Each Linux root exploit cost OpenAI about $1,280. Its agents ran against the kernel in mid-October, spent $1,213,430 in API credits, and came back with working exploits for 948 distinct privilege-escalation bugs. OpenAI published the write-up on November 4, 2026. Pwn2Own and TyphoonPWN have historically paid $20,000 to $70,000 for one of those exploits. OpenAI’s own conclusion is that an unpatched, low-privileged account now counts as root against a well-resourced attacker.
The same week, the cheapest way into an AI company was still somebody else’s environment variables. Northflank told its customers on October 30 to assume every secret on the platform had been decrypted, and Trigger.dev reported the same kind of loss two days later. Chainalysis, a firm whose business is tracing crypto crime, said an attacker using what it called “offensive agentic techniques” got into its internal tools. Cisco Talos found an infostealer that asks Claude how much each victim is worth and moves to Kimi or Gemini when Claude says no.
Two price curves moved in the same seven days. The expensive end of offense (finding and weaponizing new kernel bugs) now costs a small fraction of what bounty programs paid for it. The cheap end (a stolen key sitting on someone else’s platform) stayed cheap and kept working. Eleven items follow, all dated October 30 through November 5, 2026.
1. OpenAI’s Agents Built Linux Root Exploits For About $1,280 Each
OpenAI published “A thousand fewer paths to root” on November 4, 2026. Its pipeline ran an unreleased cyber model against the Linux kernel master branch in mid-October, flagged 2,308 candidate findings, and reproduced 1,724. It produced working exploits covering 948 unique privilege-escalation bugs, plus 291 information-leak proofs of concept. A July run on GPT-5.6 Sol found 166 for $513,690. OpenAI says the agents used at least 10 exploitation techniques new to its experts, and it’s keeping those private.
Why it matters
Five times the bugs in three months, on a kernel hardened in between.
Maintainers face hundreds of reports and patches arriving in staged batches.
Any lab with a comparable model can run the same pipeline.
What to do about it
Treat every shell account on unpatched Linux as root in your threat model.
Shorten kernel patch windows on multi-tenant and internet-facing hosts first.
Ask your Linux vendors how they’re handling the Patch the Planet batches.
Rock’s Musings
A local privilege escalation (LPE) is a bug that lets someone with a limited account on a machine become root. It needs a foothold first, which is why LPEs tend to sit lower in patch queues than remote bugs. OpenAI’s own line belongs in front of your infrastructure team: a low-privileged account on an unpatched system “should be considered functionally equivalent to root access for a well-resourced threat actor.”
I’m less sure how long defenders keep the head start, because nobody promised you the next lab with this capability runs a disclosure program.
2. Check Point Walked Chat Histories Out Of ChatGPT’s Lockdown Mode
Check Point Research published a bypass of ChatGPT Lockdown Mode on November 5, 2026. Lockdown Mode is OpenAI’s optional setting meant to stop prompt injection from sending your data to outside servers. The flaw sat in the HTML preview for code blocks, where the sandboxed frame still allowed popups that escape the sandbox, and a nested frame reached them. In the desktop app, Check Point says, talking to a malicious GPT leaked the whole chat history with no click. OpenAI fixed it on September 18, 2026.
Why it matters
The prompt injection control failed in the rendering layer.
Zero-click exfiltration beats any user-awareness training.
Check Point showed phishing and malware delivery through a trusted ChatGPT window.
What to do about it
Confirm your managed ChatGPT desktop installs auto-update.
Block custom GPTs from unknown builders in enterprise workspaces.
Ask AI vendors for exfiltration test results that cover client apps.
Rock’s Musings
An iframe sandbox is the HTML attribute that boxes embedded content away from the page around it. Each “allow-” token reopens one capability, and “allow-popups-to-escape-sandbox” does what it says. When a vendor sells you a mode, test it in the client your people run.
3. Northflank And Trigger.dev Told Customers To Assume Their Secrets Were Gone
Wiz alerted Northflank at 11:43 UTC on October 30, 2026. By 13:58 its status page read “Assume all environment variables have been decrypted. Disable/rotate all keys,” and customers soon confirmed their AI keys had been used. Northflank’s November 2 update says it contained the attack within about an hour and that the attacker focused on control-plane secrets. Trigger.dev reported on November 1 that an attacker reached environment variables for “a subset of organizations.” SecurityWeek counted at least a dozen AI developer platforms hit over the past month.
Why it matters
Your AI keys sit on hosting platforms your vendor review never covered.
In Wiz’s October cases, one stolen key ran about 1.7 million model calls in 13 hours.
