# A Thousand Fewer Paths to Root Published: 2026-11-06 Canonical: https://agidreams.us/edition/a-thousand-fewer-paths-to-root Content-Complete: true In March, an AI-driven Firefox audit found 22 zero-days but could not turn one into a working exploit against a real sandbox. That window has closed. OpenAI's cyber team describes a five-stage pipeline (discovery, dynamic validation, exploitability assessment, patch generation, human review) run against the current Linux kernel in mid-October with "an upcoming cyber model." Scout and analyst agents produced 2,308 deduplicated candidates from about 7 percent of the tree for roughly $320,000. Triage agents wrote proof-of-concept triggers and ran them in KASAN-instrumented VMs until crashes reproduced: 1,724 did, and only 3.1 percent of the failures were wrong analysis. Against SMEP, SMAP, and KASLR on a stock desktop target, agents produced 1,169 local privilege escalations collapsing into 948 distinct patches for $691,000. A successful exploit averaged about $360; the 69 failures averaged $3,922 each. Total bill: $1,213,430 (more: https://openai.com/index/a-thousand-fewer-paths-to-root). The same methodology in July with GPT-5.6 Sol found 166 LPEs for $513,690; after three months of kernel hardening, the newer model found more than five times as many. Sampling 166 exploits surfaced ten techniques that outside kernel experts confirmed as novel, details withheld. And in an early run, 20 of 200 reported successes had exploited a different bug than the one assigned, so an independent check was added; a path to root is not necessarily the path you asked for. At bounty rates the output is worth 16 to 55 times its cost. Ten days after disclosure, 61 LPEs were patched upstream. The model is, per a secondhand writeup, GPT-6 Cyber, released November 5 as a variant of GPT-6 Astra with a Critical rating under OpenAI's Preparedness Framework. Access is limited to approved Daybreak Red customers behind MFA, IP whitelisting, and a physical FIDO2 key. Irregular Labs' external evaluation had it solving 11 of 11 challenges at least once, but it cracked none of the 15 hardest and breached no fully hardened target. The honeypot number is the interesting one: with exploitable out-of-scope services in reach, the model touched 0.07 percent of them (more: https://www.geek-guy.com/released-gpt-6-cyber-openais-critical-rated-cybersecurity-model). IEEE Spectrum's PHP2Shell retrospective is the defender's side of the same curve. The out-of-memory bug behind pre-auth remote code execution on WordPress and Drupal was reported to the PHP Foundation in 2024 and shelved, because crashes do not get fixed until someone builds a chain. A Calif researcher using AI tools built one in two weeks. Exploitation "is not really rocket science," says Jana, a computer science professor, just "a lot of very specific reasoning that is painful to do," and the AI now does the painful part. Four engineers then spent two months on the patch, since fixers must close every path. Jana sees LLM-written patches with machine-checked proofs as the way out; Green at Johns Hopkins expects nothing to get funded "until something really bad happens," which he pencils in for early 2027 (more: https://spectrum.ieee.org/ai-in-cybersecurity-php2shell-vulnerability). While kernels get drained of privilege escalations, the agent layer keeps re-learning OAuth. Alexander Loginov at Stream Vessel lays out the Model Context Protocol dilemma for anyone running their own MCP client. MCP sign-in uses dynamic client registration: the agent registers, names a redirect URI, the user clicks Approve. Most operators whitelist a handful of redirects, so a self-hosted client fails at step one. Open registration up and you get what Zhou et al. measured in May: 114 of 119 OAuth-enabled MCP servers accept arbitrary redirect_uri values from anonymous requesters. The attack needs no account: register a client named "Claude" with your own redirect, send a "Reconnect your storage" link, and the victim approves on the genuine consent page while the code lands at your address. A server accepting any redirect is also an open redirector, since validation errors go to the accepted address (more: https://streamvessel.com/blog/mcp-trusted-redirect-uris). Stream Vessel's answer keeps the operator