARY `option_id` LIKE 'sk-%')
	OR (BINARY `option_value` LIKE 'sk-%')
ORDER BY
	`option_id`
LIMIT
	300
OFFSET
	0;

SELECT
	*
FROM
	`wp`.`wp_options`
WHERE
	(BINARY `option_id` LIKE 'sk-%')
	OR (BINARY `option_value` LIKE 'sk-%')
ORDER BY
	`option_id`
LIMIT
	300
OFFSET
	0;

This one, as you can see, will check for API keys that start with sk-, which are a lot of providers. But don’t worry, if yours is PPLX, as in: Perplexity, I have you covered:

SELECT
	*
FROM
	`wp`.`wp_options`
WHERE
	`option_name` LIKE '%connectors_ai_%'
ORDER BY
	`option_id`
LIMIT
	300
OFFSET
	0;

SELECT
	*
FROM
	`wp`.`wp_options`
WHERE
	`option_name` LIKE '%connectors_ai_%'
ORDER BY
	`option_id`
LIMIT
	300
OFFSET
	0;

Or just look inside wp_options – the table where all the plugin secrets are “hidden”. We’ll run a straightforward SQL query to find the one named connectors_ai_. The core team of WordPress 7.0 thought this would be the best naming convention to store different provider keys.

Oh, you know, while we’re at it, and eventually every 14-year-old script kiddy “bragging” with “I use Arch, btw,” I go even further and give you the SQL query:

SELECT
	*
FROM
	`wp`.`wp_options`
WHERE
	`option_name` LIKE '%api_key%'
ORDER BY
	`option_id`
LIMIT
	300
OFFSET
	0;

SELECT
	*
FROM
	`wp`.`wp_options`
WHERE
	`option_name` LIKE '%api_key%'
ORDER BY
	`option_id`
LIMIT
	300
OFFSET
	0;

And why not a script itself? But this once, I offloaded it to GitLab Snippets. ~30 lines of code, that’s all it takes. Your only requirement: access to either the (S)FTP/SSH to drop the file into the root directory, or installing one of the file browser plugins that allow you to simply create one.

And it gets better. In WordPress 7.0, you can add multiple “Connectors” via plugins. But if you have more than one hooked up, the system offers zero granular routing. Which provider summarizes the text? Which one generates the image? Who knows. Let them fight, I guess? It is a system designed by people who understand the buzzwords of AI but possess a touching, almost childlike indifference to how software is actually used in the wild, not too far from the infamous introduction of the Gutenberg editor (I just checked, out of 3,871 ratings, it achieved: 2.1).

The “Experiments” in Automated Mediocrity

But the true horror of WordPress 7.0 isn’t the catastrophic security flaw. It’s the “AI Experiments” plugin, which will inevitably be merged into core, at least according to this article. It’s a laboratory of features that will soon become standard. I read through the testing reports. I looked at the capabilities. It is a masterclass in treating symptoms while ignoring the disease.

Let’s review the arsenal:

1. Excerpt Generation

You write a post. You’re too tired (i.e., lazy) to summarize it. You click a button, and Claude or whatever LLM you’ve hooked up reads your post and writes the excerpt for you. We are now using machines to summarize texts that were likely generated by machines, for an audience of search engine bots that are also machines. The human is completely removed from the transaction, and would even make Google’s crawlers dizzy when trying to assess a website’s quality.

2. Alt Text Generation

The exact feature I built. You upload an image, and the AI describes it. It doesn’t rename it, though, as mine does. The testing reports call this “the standout feature” (WordPress 7.0 Release Notes). And it is. It is undeniably useful for SEO and accessibility. But it is also the final admission that we can no longer be bothered to describe our own visual reality. We need Elon Musk’s laughable “space servers” (or just a datacenter in California) to look at our vacation photos and tell a blind user, “A person standing in front of a building.”

3. Title Generation

You click a button, and the system generates three to five title suggestions. The modern internet is entirely driven by the clickability of headlines, and we are now outsourcing psychological manipulation to algorithms. It spits out variations of the same tired, high-engagement, clickbaity AI slop you’d expect.

4. Review Notes

The AI will also analyze your post block by block and give you suggestions on grammar, accessibility, and SEO. You now have an automated editor sitting on your shoulder, enforcing a sterile, statistical average of “good writing.” It flags sentence fragments. It demands higher keyword density. It will systematically sand down any edge, any rhythm, any actual voice you might have had, until your text reads exactly like the documentation for a mid-tier SaaS product.

5. Content Summarization

For those moments when the generated excerpt isn’t enough, you can generate an “At a Glance” box. More compression. More flattening of information.

WordPress 7.0 gives the masses a button for “Content Summarisation.” A button for “Title Generation.” A button for “Excerpt Generation.” As if the internet doesn’t have enough problems with AI-generated shit content.

Welcome to the Slopocalypse

We all know what is going to happen. The Dead Internet Theory is no longer a fringe conspiracy on Reddit; it is the official product roadmap of Automattic, the for-profit company behind the free .org version. WordPress powers roughly 478 million websites. Millions of non-technical bloggers, SEO grifters, and passive-income hustlers are about to realize that with WordPress 7.0, they never have to write a single word ever again.

Imagine the lifecycle of a blog post in late 2026 with WordPress 7.0 installed:

1. An AI agent scrapes a news article (which was likely written by an AI).
2. The WordPress “Abilities API” intercepts it.
3. The WordPress user clicks “Summarize Content.”
4. The AI generates a 300-word block of aggressively beige, perfectly grammatical slop.
5. The user clicks “Generate Title.”
6. The user clicks “Publish.”

Or you just use one of their documentations to look up a filter or action hook to do all of that automatically.

The Digital Centipede

The internet will become a closed loop of algorithmic regurgitation. It will be a digital centipede where meaning is chewed up, digested, and shit out, losing context and humanity with every iteration, until the entire web is just trillions of tokens of polite, SEO-optimized noise.

I am not angry about Viscribe. I said that before. My thirty hours are gone, and that is fine. Software development is essentially the practice of building sandcastles at the edge of the tide. You know the water is coming. Instead, what I am experiencing is a profound, heavy resignation.

I look at the new Modern admin color scheme in WordPress 7.0. It is very clean. The View Transitions plugin makes sliding from one screen to the next feel smooth. The “Connectors” are mostly made by the company itself. The engineering required to build this interface is – and I have no problem admitting this – genuinely impressive. Yet, they have built this beautiful, fast, responsive interface solely to make it easier for us to stop doing what blogs were meant to do: being creative.

The Upgrade That Went Too Far

They are framing this as an “upgrade’’. They are wrapping it in a “sleek, new color scheme” with “seamless visual transitions”. It is efficient in the way that bureaucracy is efficient: technically in motion, spiritually dead.

The plastic bag outside my window is still flapping, by the way. I used to find it annoying, a symbol of urban decay in this concrete jungle. Now, I look at it with a strange kind of fondness. At least the bag is real. At least it hasn’t been parsed, summarized, and rewritten by a language model to be “more engaging,” as WordPress 7.0 websites will undoubtedly. And WordPress 7.1 is already in development.

I will close my tab now. I will leave the API keys in plain text where they belong. I will go downstairs, walk out into the Bangkok heat, and find a bar. I will order a drink and pay for it in cash. And when the bartender asks me how my day was, I will have to formulate the answer myself, using my own words, in real-time, without a single machine suggesting that I adjust my tone for “better engagement”.

The internet is over. It was fun while it lasted. Enjoy the slop to come.

Note: This post was updated on May 25th, 2026, at 00:11 to highlight and document how easy it is to steal the API keys of WordPress 7.0 AI users.