Neither company has said how the attackers got in.
What to do about it
Inventory every platform holding your model provider keys.
Set hard spend caps and usage alerts on every AI API key.
Move long-lived keys to a secrets manager issuing short-lived credentials.
Rock’s Musings
LLMjacking is stealing someone’s cloud or model-provider credentials to run inference on their bill, to use or resell. The Cloud Security Alliance described the path: intruders reach AI provider credentials “through the intermediary layer of hosting platforms.” A key in an environment variable on a hosting platform is a key you’ve handed to that platform’s weakest admin, so go count how many copies of yours sit in hosting dashboards.
4. Chainalysis Says Attackers Used “Offensive Agentic Techniques” To Get In
Chainalysis disclosed on October 30, 2026 that external attackers using “offensive agentic techniques” reached its systems and internal tools in October. They got customer user IDs, full names, email addresses, and organization role labels. Chainalysis says it found no sign of access to investigation content, query results, clear-text passwords, MFA secrets, or session tokens. On November 3 it took Reactor and Data Solutions offline while outside experts finished their work.
Why it matters
A blockchain-intelligence customer list is a ready-made phishing list.
“Agentic” now appears in breach notices with no definition attached.
Chainalysis published no technical breakdown of the intrusion.
What to do about it
If you use Chainalysis, warn your investigators about targeted phishing now.
Require phishing-resistant MFA for every account Chainalysis provisioned for you.
Ask Chainalysis what “agentic” covered before you close the ticket.
Rock’s Musings
TTPs (tactics, techniques, and procedures) describe how an attacker operated, at a level defenders can turn into detections. “Offensive agentic techniques” names a category and gives you no TTPs. I can’t tell from the notice whether an agent wrote the lure, drove the session, or chained the tool access, and each answer changes what you’d hunt for.
5. Anthropic’s S-1/A Says It May Imminently Hit Its Own Self-Improvement Threshold
Anthropic filed an amended S-1 on Monday, November 2, 2026. The new risk factor says internal estimates “indicate that we may imminently meet our Responsible Scaling Policy’s definition of ‘dramatically accelerated progress attributable to AI.’” It also says Anthropic has “in the past not identified, and may in the future not identify, a significant acceleration in our rate of development until after it has occurred.” Anthropic says it’s considering policy updates to keep humans in control of frontier model development.
Why it matters
A lab told securities regulators it has spotted capability jumps only after they happened.
The original filing treated open-weight models as a pricing threat and skipped the security one.
Anthropic’s red team measured GLM-5.3 within two points of Mythos Preview at building exploits.
What to do about it
Assume attackers hold exploit-building capability four to seven months behind the closed frontier.
Build so you can swap models without a rewrite, and skip multi-year volume commitments.
Track the promised Responsible Scaling Policy update and read the diff.
Rock’s Musings
Recursive self-improvement is the point where AI systems do enough of the work of building their successors that progress compounds faster than humans can follow. Anthropic says the threshold may arrive soon and that it has missed earlier accelerations until after the fact.
I spent this week’s blog post on the original S-1, which files open-weight models under cheap while Anthropic’s own red team watched GLM-5.3 build exploits in 50 of 410 attempts against 56 for Mythos Preview. The amendment adds candor about Anthropic’s own speed, and none of the coverage I read says it touched the open-weight language. Put the two side by side, and you get your threat model: your vendor may not see its next jump coming, and an open-weight model that nearly matches Mythos Preview sheds its refusals for about $1,200.
The question I can’t answer, and the filing doesn’t either, is who outside Anthropic measures how fast its models are improving.
6. OpenAI Brings In The Firm That Got Into Anthropic As Reuters Details Years Of Warnings
OpenAI announced a new internal security sprint on November 2, 2026, with Cathedral Systems researchers attacking OpenAI’s defenses using OpenAI’s own models. Cathedral said in late October that it had reached Anthropic Slack channels, and Anthropic said the exposed data included business contact information and basic account records. Reuters reported on November 3 that, according to five people, employees warned leadership and the board for years that security controls were too lax.
Why it matters
OpenAI raised mid-range bounty payouts more than fourfold on average.
Reuters’ sources say model test sandboxes lacked regular security reviews.
OpenAI is buying offensive testing from the firm that got into its rival’s systems.
What to do about it
Budget triage staff before you scale AI-assisted bug hunting.
Audit which engineers can read your entire code base.
Put your own AI test sandboxes on the security review calendar.
