Top line

OpenAI ships GPT-6 Cyber for Daybreak Red, rated Critical under its Preparedness Framework

OpenAI introduced GPT-6 Cyber on Nov. 5 for authorized vulnerability research. On ExploitGym it scores 48.5%, up from 32.1% for GPT-5.6 Cyber, about a 51% relative gain. OpenAI now rates the model Critical for cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. In real campaigns it helped produce the 948 Linux privilege-escalation exploits covered yesterday and evidence for 81 novel high-severity Firefox bugs Mozilla is fixing. Access starts through the API and Codex for a select group of Daybreak Red customers, with expansion planned; GPT-5.6 Cyber is opening to all Daybreak Red. The API model id is gpt-6-cyber. Separately, gpt-5.5-cyber-preview is deprecated with removal on Feb. 1, 2027.

Why it matters: This is a gated offensive-research model with stronger scope-alignment claims, not a general ChatGPT upgrade. Security teams should decide whether Daybreak Red or Blue fits their charter, and anyone pinned to gpt-5.5-cyber-preview needs a migration plan before February.

Sources: OpenAI announcement · API changelog · Deprecations

Cursor can build and share live apps from cloud agents

Cursor's Nov. 5 changelog says agents can scaffold a web app, stand up Postgres if needed, put auth behind Cursor SSO, and deploy to a shareable link. Publish runs deterministic and agentic security checks first; nothing goes live until checks pass and a human publishes. Team admins can see apps and secrets, add review rules, approve blocked publishes, and unpublish. Available on all paid plans with cloud agents enabled; Origin and GitHub repos work now, GitLab later.

Why it matters: Internal tools can leave localhost without a separate hosting stack. Security and compliance owners should review admin visibility, secret handling, and publish gates before turning this on broadly.

Sources: Cursor changelog

Edge Stable 157.0.4341.42 ships Chromium's security updates

Microsoft released Edge Stable 157.0.4341.42 on Nov. 5 with the latest Chromium project security updates. CVE details are still listed as coming soon. This closes the multi-day watch after Chrome 157's critical fixes while Edge was still pending.

Why it matters: Fleet admins who held Edge waiting for the Chromium backport can deploy 157.0.4341.42 now, then confirm the CVE list when MSRC fills it in.

Sources: Edge security release notes

What to do

  • Finish WordPress remediation today. CISA's due date for CVE-2026-119977 is Nov. 6. Patch to 7.1.4 or the matching backport, and triage sites that auto-upgraded during the race window. CISA KEV · WordPress 7.1.4
  • Deploy Edge 157.0.4341.42 across managed browsers. Edge security release notes
  • Keep hunting Apple devices below the May 2024 WebKit fixes (iOS/iPadOS 17.5 / 16.7.8, macOS Sonoma 14.5, Safari 17.5). CISA's due date for CVE-2024-27834 is still Nov. 18. Apple iOS 17.5 notes

Also notable

  • Gemini Omni 1.2 Flash is GA with up to 15-second video, about 30% lower video pricing ($0.07/sec at 720p), and doubled paid rate limits. Effective Dec. 3, gemini-omni-1.1-flash auto-routes to 1.2 at 1.2 rates. Google blog
  • Claude Console IP allowlists (beta) refuse covered requests from non-listed addresses (up to 1,000 entries). Enterprise Admin API can sign a member out of Claude everywhere. Claude release notes
  • AWS Bedrock AgentCore Web Answer is GA in US East (N. Virginia): one managed MCP call returns a cited web answer. AWS What's New
  • Mistral Studio added managed agents in public preview. Mistral announcement
  • NVIDIA posted open Cosmos 3 Nano world-simulation checkpoints for AV and robotics. HF blog
  • OpenAI status: ChatGPT Work and Dots had a minor ~13-hour error incident from 9:25 AM CT Nov. 5 to 10:31 PM CT, now resolved. OpenAI status
  • Catch-up: Baidu released ERNIE-5.5-Flash-Base open weights (280B / 14B active); commercial use above $50M related revenue needs Baidu authorization, and the license excludes the EU, UK, and South Korea. ERNIE release
  • Watch: xAI default Grok API text watermarking starts Nov. 7; Hy4 full weights and the Pentagon AI-lab legal inventory are still unpublished. xAI watermarking
  • Codex / ChatGPT limits: Tibo Sottiaux posted no new resets or limit changes in-window. The Oct. 29 Pro doubling still stands. Tibo on X

Sources

OpenAI announcement · API changelog · Deprecations · Cursor changelog · Edge security release notes · CISA KEV · WordPress 7.1.4 · Apple iOS 17.5 notes · Google blog · Claude release notes · AWS What's New · Mistral announcement · HF blog · OpenAI status · ERNIE release · xAI watermarking · Tibo on X