# WP Weekly 295 – Back > [!question] Lingering Questions > - Does the 24-hour auto-update delay create its own risk window (known-vulnerable versions staying live a day longer) that offsets the review benefit? > - Is the Abilities API surface shipping with adequate capability/permission gating, or is the attack surface widening faster than it's being secured? > - Are the Kinsta and GoDaddy figures representative, or only of each vendor's own (skewed) customer base? > [!tip] Article Ideas > - "Shipping Abilities API support" using SEOPress and Stream as worked examples — the quarter's dominant plugin-integration pattern, concrete enough for a how-to. > [!link] Cross Reference > - [[3. Resources/Permanent Notes/Core Abilities Must Be Consumer-Neutral Primitives Not One Interface's Mirror]] — same Abilities API surface, different angle (API design principle vs. adoption trend) > - [[3. Resources/Permanent Notes/An Ops Agent Is Only as Capable as Its System Access]] — relevant to the review-window / agent-access tradeoff > - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — bot traffic and the auto-update delay are both hosting-security infrastructure items > [!quote] Vocabulary > - **Abilities API** — WordPress's emerging machine-interface layer; exposes plugin data/actions (SEO fields, audit logs, form data) so any MCP-aware client (Claude, Cursor, ChatGPT) can read and act on them. > - **llms.txt** — a proposed site-level file signaling content to AI crawlers; per an Ahrefs study cited in this issue, 97% of published llms.txt files are never read by bots or humans. ## Metadata - Source: [[3. Resources/Readwise/Articles/WP Weekly 295 – Back]] - Author: Davinder Singh Kainth (The WP Weekly) - URL: https://thewpweekly.com/issue-295/ ## Author's thesis Issue 295 (returning after a WordCamp Europe hiatus) is a state-of-the-ecosystem digest: WordPress.org is standing up an AI-assisted security-review posture (a 24-hour auto-update delay) and a machine-interface layer (Abilities API/MCP adoption across SEOPress, Stream, WPForms, SureCart) at the same moment the platform faces measurable market-share erosion (33%, down from 36%), a widening third-party breach (Awesome Motive), and rising AI-bot infrastructure cost. ## Key arguments 1. **The 24-hour auto-update delay institutionalizes AI-assisted security review** — a structural change from instant to reviewed update propagation. 2. **The Abilities API is becoming the default machine-interface for WordPress plugins** — four major plugins shipped support in a single issue, making agent-readable plugin data the quarter's dominant integration pattern. 3. **AI bot traffic is now a first-order infrastructure cost**, not a nuisance — vendor data (Kinsta) puts it at roughly 1 in 31 visits with a 300%+ yearly surge. ## Claim atoms ### WordPress is adding a 24-hour security-review window before auto-updates distribute > [!quote] ID:rw_pending > "WordPress.org is adding a temporary 24-hour delay before plugin and theme updates are distributed through auto-updates. The pause creates a window for security review, including the use of AI-assisted tools that can operate continuously." Where/why: changes the update threat model from instant propagation to reviewed propagation; sits against the backdrop of the widening Awesome Motive breach. ### The Abilities API is becoming the default machine-interface for WordPress plugins > [!quote] ID:rw_pending > "Now the same data is also exposed as a set of WordPress Abilities, and any MCP-aware client can read and act on it: Claude Desktop, Claude Code, Cursor, ChatGPT, anything that speaks the Model Context Protocol." Where/why: SEOPress, Stream, WPForms, and SureCart all shipped Abilities API/MCP support in this single issue — a genuine adoption-wave signal, not one vendor's announcement. ### AI bot traffic is now a first-order hosting cost > [!quote] ID:rw_pending > "over 300% bot traffic surge in one year, 1 in 31 web visits is an AI bot, and over 3.75M 'add to cart' hits from one bot in 24 hours." Where/why: Kinsta, 10B+ requests analyzed (a vendor study — self-selection caveat applies); reframes bot traffic as a budgeted infrastructure line item rather than background noise. ## Permanent candidates - **The 24-hour review window as a speed-for-safety tradeoff** — a genuine, reusable claim about how a timed review gate changes an update channel's threat model. Promoted below. - **Abilities API adoption as the quarter's default integration surface** — a distinct trend claim (not the same as the existing consumer-neutral-primitives design note). Promoted below. - The bot-traffic figure is vendor-sourced and single-study; not promoted on its own, but flagged in Lingering Questions for independent verification. ## Processing checklist - [ ] Independently sanity-check the Kinsta "1 in 31 visits" figure against courtneyr.dev logs before citing it externally - [ ] Watch whether Abilities API adoption produces a measurable security-incident spike as plugins expose more write surfaces - [x] Connect into the relevant MOC — [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] ## Links - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — auto-update delay and AI bot traffic are both fleet/hosting-security infrastructure signals - [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] — Abilities API/MCP adoption is the WordPress instance of agent-readable software becoming the default integration layer