OpenAI Releases Its First Critical-Rated Cyber Model as METR Finds Anthropic's R&D Pace Has Doubled

Friday, 6 November 2026 | Global AI News Daily Ledger

The first weekday after the US midterms repriced the whole AI buildout: the S&P 500 had its worst day since April as data-center politics went national, and OpenAI answered by dropping NDAs with public officials. The capability race did not pause. OpenAI released GPT-6 Cyber, the first model it rates Critical for cybersecurity, a day after publishing the Linux exploit campaign behind it. METR's unprecedented audit inside Anthropic found AI-assisted R&D has doubled the lab's pace of progress - with the most informative evidence redacted. Cursor started shipping deployed apps rather than just code, Thinking Machines, Moonshot, Baidu and Google all shipped models, Claude gained read-only access to bank accounts, and the Justice Department stood up a Super Intelligence Task Force.

Coverage window Since 5 November, 18:44 IST | Compiled 6 November, 18:44 IST

1. OpenAI launches GPT-6 Cyber, its first 'Critical'-rated cybersecurity model

OpenAI released GPT-6 Cyber, a security-specialized model it classifies as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. It scores 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, reached 40.3% recall on a new black-box web penetration test (GPT-6 Astra: 32.0%), and completed 95% of RemoteExploitBench tasks that GPT-6 Astra refused outright. OpenAI says the model produced the 948 Linux privilege-escalation exploits detailed in yesterday's edition and identified 81 previously unknown high-severity Firefox vulnerabilities, with Mozilla already shipping fixes. Scope alignment is the pitch: it avoided out-of-scope honeypot services in 99.93% of tests unprompted and 100% with the deployment prompt. Access runs through the Daybreak tiers, starting with selected Daybreak Red organizations; Cisco, Calif and CodeRabbit are early users. VentureBeat reports API pricing above Anthropic and Google equivalents.

Analysis. The first Critical-rated frontier cyber model formalizes the dual-use bargain: the same capability that finds exploitable bugs at machine speed must stay inside rules of engagement, and OpenAI is selling the alignment training as much as the offense. Restricted Daybreak Red access is now the template for releasing dangerous capability.

OpenAI: https://openai.com/index/introducing-gpt-6-cyber/
VentureBeat: https://venturebeat.com/technology/openai-launches-gpt-6-cyber-with-stronger-exploit-research-and-higher-api-price-than-anthropic-and-google

2. METR finds Anthropic's AI-assisted R&D has doubled its pace of progress, with key evidence redacted

METR published an independent, high-access assessment of AI R&D acceleration inside Anthropic, covering 12 August to 29 October 2026. Its central estimate: Anthropic is now improving model capabilities on well-specified tasks at roughly twice its March 2024 to October 2025 rate, with benchmark scores (AECI) growing 1.9x faster since October 2025 (95% CI 1.5-2.8x) - about two years of historical progress in one. METR attributes a majority of the acceleration to Anthropic's own use of AI in R&D, mostly assisting people rather than running research autonomously, and says it found no clear bottleneck on algorithms, compute or data that must limit progress over the next 12 months. It is confident the speedup is not driven by training-compute scaling. Anthropic redacted most of the evidence METR considered most informative, citing competitive confidentiality; METR warns the public must therefore trust its judgment without seeing the underlying measurements.

Analysis. This is the first independent, inside-the-lab confirmation that recursive self-improvement dynamics are measurably underway - and a transparency stress test: the evaluator itself says its most important evidence cannot be shown. Expect the redaction dispute to become a template fight for future third-party lab access.

METR: https://metr.org/blog/2026-11-05-anthropic-ai-rd-acceleration-assessment/
AP: https://apnews.com/article/anthropic-metr-ai-claude-acceleration-9cf8c590ffc1abdb489179bdccc69c23

3. Cursor now builds and deploys live web apps from a prompt

Cursor shipped Build Live Apps: its cloud agents scaffold a web app, provision a Postgres database, configure authentication behind Cursor SSO, provision hosting and deploy to a shareable link - all from natural-language instructions. Deployment is gated by deterministic and agentic security checks (secrets in files, exposed credentials), and nothing goes live without explicit user approval; team admins can audit apps and secrets, add review rules and unpublish. Apps deploy from new or existing repos on Cursor Origin and GitHub, with GitLab support coming. The capability is available on all paid plans with cloud agents enabled; Cursor says its own sales, ops, legal, finance and engineering teams already run internal tools built this way.

Analysis. Vibe coding's last mile - getting off localhost - is now inside the editor. Cursor stops being just a code tool and becomes a hosting platform, moving onto Replit, v0 and Vercel territory and making 'describe it, ship it' the default for internal software.

