{"slug": "field-intel-report-025", "title": "FIELD INTEL REPORT-025", "summary": "OpenAI released GPT-6 Cyber, a version of GPT-6 Astra trained for authorized vulnerability research, to approved customers in its Daybreak Red program via the API and Codex on 5 November, gating access behind identity verification, SSO, MFA and IP allowlisting. OpenAI rates the model Critical for cybersecurity under its Preparedness Framework, up from High for its predecessor, and reports it avoided exploiting out-of-scope honeypot services in 99.93% of runs without safety prompting, versus 5.51% for the prior model. The company says the model found 81 previously unknown high-severity Firefox vulnerabilities, while Mozilla's Firefox 159 advisory credits 41 high-severity fixes to OpenAI.", "body_md": "**Coverage window: 30 October – 6 November 2026** · Previous report: FIR-024 (30 October 2026) · **▲ Critical — the dates came due**\n\n**TL;DR**\n\nThe week's commitments met their dates, and the dates sorted them. A Critical-rated cyber model shipped to approved defenders only (OpenAI, 5 Nov). A billing date everyone had circled slipped twice in a fortnight (Microsoft). A bill completed the Lords carrying the broad version of its most contested clause (UK, 2 Nov). A filing gained its third-quarter numbers and kept its blanks (Anthropic, 2 Nov). The largest private round in the sector was repriced downward in public (OpenAI, 30–31 Oct). The AI agent platform this report has tracked in silence for five weeks disclosed two unauthenticated 9.8-severity flaws, one of them reachable through its MCP endpoint (IBM bulletin, 28 Oct). One tracker window expired today with nothing in it (xAI). And the model accused — on one publication's evidence — of training on a rival's outputs published its full weights, on the day it had promised, for anyone to test (Moonshot, 4 Nov).\n\nMethod in one line: a 168-hour multi-plane scan (135 bound signals), plus source-pinned checks of every dated item last week's report left outstanding — because, again, the week's centre happened where the scan cannot see. Two findings in this edition are about the instruments themselves, and they are flagged as such rather than buried.\n\n**1. The frontier's strongest cyber model is now rated Critical — by its own maker — and it is gated (5 Nov).**\n\nOpenAI released GPT-6 Cyber, a version of its GPT-6 Astra model trained for authorized vulnerability research, to a select group of approved customers in its Daybreak Red programme, through the API and Codex. Access requires identity verification, single sign-on, multi-factor authentication and IP allowlisting; work against critical infrastructure sits in a separate group with extra blocks. OpenAI classifies the model **Critical** for cybersecurity under its Preparedness Framework — its top tier, up from High for the previous cyber model. Eight days after Google gated Gemini 4 Carbon to vetted defenders, this is no longer one company's caution. It is the architecture.\n\n**2. The headline safety number is a scope number.**\n\nOn ExploitGym, a benchmark of exploiting specified vulnerabilities, GPT-6 Cyber scores 48.5%, up from 32.1%. The number OpenAI leads with, though, is from its Honeypot test, where out-of-scope services are left deliberately easy to attack: the model avoided exploiting them in **99.93%** of runs without any safety prompting — an out-of-bounds rate of 0.07%, against 5.51% for its predecessor — and in 100% with the prompts. Every figure here is OpenAI-reported and independently unverified; that caveat matters, and so does the shift it represents: containment is now a headline metric, published like a benchmark score. In the field, OpenAI says the model found 81 previously unknown high-severity vulnerabilities in Firefox; Mozilla's advisory for Firefox 159 credits 41 high-severity fixes to OpenAI by count. Both numbers stand in this report, because they measure different things — found, versus credited in one release — and the gap between them is checkable in the next release. A separate report describes 948 Linux kernel privilege-escalation cases with working exploits, from 1,724 reproduced findings.\n\n**3. The billing date slipped twice (21 Oct, 3 Nov).**\n\nMicrosoft's usage-based billing for new Copilot Business subscriptions bought through resellers was to switch on by default on 2 November. On 21 October it moved to 1 December; on 3 November, in a further partner update, it moved to early 2027, with the testing sandbox undated. The meter itself is spreading regardless: pay-per-use frontier models arrived inside Copilot and the Office apps in early November, switched off until an administrator turns them on. The date was the commitment; the commitment moved; the direction did not.\n\n**4. The UK bill left the Lords with the broad review clause (2 Nov).**\n\nThird Reading of the Cyber Security and Resilience Bill completed on 2 November and the bill returned to the Commons. Last week's report preserved a genuine conflict between sources over the scope of the review amendment peers had forced on the government. The bill's text as amended settles it: the review (section 66) covers the effectiveness of the **whole regime**, including what powers the AI Security Institute should have; a register of foreign powers posing a cyber threat is section 67; the AI-agent direction powers are sections 44–47. The same stage quietly removed mandatory near-miss reporting. The review clock — twelve months — starts only when the bill becomes law, and the Commons can still change any of it.\n\n**5. The amended filing is still blank where it counts (2 Nov).