Rock’s Musings
A monorepo is one repository holding most of a company’s code, so read access to it is read access to nearly everything. Reuters says anybody at OpenAI with code access was able to see details of many sensitive projects. OpenAI says its most sensitive work sits in separate repositories with strict access controls, and both can be true. OpenAI’s own account of its last sprint says duplicate findings slowed review, and a sprint without triage staff becomes a backlog with a press release.
7. Britain’s Cyber Chief Puts A 2028 Date On AI Ransomware Against Infrastructure
The UK National Cyber Security Centre launched its State of the Cyber Nation report in London on November 3, 2026. Infosecurity Magazine reports the judgment that AI-powered malware is “highly likely” to be used by financially motivated attackers against UK power stations, airports, and hospitals by 2028. CEO Richard Horne blamed “vulnerabilities that have been tolerated for far too long” that can now be found and exploited “at a scale that was once unimaginable.” GCHQ director Anne Keast-Butler said, “We need every organization in the UK to take action now.”
Why it matters
The NCSC blames long-tolerated, unpatched systems for the risk.
A national agency put a date on AI ransomware against infrastructure.
GCHQ’s director joined the call for every organization to act now.
What to do about it
List every end-of-life system in production and fund replacements.
Rank OT assets by how long their known flaws have sat unpatched.
Brief your board on the 2028 judgment with your own asset numbers.
Rock’s Musings
UK intelligence writes “highly likely” on purpose. Its probability yardstick maps that phrase to roughly 80% to 90%, and plain “likely” to roughly 55% to 75%. AP’s wire story, run by SecurityWeek, says the UK “will likely face” these attacks. If that’s the report’s own word, it’s a lower band, and I’m holding Infosecurity’s reading until I see the report text.
Horne’s “tech on the cheap” line will sound familiar to anyone who has run security for a utility, and I did it for years. A controller that runs fine stays in service, and its patch waits for the next planned outage. That math worked when exploitation took skill and time. Item 1 says it no longer does.
8. VOLTA Asks Claude What Each Victim Is Worth
Cisco Talos published research on October 31, 2026 on an infostealer that calls itself VOLTA-AUTODOXER. After theft, it sends the victim’s data through OpenRouter to Claude Opus 4.6 and asks the model to rate “WHAT THEY’RE WORTH” and “THEIR OPSEC.” When the reply contains refusal phrases like “I can’t” or “I’m not able,” the malware retries with Kimi K2, then Gemini 2.5 Flash.
Why it matters
At least one crew now sorts victims by value with commodity models.
One provider’s refusal became a routing step with two fallbacks behind it.
A gateway hides which model saw your stolen data.
What to do about it
Alert on endpoints calling LLM gateway APIs outside approved tools.
Treat executive and finance staff as the first rated targets.
Rotate credentials on any infostealer hit before the triage finishes.
Rock’s Musings
A model fallback chain is a list of models a program tries in order until one answers. VOLTA uses it to route around safety refusals, so a guardrail at one provider buys a few seconds of delay. Talos reads the refusal check as the author expecting guardrails, and I’ll give Anthropic credit. The defense still has to live on your endpoint, because the attacker owns the routing.
9. A Codex Jailbreak Bundle Rewrote The Agent’s Standing Orders To Sell Ads
Check Point Research published a report on November 3, 2026 on “Haiou,” a jailbreak bundle for OpenAI’s Codex. It jailbreaks the model with role-play and Capture The Flag framing, then installs skills for penetration testing, cracking, and reverse engineering. It also edits Codex’s configuration and global instruction file so greetings like “hi” trigger an ad for an LLM gateway. Check Point calls this “prompt adware.”
Why it matters
Agent instruction files persist across sessions, so one edit rides along.
The bundle drew hundreds of GitHub stars and ships inside Codex-X.
Check Point says the Claude version failed because Sonnet 5 flagged the injection.
What to do about it
Hash and monitor developers’ agent configuration and instruction files.
Block unapproved model gateways at your egress proxy.
Scan endpoints for jailbreak bundles and ban them in acceptable-use policy.
Rock’s Musings
A global agent instruction file is the file a coding agent loads into every session as standing orders. Whoever writes to it steers every project on that machine. Check Point’s Pedro Drimel Neto said the prompts, skills, and third-party components shaping an agent “become part of the trust chain too.” The same edit can carry exfiltration instructions, and your EDR will see a text file change.
