"The AI Pulse — 2026-11-06: The Attack Surface Just Got a Product Page"

Today the AI-finds-vulnerabilities story stopped being a research beat and became a product category. OpenAI launched GPT-6 Cyber, its first dedicated security model — it found 81 previously-unknown high-severity Firefox flaws and built working exploits for 948 Linux kernel bugs, scoring 48.5% on ExploitGym, and it's explicitly trained to stay inside authorized scope. The through-line with this week's other items: the parts of AI that used to be demos are getting SLAs.

The attack surface just got a product page

The significance isn't the flaw counts — AI-discovered CVEs have been weekly news since the PHP bugs in October and Cipher's fusion-reactor CVSS-9.8 earlier this week. It's that a frontier lab now ships offensive capability as a product, with rules-of-engagement baked into training rather than bolted on in a policy document. The week completes an uncomfortable circle: OpenAI productizes aligned offense on Thursday, while Epoch AI showed (Nov 1) that open-weight GLM-5.3 builds full Firefox exploit chains in under 48 hours for about $1,000 per chain with no safety net firing. Aligned and unaligned versions of the same capability now differ by a terms-of-service screen, not by access.

OpenAI — Introducing GPT-6 Cyber

*sshole: the AI-fuzzing era meets the world's remote-access daemon

Hours before the Cyber launch, OpenSSH shipped an emergency fix for a password-authentication bypass on musl/Alpine systems — found by AI agents that ran roughly 17,600 authentication tests, per researcher Özgün Kültkin. Damien Miller's advice was unusually blunt: disable password authentication immediately (Alpine advisory). What's quietly historic is the discovery method: fuzzing at this scale used to be a funded lab activity, and it just found a decade-old flaw in the most-deployed remote-access daemon on earth. Fuzzing is the rare security task where AI's brute patience is a superpower and its judgment barely matters — expect the bottleneck to shift to humans who can triage the resulting flood, the same way PostgreSQL committers are already drowning.

openwall — oss-security advisory

Two benchmarks, one verdict: reasoning, not knowledge, is the bottleneck

Two independent Nov-5 releases measured frontier models against expert work and landed on the same diagnosis from opposite directions. SemiAnalysis's GDPx found no AI agent completes more than 12% of multi-hour real professional tasks — live enterprise software, data rooms, actual engineering environments — even as the same agents ace coding benchmarks. And FrontierPhysics put Claude Opus 5.5 ahead of 26 configurations at just 27.4%, with manual failure analysis showing the models don't fail for lack of knowledge: 48% of failures were non-rigorous reasoning, 34% missing expert intuition, only 11% knowledge gaps. The convergent read: the next training-compute dollar buys less than the next taste for verification and self-checking — and nobody currently knows how to buy that.

The Decoder — GDPx · Emergent — FrontierPhysics

Inkling 2 Small: a flagship with a warning label attached

Thinking Machines shipped Inkling 2 Small — a 594B-parameter MoE with only 17B active, 1M-token context, and a 57.4 Artificial Analysis score, the highest-ranking new model of the week, with Apache-2.0 open weights promised for next week. The independent AA writeup is the interesting part: it "hallucinates less mainly because it answers fewer questions," and its Omniscience net score of 16 still trails Gemini 3.8 Flash (23) and Claude Sonnet 5.5 (19). Mira Murati's lab is thus running the first open-weights flagship launch where the abstention strategy is the honesty story — a model that declines to answer is easier to trust than one that's merely usually right, and next week's weight drop will test whether the community rewards that.

Thinking Machines — Inkling 2 Small

AutoDNA: the self-driving lab moves from chemistry to biology

Shanghai Jiao Tong University's AutoDNA, published in Nature, runs DNA synthesis and sequencing experiments end-to-end from natural-language prompts across 20+ instrument types — humans only replenish reagents. Autonomous labs already exist in chemistry, where reactions are tolerant of imprecision; molecular biology is not, and that's why this matters. The agents at the core write a Hawking quote into synthetic DNA as a demonstration, which is either charming or the most on-brand watermark of the year. The remaining bottleneck — reagent handling and precision — is now an engineering problem, which is the category of problem that stops being a bottleneck.

The Mondo News — AutoDNA

---

The pace, today: in one week the arc went from AI finding bugs in a fusion reactor (Wednesday), to AI finding bugs in OpenSSH (Thursday), to AI finding bugs as a shipping product (Cyber's launch, everywhere by Friday). The defense side of that ledger didn't ship anything this week.