Cursor: https://cursor.com/changelog/build-live-apps
StartupHub.ai: https://www.startuphub.ai/ai-news/artificial-intelligence/2026/cursor-now-ships-the-app-not-just-the-code

4. Thinking Machines launches Inkling 2 Small, a 594B MoE aimed at long-horizon agent work

Thinking Machines Lab introduced its second model generation: Inkling 2 Small, a mixture-of-experts model with 594B total and 17B active parameters, image inputs and variable effort. It scores 31 on the Artificial Analysis Intelligence Index, which Artificial Analysis says makes it the highest-scoring open-weights-destined model outside China. On the PMPP-Hard kernel-optimization suite it solved 54.25 of 69 tasks, behind GPT-6 Astra (63) and Kimi K3.1 Pro (60.5) but ahead of DeepSeek V4.1 Flash and Mistral Large 4; it was quietly field-tested on OpenCode as 'Fledge-Alpha'. Access starts closed-weight through Tinker (playground, sampling, fine-tuning); the company says full Apache 2.0 weights are planned for next week after external safety testing and red-teaming - a stated plan, not yet a release.

Analysis. Mira Murati's lab is pacing the open-weights frontier from the US side, and the staged release - closed first, Apache 2.0 after red-teaming - is becoming the credible middle path between fully closed and day-one open.

Thinking Machines: https://thinkingmachines.ai/news/inkling-2-small/
Artificial Analysis: https://artificialanalysis.ai/articles/thinking-machines-releases-inkling-2-small-highest-scoring-open-weights-model-outside-of-chinia-upon-weights-release-it

5. Google ships Gemini Omni 1.2 Flash: 15-second video, 30% cheaper

Google made Gemini Omni 1.2 Flash generally available on the Gemini API and Google Cloud. The video model now generates native clips up to 15 seconds (from 10), supports multi-turn conversational editing of the same clip, and holds character, product and brand references more consistently across shots, with improved lip-sync and multi-speaker dialogue. Pricing drops 30% from Omni 1.1 to $0.07 per second for 720p, with draft-then-upscale workflows to 1080p or 4K; outputs carry SynthID watermarks. It rolls out across Flow, Google Vids, the Gemini app and Google Ads, with Provisioned Throughput for enterprise.

Analysis. Video generation is entering its price war phase: longer native duration plus a 30% cut in one step puts direct pressure on OpenAI's Sora line and Runway, and GA on Cloud turns it from demo into workload.

Google: https://blog.google/innovation-and-ai/technology/developers-tools/introducing-gemini-omni-1-2-flash/
The Verge: https://www.theverge.com/tech/1027845/googles-gemini-omni-1-2-flash-can-generate-clips-up-to-15-seconds-long

6. Moonshot launches Kimi Hosted Agents, a managed runtime for long-running agents

Moonshot AI formally launched Kimi Hosted Agents, a managed cloud harness that runs customers' agents around the clock: hosted sandboxes, persistent execution and safety hooks, aimed at enterprise workloads. The pitch is that Moonshot operates the agent runtime itself rather than only selling model tokens, with managed isolation and guardrails for unattended operation. Launch coverage emphasizes managed sandboxing and inference-time safety hooks as the differentiators; detailed pricing and regional availability remain vendor-described at launch.

Analysis. The agent-runtime layer is becoming the real product battleground - OpenAI, Anthropic and now Moonshot all want to own the loop, not just the weights. A Chinese lab selling hosted, guardrailed agent operations to enterprises also puts data-residency questions on the roadmap.

Unite.AI: https://www.unite.ai/kimi-formally-launches-hosted-agents-for-enterprise-ai-workloads/
AI Affairs: https://www.aiaffairs.com/technology/moonshot-ai-kimi-hosted-agents-managed-sandboxes-inference-hook/

7. Baidu open-releases ERNIE 5.5 Flash Base, a 280B MoE base model

Baidu released ERNIE 5.5 Flash Base, a 280-billion-parameter mixture-of-experts model with about 14 billion parameters active per input, and made the weights openly available under a restricted license. Notably, Baidu published the base model before instruction fine-tuning, deliberately giving developers a raw foundation to customize for their own applications rather than a finished chat model. Gigazine reports Baidu framed it as a foundation built for future enhancements; TokenPost notes the license carries restrictions rather than a fully permissive Apache/MIT grant.

Analysis. China's open-model cadence now extends to deliberately unfinished base models - an ecosystem play that trades polish for developer lock-in. The restricted license keeps it a step short of the Apache 2.0 standard set by Ripple and promised by Thinking Machines.