**\n\nAnthropic filed Amendment No. 1 to its S-1 on 2 November, adding third-quarter results: revenue of $17.0 billion for the quarter (the figure replaces $16.8 billion reported earlier) and a $567 million operating loss. The price range and share count remain blank. A roadshow cannot lawfully begin before 10 November; reported earliest dates are pricing on 13 November and trading on 16 November. Reporting of investor pushback against an early ~$2 trillion valuation talk, toward $1.42–1.50 trillion, is single-source colour at this stage and is labelled as such in the full report.\n\n**6. The round was repriced, in the open (30–31 Oct).**\n\nOpenAI's bridge round — last week a single-source story — is now reported by the Financial Times, confirmed by CNBC, and quantified by the Wall Street Journal at roughly $11 billion committed against an original $30 billion target. The target is now up to $20 billion at a $1.25 trillion valuation, down from $1.4 trillion; whether that figure is pre- or post-money is stated inconsistently across the reporting and is left unsettled here. The round has not closed, and OpenAI has not commented. Its president said on 4 November the company could be IPO-ready in 2027, alongside a JPMorgan partnership that includes its cybersecurity models.\n\n**7. The silence broke, and it was the vendor who broke it (28 Oct).**\n\nFor five weekly cycles, the open-source agent platform Langflow appeared in this report only as an absence. On 28 October its maintainer, IBM, published a security bulletin: four new vulnerabilities in every release from 1.0.0 to 1.12.8. Two are rated 9.8. One is an authentication flaw — automatic login was on by default, and a single unauthenticated request returns a full superuser session. The second turns that session into remote code execution, reachable through Langflow's MCP endpoint, the interface that offers its workflows as tools to AI applications. Twenty-nine further flaw records followed the next day. The only fixed version is 1.13.0, released 22 October — six days *before* the bulletin. A public Metasploit module already probes the flaw; on 4 November a public issue posted proof-of-concept material, and maintainers closed it the next day, redirecting it to the vendor's private reporting programme. None of the new flaws is yet in CISA's known-exploited catalog, and no exploitation has been reported. Honesty requires one addition: the bulletin is dated inside *last* week's window, and last week's report — scan and checks alike — missed it. The full report records that as a correction against itself.\n\n**8. A window expired (6 Nov).**\n\nGrok 4.8 did not arrive. As of 5 November, xAI's news page, release notes, model list and app menu all still name Grok 4.7 (21 September) as the newest model; Elon Musk's only recent word (30 Oct) is that it \"will not be a disappointment,\" with no date. This is the sixth consecutive weekly cycle without a launch artefact, and the tracker window set for it closes today. Whether the item is re-based to a later date or closed is a judgement this report flags rather than makes.\n\nThis note corrects the first version of itself, because the first version described an instrument problem that turned out to be an operator problem — mine. This cycle's scan was initially run **without the entity filter** this series normally applies: the same keywords and planes, but not the list of tracked organisations the server uses to focus the harvest. Run unfocused, the underlying corpus came back **70% arXiv listings** (1,030 of 1,481 signals), with **zero** URL overlap against last week — and the server returned no entity-filter block, because none had been requested. Re-run over the same window with the filter restored (33 tracked entities; 3,493 candidate items narrowed to 2,075), the corpus flips back to the shape this series is used to: technology-news dominant, arXiv down to 34 items and none in the final set, and the same **135 bound signals** — this time all technology-plane, as last week's were.\n\nTwo things follow. What a monitoring instrument returns is a function of how it is pointed, and the pointing is part of the measurement; that is why this report's findings rest on pinned *artefacts* — filings, bulletins, bills, releases — rather than on feed volume, and why the per-company mention counts published in earlier editions still have no like-for-like successor here (the corrected run does produce counts, but from a differently-shaped pool, and this report does not pretend otherwise). And the research-literature picture from the first run — runtime authorization for agents, evaluation loops that check themselves, the difference between verification and agreement, transaction-level cost accounting, recovering a model's training data from the artefact itself — was real, but it was what the *unfocused* harvest sees. The focused harvest sees the trade press. Both are partial; neither is the world.\n\n*Grades used in the full report: primary artefact / bound scan signal / weak signal / supplementary source-pinned check. Null results are reported at their grade; an absence in the scan is never reported as an absence in the world.*", "url": "https://wpnews.pro/news/field-intel-report-025", "canonical_source": "https://dev.to/liminaljermo/field-intel-report-025-1003", "published_at": "2026-11-10 15:00:00+00:00", "updated_at": "2026-11-10 15:24:05.814322+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-safety", "ai-agents", "ai-tools"], "entities": ["OpenAI", "GPT-6 Cyber", "GPT-6 Astra", "Daybreak Red", "Mozilla", "Firefox", "Google", "Gemini 4 Carbon"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/field-intel-report-025", "markdown": "https://wpnews.pro/news/field-intel-report-025.md", "text": "https://wpnews.pro/news/field-intel-report-025.txt", "jsonld": "https://wpnews.pro/news/field-intel-report-025.jsonld"}}