Top line

OpenAI's automated pipeline produced 948 Linux root exploits in 10 days

OpenAI published results Wednesday from an autonomous pipeline running an upcoming cyber model against the latest Linux kernel in mid-October. It reproduced 1,724 vulnerabilities and built 948 distinct local privilege-escalation exploits that worked on a stock desktop distro with SMEP, SMAP, KASLR and hardened usercopy on. The run cost $1,213,430 in API credits, about $1,279 per exploit. By the end of the scan, 61 fixes had landed upstream and 43 more were in staging, with OpenAI working through the Patch the Planet partners on the rest.

Why it matters: OpenAI's own advice is to treat any unprivileged account on an unpatched Linux host as root. Shared build runners, multi-tenant hosts and agent sandboxes should rely on VM-grade isolation such as Firecracker or gVisor, not just user separation.

Sources: OpenAI research post · @OpenAI post

Images 2.6 is live in ChatGPT, Codex and the API

OpenAI released Images 2.6 at 5:35 PM CT Wednesday across all ChatGPT tiers and in Codex. In the API it ships as two models, gpt-image-2.6-flare and gpt-image-2.6-sunburst. OpenAI says generation is 50% faster, and Flare can return a low-quality image in about 6 seconds. New features include GIFs, saved reference images, image markup, SVG export and a complexity parameter. Codex now edits images in an overlay.

Why it matters: Teams that generate UI assets, diagrams or icons get vector output and faster drafts. Test the two API models against your current image model before switching.

Sources: OpenAI announcement · @OpenAI post

Kimi K3.1 Pro weights are out, with day-one hosting

Moonshot released Kimi K3.1 Pro weights at 10 AM CT Wednesday. vLLM lists it at 2.8 trillion total parameters, 104 billion active, with a 1 million-token context, and shipped a dedicated container the same morning. Together, Ollama Cloud and Nebius had it running the same day, and Together now serves it at $2 per million input tokens and $10 per million output. The Hugging Face repo lists its license as "other," so read the terms before you deploy it.

Why it matters: This is a frontier-scale open model you can host yourself or buy from several providers. It is a real option for data-residency needs, if the license fits.

Sources: @Kimi_Moonshot post · Hugging Face repo · Together changelog

CISA lists an exploited 2024 Apple WebKit flaw, due Nov. 18

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on Nov. 4. Apple says an attacker with arbitrary read and write access can use the WebKit bug to bypass pointer authentication. It was fixed in May 2024 in iOS and iPadOS 17.5 (16.7.8 for older devices), macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5. Federal agencies have until Nov. 18.

Why it matters: Any Apple device still below those versions is now a known target. Use your MDM to find stragglers, especially older iPhones and iPads.

Sources: CISA KEV catalog · Apple iOS 17.5 security notes

What to do

  • Isolate shared Linux hosts and CI runners with VM-grade sandboxing, and keep kernels current. OpenAI research post
  • Find Apple devices below the 17.5 and 14.5 releases before Nov. 18. Apple iOS 17.5 security notes
  • Re-check Actions runs and Pages deploys from 10:05 AM to 12:16 PM CT Wednesday, when GitHub had two major Actions incidents. GitHub incident
  • Edge still hasn't shipped the Chromium security fix it promised Nov. 3, so keep watching. Edge security release notes

Also notable

  • Claude Code usage: Anthropic says status updates for background subagents now come from Haiku 5.5, which cut usage in those sessions by about 5%, or roughly 6% more prompts. It applies on v2.1.316 and later. @ClaudeDevs post
  • OpenAI buys Pierre: OpenAI is acquiring Pierre Computer Company to build out Codex tools for understanding and reviewing code. OpenAI announcement
  • Copilot in Xcode: GitHub Copilot now works inside Xcode's built-in coding assistant, in public preview. GitHub changelog
  • Cloudflare: Sites can now see and set policies for personal AI agents that act for users. AI Gateway also added model aliases, which fall back across a pool of models under one name. Cloudflare blog · Cloudflare changelog
  • US regulation: Pentagon CTO Emil Michael said the government will publish the laws that apply to domestic AI labs "in the next week or two," Reuters reported. Reuters via Investing.com
  • Codex limits: OpenAI's Tibo Sottiaux announced no new resets or limit changes. The Oct. 29 Pro doubling still stands. Tibo on X

Sources

OpenAI research post · @OpenAI post · OpenAI announcement · @OpenAI post · @Kimi_Moonshot post · Hugging Face repo · Together changelog · CISA KEV catalog · Apple iOS 17.5 security notes · GitHub incident · Edge security release notes · @ClaudeDevs post · OpenAI announcement · GitHub changelog · Cloudflare blog · Cloudflare changelog · Reuters via Investing.com · Tibo on X