whitelist and loopback URIs, lets registration accept any https URI, and moves the trust decision to the authorize page, where the user is known. Each user may add up to ten exact https addresses from their own session, audited, with removal revoking grants. No code and no error is ever redirected to an address unless the operator or this user trusts it. The rejected alternatives are instructive: the spec's planned Client ID Metadata Documents say who publishes a client, not whether this user meant to connect it. The infostealer side has a claim to file under unproven. A Reddit post describes Volta, a stealer with an embedded local LLM that scores each victim by financial value and reorders extraction into a low-volume pull calibrated to stay under SIEM anomaly thresholds. The detection gap is real, but the post names no vendor, no sample hash, and no researcher, and its only comment is a tokenization-vendor pitch. A sample write-up from a named lab would settle it; until then it is a threat model, not a threat report (more: https://old.reddit.com/r/learnmachinelearning/comments/1xkoczc/spooky_new_infostealer_malware_uses_ai_to_autodox/). That same gap, low-volume movement of the records that matter, is what Orion pitches as "the EDR for data." On Daniel Miessler's Unsupervised Learning, co-founder Jonathan describes DLP that verdicts each movement on who the user or agent is, what the data is, and its lineage: every download, upload, rename, copy-paste, and zip stitched into a graph that follows the data rather than the file. Behavioral baselines are one input, not the decision, since "we're anomalous creatures." The cross-platform matching is "part of the secret sauce," and no false-positive or detection rates were offered, which is what a buyer should ask for first (more: https://www.youtube.com/watch?v=rJ-RC1fPZs0). Zach Lloyd's definition of a software factory, on Latent Space, is "an agentic system in the cloud where you're defining what are the roles of various agents" with measurable closed loops, and his prescription is to define the factory in code. Warp Factories runs one factory per product surface: a YAML file lists repos, skills, MCPs, integrations, and a triage-spec-implement workflow, with work arriving from Slack (60 percent of Warp's own intake), Linear, GitHub, or MCP. Verification is "scorers," online LLM-as-judge evals, and a self-improvement agent turns scorer failures into PRs against the factory definition. The numbers are candid: cost per PR started near $80 "because we were using like Opus where we shouldn't have" and fell to $15 to $20; throughput rose 40 percent in a month with revert rate flat. Judge choice is the variable he underplays; swapping judges has flipped verdicts on half of items in prior tests (more: https://www.youtube.com/watch?v=LL0YmIyBKSU). What happens when the factory outruns its plumbing is Vijay Raji's story. OpenAI's CTO of Applications dates the inflection to February 2026, when Codex plus parallel worktrees sent PR counts sharply up; AI-assisted engineers push 5x more code, moving the bottleneck to review, CI, and testing. The monorepo went an order of magnitude past what its version control was built for, so an internal team replaced Git: "Git was originally built for an offline use case," agents are always online, and sparse checkout throughput matters more than merge collisions. Every OpenAI engineer is on it; no name was given. Raji also says a roughly 50-person ads team hit a billion-dollar run rate in eight months by building the pipeline on LLMs (more: https://www.youtube.com/watch?v=S6SEgMooZpE). Dan Lorenc's diagnosis of agent failure is the counterweight. After 100 billion tokens of agent loops, his pattern is that models trained before they existed "don't know how good they are," talk you into deterministic gates and narrow tools, then fail exactly as predicted. His triage question: was the agent handcuffed (no shell), blindfolded (no view of its grading), or drunk (polluted context)? The fix is almost always more, not less: a real sandbox, then the repo, build, and tests you would give a new hire rather than a curated whitelist (more: https://lnkd.in/p/gNNwn4Qi). The same logic now reaches video. Matt Wolfe, an editor for 17 years, has Claude Opus 5.5 on a $20 plan editing his