Gigazine: https://gigazine.net/gsc_news/en/20261106-ernie-5-5-flash-base/
TokenPost: https://www.tokenpost.com/news/technology/50071

8. Claude connects to personal bank accounts via Plaid

Anthropic launched a Personal Finance beta for Claude: US Pro, Max and Ultra subscribers can connect bank and card accounts through Plaid and ask Claude about spending, upcoming bills and unusual transactions. Access is read-only - Claude cannot move or invest money - with up to two years of transaction history, and conversations inside the Personal Finance hub are excluded from model training. Plaid confirmed the partnership in its own blog post; Anthropic's help-center documentation details the scope and controls.

Analysis. Consumer agents are crossing the threshold from productivity into sensitive personal finance, and the trust design - read-only scope, Plaid as the regulated intermediary, a training carve-out - is the actual product. Account-level access is the next agent land-grab.

Plaid: https://plaid.com/blog/plaid-anthropic-financial-insights-in-claude/
Claude Help Center: https://support.claude.com/en/articles/18185620-use-personal-finance-in-claude
The Verge: https://www.theverge.com/ai-artificial-intelligence/1027652/anthropic-claude-plaid-personal-finance

9. US Justice Department launches a Super Intelligence Task Force

The Department of Justice launched a Super Intelligence Task Force to investigate unlawful uses of advanced AI, focusing on threats from foreign governments and criminal organizations as well as AI-enabled fraud. The department says the unit will also press for companies to maintain safeguards that help prevent misuse. The announcement (4 November) frames advanced-AI misuse as a federal enforcement priority alongside national-security threats; Nextgov reports the task force assembles prosecutors and specialists across divisions.

Analysis. Washington is moving from drafting AI rules to staffing AI enforcement - and 'super intelligence' entering DOJ vocabulary signals the government now treats frontier misuse as a standing criminal category, not a hypothetical.

Justice.gov: https://www.justice.gov/opa/pr/department-justice-launches-super-intelligence-task-force
Nextgov/FCW: https://www.nextgov.com/artificial-intelligence/2026/11/department-justice-forms-ai-task-force/417074/

10. Post-midterm repricing: AI stocks sink in worst day since April, as data-center politics bite

A brutal selloff swept AI-linked stocks on 5 November: the S&P 500 fell 4.4% - its worst day since the April 2025 tariff shock - the Dow dropped 1,833 points (3.4%) and the Nasdaq slid 5.5%, leaving it 11.9% below its all-time high, with data-center-buildout stocks leading the fall. Reuters tallied roughly $2.5 trillion wiped off the Nasdaq as investors weighed midterm results that turned data-center expansion into a political target; CNBC reports local resistance and capex doubts converged. The industry's split response landed the same week: Google committed $17 billion to Wyoming AI data centers (gas with carbon capture plus a planned 702 MW fuel-cell project), while OpenAI announced it will stop requiring NDAs with public officials on data-center deals, pay the full cost of its electricity and serving infrastructure, and sign a 'local compact' for every future compute campus.

Analysis. The midterms converted data-center NIMBYism into national market risk. Google's answer is to keep building with firmer power plans; OpenAI's is transparency concessions - both are now the cost of capital for the infrastructure race.

AP: https://apnews.com/article/stocks-markets-ai-midterm-oil-trump-7ee9c212805aa5e70cf34d25aab7a36e
CNBC: https://www.cnbc.com/2026/11/06/ai-data-center-midterms-selloff.html
The Verge: https://www.theverge.com/ai-artificial-intelligence/1028454/openai-data-center-nda
Google: https://blog.google/innovation-and-ai/infrastructure-and-cloud/global-network/wyoming-data-center/

Scope and sourcing notes

Ten distinct developments, none covered in prior editions. Story 1's 948 Linux exploits and Firefox findings were reported in the 5 November edition as research results; today's story is the GPT-6 Cyber model release behind them, with benchmark, access, alignment and pricing details published 5 November - the two cross-reference rather than duplicate. Google's $17B Wyoming commitment and OpenAI's NDA reversal are reported inside story 10 as parts of the same post-midterm market and political repricing, not as separate items. Inkling 2 Small's open weights are a stated plan for next week, labeled as such in the story; ERNIE 5.5 Flash Base carries a restricted license, not Apache 2.0. Kimi Hosted Agents' launch details beyond sandboxing and safety hooks remain vendor-described. Weighed and dropped: Mistral's Studio managed agents and enterprise apps (public preview), Perplexity Teammates, the UK Cyber Security and Resilience Bill's agentic-AI amendment (enabling powers only; secondary legislation still required), Tessl's $125M round, Airbnb's 2027 travel-agent plan, Anthropic IPO-timing concerns (investor opinion, not a company decision), Ant's Ling-3.2-flash, Tencent's WeLM-Image, Meta's Muse avatars, Glasshand's device rentals, Rerun, and Planet's satellite-imagery app. No public X post met the evidence threshold, so no Firsthand signal item is included. Prior editions remain unchanged.