10. Hundreds Of Harmless-Looking AI Apps Turned On Deepfake Features After Review
WIRED reported on November 2, 2026, working with the nonprofit AI Forensics, on more than 400 connected apps and domains disguised as tools like pet portrait generators. According to 9to5Mac, the apps passed review at Apple, Google, and Meta, then a server check switched on features for making sexually abusive deepfakes. Apple removed 19 apps after WIRED contacted it, and Meta acted against more than 10,000 ad accounts.
Why it matters
App store approval describes the app on review day only.
Your mobile allowlist trusts the same review these apps beat.
Deepfake tooling now arrives through ordinary consumer app channels.
What to do about it
Recheck approved apps that load content from remote servers.
Deny AI image apps by default in mobile device management.
Brief HR and legal on deepfake abuse response before the first case.
Rock’s Musings
Cloaking is showing reviewers one thing and real users another, with a server deciding which version you get after install. Apple said these apps “complied with our rules when we reviewed them,” and I believe it, which is the problem. A control that checks once and trusts forever loses to an app that changes after the check.
The One Thing You Won’t Hear About But You Need To: Your Coding Agent Is Installing MCP Servers Nobody Maintains
Glow Labs published research on November 2, 2026, covered by Help Net Security the next day, showing coding agents installing deprecated Model Context Protocol servers. Across Claude Code, Cursor, Codex CLI, Claude Cowork, and Claude chat, with models from Anthropic, OpenAI, and xAI, agents chose Anthropic’s archived reference servers from memory. In 98% of those sessions the agent picked the package unprompted. Glow counts more than 17 million npm downloads of those packages since July 2025. It found four high-severity flaws, including remote code execution in the Puppeteer server, with no CVEs and no fix coming.
Why it matters
Agents pick dependencies from training data older than the deprecation.
Glow says 13 of the 20 reference servers Anthropic published in 2024 are archived.
No CVE means your scanners stay silent on all four flaws.
What to do about it
Pin approved MCP servers in a list your agents must use.
Search developer machines for the archived reference server packages.
Require human approval before an agent installs any MCP server.
Rock’s Musings
A knowledge cutoff is the date after which a model saw no training data. Anything deprecated after that date still looks current to the model, so it recommends last year’s package with full confidence. Glow’s Ophir Arie put it this way: “The model’s memory is now a package manager with no deprecation feed.” AWS, on November 2, issued CVE-2026-116635 and a fixed release for a path traversal flaw (CVSS 6.1) in its maintained Serverless MCP Server. The archived ones get silence, and your agents keep installing them.
The frontier labs pushed the cost of a new kernel exploit down to about $1,280. The breaches at AI developer platforms this week, as far as anyone has disclosed, turned on secrets in environment variables, and your agents kept installing packages nobody maintains. Fund the plain controls first: secret rotation, spend caps on AI keys, shorter patch windows, and a pinned list of what your agents may install.
👉 Subscribe RockCyber Musings for more insights into AI security and governance, with the occasional rant. You can subscribe above
👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.
👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com
References
Amazon Web Services. (2026, November 2). CVE-2026-116635: Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (Security Bulletin 2026-164-AWS). https://aws.amazon.com/security/security-bulletins/2026-164-aws/
Arghire, I. (2026, November 4). AI-linked breaches mount as WorkOS, Northflank, Trigger.dev disclose hacks. SecurityWeek. https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/
Associated Press. (2026, November 3). UK cyber chief says the UK will face AI cyberattacks on critical infrastructure by 2028. SecurityWeek. https://www.securityweek.com/uk-cyber-chief-says-the-uk-will-face-ai-cyberattacks-on-critical-infrastructure-by-2028/
Baran, G. (2026, November 3). OpenAI launches new security sprint to hunt vulnerabilities and strengthen defenses. Cyber Security News. https://cybersecuritynews.com/openai-security-sprint/
Bort, J. (2026, November 2). Anthropic warns that it’s very close to RSI capability, aka self-building AI. TechCrunch. https://techcrunch.com/2026/11/02/anthropic-warns-that-its-very-close-to-rsi-capability-aka-self-building-ai/
Check Point Research. (2026, November 3). Free the model, sell the gateway: Prompt adware hidden in jailbreak bundles. https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/