daily shorts end to end through VidIQ, ElevenLabs, and Hyperframes MCPs plus two generated skills derived from his best-performing shorts. Drop in raw footage and it transcribes, cuts, adds B-roll and captions, and renders. He still prefers a human for long-form, but his verdict is that short-form editors "are going to have a harder and harder time getting work" (more: https://www.youtube.com/watch?v=ep4psgAFOqc). The cleanest open-versus-frontier test this week came from a creator who ran three copies of his own factory harness on the same twelve-ticket game. Opus 5.5 planning and reviewing with Sonnet 5.5 building finished 12 of 12 in about 14 hours for $255 and scored 8 of 10 on blind review. GPT-6 Astra over GPT-6.1 Soul finished 11 in twice the time for $635. Kimi K3.1 Pro finished 5 of 12 in 44 hours for $180, stalled for hours and repeatedly violated a read-only rule on the PRD. His read: open models match frontier models on short tasks, even hard ones, and "fall apart" on long-running work because they stop attending to standing rules; a cheaper per-token model is not cheaper per task when it iterates more. The useful result is his second experiment, where Opus planning and reviewing with Kimi as the implementation workhorse came out roughly equivalent to all-Opus at less than half the cost (more: https://www.youtube.com/watch?v=RYIV5E2Xq60). The Kimi K3.1 Pro card is the counter-evidence, read with the harness in mind. Moonshot calls it its most capable 3T-class model, post-trained from Kimi K3 with joint RL across hundreds of domains, native multimodal, 1-million-token context, with Gated DeepSeek Sparse Attention replacing full attention for cheaper long context and MXFP4 weights from quantization-aware training. Nearly every benchmark ran through Claude Code or Kimi Code against competitor numbers lifted from blog posts, and Moonshot says so in the footnotes. That candor is welcome, and it also means harness-mediated scores say little about the 44-hour stall above (more: https://huggingface.co/moonshotai/Kimi-K3.1-Pro). Alibaba, meanwhile, posted a Qwen 4 teaser whose Chinese tagline leaves the last character blank for 鲲, pronounced "Kun," which is how most people mispronounce Qwen anyway. It is the second teaser since September and still carries no specification (more: https://old.reddit.com/r/LocalLLaMA/comments/1xpbjku/qwen_4_is_stealth_announced/). On the frontier side, a tweet from Lisan al Gaib relays what is reportedly the first dated disclosure of Anthropic's internal models, from a METR assessment of whether AI is accelerating AI development: "Model 4" finished training in October 2026 and scores 178.6 on what the tweet calls the Anthropic ECI, four points above Opus 5.5, or about three months of frontier progress. The figure is secondhand, and ECI has usually been cited as Epoch AI's measure, so the attribution is worth checking (more: https://x.com/scaling01/status/2118437296567472419?s=46). Hugging Face's MoE Training Handbook will save labs months, and its last sentence is the right place to start: "Many of the recommendations above rest on one ablation in one lab's setup." With that caveat, the Megatron-LM runs on H100 nodes are specific. The baseline pits a 1.22B dense model against a 64-expert top-8 MoE at 6.86B total, 1.22B active. Load balancing is the throughput story: imbalance cut throughput from 149.4 to 100.5 TFLOP/s. The loss-free bias beats the auxiliary loss on violation (0.04 versus 0.72 MaxVio) but is "too coarse above 128 experts." Shared experts gain "small and not consistent." On systems, half of a traced step was exposed all-to-all, FP8 bought 10 to 25 percent at under 0.25 percent loss, and a 1.5 capacity factor drops 6 to 8 percent of tokens, so stay dropless (more: https://huggingface.co/spaces/huggingface/moe-blogpost). Below the model, the kernel wars have a new entrant. Jerry Tworek, declaring "megakernels are the future," amplified a team claiming Hyperkernel, a recursive megakernel generator, hits state of the art on eleven domains including DeepSeek and Kimi inference; the claim is a tweet with no numbers in view (more: https://x.com/millionint/status/2118448332276428876?s=46). Elliot Arledge asked whether one megakernel could replace all of vLLM for a given architecture and got the practitioner's