Check Point Research. (2026, November 5). ChatGPT Lockdown Mode bypass: Phishing, malware delivery, and silent data exfiltration. https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration
Cloud Security Alliance AI Safety Initiative. (2026, November 2). Black October reaches PaaS: Northflank, secret stores, and AI key resale. https://labs.cloudsecurityalliance.org/research/csa-research-note-northflank-ai-key-resale-pipeline-20261102/
Cohen, N. C. (2026, November 2). MCPhantom: AI coding agents are installing vulnerable deprecated MCP servers from training data. Glow. https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data
Crypto Briefing. (2026, October 31). Chainalysis discloses cyberattack exposing customer names and emails. https://cryptobriefing.com/chainalysis-discloses-cyberattack-user-data/
Kovacs, E. (2026, November 5). AI agents got root on Linux via 948 kernel flaws in OpenAI research. SecurityWeek. https://www.securityweek.com/ai-agents-got-root-on-linux-via-948-kernel-flaws-in-openai-research/
Lakshmanan, R. (2026, November 4). Researchers uncover prompt adware hidden in OpenAI Codex jailbreak toolkit. The Hacker News. https://thehackernews.com/2026/11/researchers-uncover-prompt-adware.html
Lakshmanan, R. (2026, November 5). OpenAI AI pipeline generates 948 Linux root escalation exploits in 30-hour run. The Hacker News. https://thehackernews.com/2026/11/openai-ai-pipeline-generates-948-linux.html
Let’s Data Science. (2026, November 2). VOLTA infostealer uses Claude, Kimi and Gemini to rank victims’ stolen data. https://letsdatascience.com/news/volta-infostealer-uses-claude-kimi-and-gemini-to-rank-victim-e181337d
Lovejoy, B. (2026, November 2). AI apps with hidden sexual and violent deepfake features made it into the App Store. 9to5Mac. https://9to5mac.com/2026/11/02/ai-apps-with-hidden-sexual-and-violent-deepfake-features-made-it-into-the-app-store/
Magica. (2026, November 2). Disguised AI apps test app-store review and Meta ad bans. Magica. https://magica.com/news/everyday-ai-apps-hide-abusive-deepfake-tools
OpenAI. (2026, November 4). A thousand fewer paths to root. https://openai.com/index/a-thousand-fewer-paths-to-root
Paganini, P. (2026, November 2). VOLTA, the infostealer that asks an AI which victims are worth the effort. Security Affairs. https://securityaffairs.com/202281/malware/volta-the-infostealer-that-asks-an-ai-which-victims-are-worth-the-effort.html
Philogene, R. (2026, October 30). Northflank security incident: Secrets in your own cloud. Qovery. https://www.qovery.com/blog/northflank-security-incident-secrets-own-cloud
Poireault, K. (2026, November 3). NCSC chief warns of imminent AI ransomware threat to UK critical infrastructure. Infosecurity Magazine. https://www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/
Professional Head of Intelligence Assessment. (n.d.). Explaining uncertainty in UK intelligence assessment. GOV.UK. https://www.gov.uk/government/publications/explaining-uncertainty-in-uk-intelligence-assessment/explaining-uncertainty-in-uk-intelligence-assessment
Seetharaman, D. (2026, November 4). OpenAI employees warned about operational security lapses for years, sources say. Reuters via Claims Journal. https://www.claimsjournal.com/news/national/2026/11/04/341107.htm
Sison, M. (2026, November 3). Everything that happened in AI today (Tuesday, November 3, 2026). The Neuron. https://www.theneuron.ai/digest/everything-that-happened-in-ai-today-tuesday-november-3-2026/
Strix. (2026, November 3). CVE-2026-116635: aws-serverless-mcp-server vulnerability. https://www.strix.ai/cve/CVE-2026-116635
The Hacker News. (2026, November 5). Researchers bypass ChatGPT Lockdown Mode to exfiltrate chats without user interaction. https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html
Ticong, L. (2026, November 4). OpenAI expands security testing: Bug bounties near $172,000. eSecurity Planet. https://www.esecurityplanet.com/news/news-openai-ai-security-sprint-bug-bounties/
Vigliarolo, B. (2026, November 2). Thieves pilfer environment variables from Trigger AI workflow tool. The Register. https://www.theregister.com/security/2026/11/02/thieves-pilfer-environment-variables-from-trigger-ai-workflow-tool/5306998
Zorz, M. (2026, November 3). AI coding agents are installing MCP servers that will never be patched. Help Net Security. https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/
Zorz, Z. (2026, November 2). Chainalysis breached using “offensive agentic techniques.” Help Net Security. https://www.helpnetsecurity.com/2026/11/02/chainalysis-breached-using-offensive-agentic-techniques/
The standing-orders file in item 9 is the one I'd watch. Whoever writes to it steers every project on that machine, and the agent can't tell its owner's edit from an attacker's. It's the same shape as an agent running on a person's login, where the record shows one name for both. Hashing the file helps, and an agent with its own identity makes the edit attributable.