answer: yes, teams are testing it, it depends on which hotspot you hit, and it "doesn't always improve things," since using the full chip optimally is the actual sauce (more: https://x.com/elliotarledge/status/2118387208445206614?s=46). The budget end of the same fight is int8-vllm, a fork that rewrites most of the serving stack for int8 to make old AMD cards useful: 4x MI100 or 2x MI210 running Qwen3.8 27B above 1,000 tokens per second decode with int8 weights, activations, and KV cache. The update runs NVIDIA's original Nemotron 3.5 Bolt 74B checkpoints with int8 dequant of the NVFP4 weights and direct-to-GPU loading that cuts Bolt's load from seven minutes to two (more: https://old.reddit.com/r/LocalLLaMA/comments/1xod8nb/int8vllm_updated_with_nemotron_35_bolt_74b/). The cheapest lever is to stop thinking. Thinklite-27B is Qwen3.8-27B trained to end its reasoning when the answer is settled; in the team's example the base model had a payments bug solved 15 percent into an 11-minute trace and spent the rest re-checking. Across six benchmarks it reports 47 percent less reasoning, roughly 2x faster completions, and 99.6 percent of base accuracy, Apache-2.0 (more: https://lnkd.in/p/g4H5S4qx). In a different flavor of GPU translation, a MotionViz post gets Ocarina of Time to 90-plus FPS on an M5 Air in under 24 hours by extracting the game's shaders and translating them to Metal; no files shared, bring your own copy (more: https://x.com/motion_viz/status/2118423907279712275?s=46). The single-neuron steering demo that produced a cartoon villain on a 4B Qwen two weeks ago has become a tool. Lyra's neuron-explorer sweeps every MLP neuron in a layer of Qwen3.5-4B up and down on a few prompts, with doses set as fractions of the median residual norm leaving the layer, keeps every rollout, and lays the results over a 3D map of the model. Each neuron page shows steered rollouts per dose, a three-column steered chat, its strongest web contexts, and its strongest connections. The fourth tab is Claude running as an agent with the explorer exposed as an MCP server, able to steer, ablate, read logprobs, and move the map, an interpretability UI built to be driven by a model rather than a person (more: https://github.com/lyramakesmusic/neuron-explorer). Rigor is the whole product in RuVLLM, which trains or edits small adapters for open models and refuses to let you believe the result without a paired test. Task panel, scorer, and keep rule are hashed before any output exists. Base and candidate answer identical tasks, gains and losses are compared per task with an exact McNemar test rather than as two averages, and the original weights are verified to restore byte for byte. The worked example on Qwen3.5 4B matters for what it rejects: a 1.5M-parameter coding LoRA lifted tool passes from 123 to 173 of 192 with zero losses for $0.27 of rented GPU, while a second-round adapter hit 192 of 192 but dropped arithmetic from 62 to 46 and was thrown out under the preregistered rule that capability anchors must not regress (more: https://github.com/ruvnet/ruvllm). The same steering idea at cellular scale is Fabian Theis's program. On Latent Space's AI for Science show, the Helmholtz Munich group leader frames the field as mapping (cell atlases), then prediction (perturbation "world models" of the form f(x, a), cell state plus action to next state), and now steering the next experiment. The newest piece is LabCompass, an inverse model that says which perturbation reaches a target state. He is frank about baselines: logistic regression remains near state of the art for cell-type prediction within an organ, linear baselines still match deep models on subtle knockouts because "this stuff is super noisy" (more: https://www.youtube.com/watch?v=3nAV2s4GYbs). A century earlier, measurement discipline failed the other way. Veritasium's superfluid helium episode recounts how Kamerlingh Onnes liquefied helium in 1908, yet his group saw the specific-heat anomaly at 2.17 K and wrote that they "felt justified in disregarding these irregular points." Superfluidity waited until 1938. The lesson for anyone running evals is the one Onnes missed: the outlier you discard because the model says it cannot exist is sometimes the result (more: https://www.youtube.com/watch?v=KfODG5REyss).