In one minute
- OpenAI reports 948 Linux vulnerabilities and describes checks to establish which flaw each attack actually exploits. [1]
- The OCC publishes a framework for examiners; Anthropic investigates vault particles with Claude. Autonomy, consequences and verification connect the two stories. [2][3]
- Tencent launches Hy4, OpenAI introduces Images 2.6, and Arm increases revenue by 27%. Conductor will close its cloud service on 20 November: users should check their data exports. [4–7]
Main story
CYBERSECURITY · AGENTS · 4 NOVEMBER
OpenAI combines flaw discovery, test attacks and proposed fixes
In A thousand fewer paths to root, OpenAI describes a trial conducted in mid-October. The system analysed 2,308 candidate findings in the Linux kernel, reproduced 1,724 vulnerabilities and exploited 948 distinct vulnerabilities to escalate privileges. A local user with limited permissions could obtain administrator access in the tested environment. The run cost $1,213,430 in API credits, approximately $1,279 per vulnerability in the final group. [1]
Agents examined code and worked in isolated virtual machines. They produced working test attacks and candidate patches for human review. By the end of ten days of automated and manual analysis, 61 flaws had fixes incorporated upstream, while 43 had staging patches. [1]
An earlier trial showed why the mechanism matters: 20 of 200 successful attacks had exploited a different flaw from the one assigned. The team added an independent check to ensure that each attack used its intended vulnerability. [1]
Why it matters: Faster discovery requires the capacity to prioritise, review and update. These are OpenAI's figures from controlled tests; they do not mean that all fixes have been distributed to users.
Other news
2. The OCC guides examiners on assessing the authority given to AI agents
BANKING · SUPERVISION · 4 NOVEMBER
The US banking supervisor published bulletin 2026-54, Super Intelligence: Supervisory Framework. It proposes tailoring examinations to the specific use: its potential consequences, delegated autonomy and human oversight. The framework supplements existing governance, technology, compliance and operational risk practices; it tells examiners not to treat AI as a separate risk category. [2]
The distinction helps when authorising tasks: a simple agent able to initiate payments may need more control than an advanced model limited to drafting text. This is guidance for examiners, introducing no new binding requirements or obligation for banks to use it for their own assessments. [2]
3. Anthropic uses Claude to investigate the structure of a vault particle
RESEARCH · BIOLOGY · 4 NOVEMBER
Anthropic's laboratory describes a hollow structure made from 96 copies of one protein originating from a bacteriophage, a virus that infects bacteria. Claude helped search for proteins, design DNA, improve purification and process microscopy data. The team reports 90 minutes for purification, compared with the usual three days, and 34 hours of processing to obtain the first complete structure. [3]
The work shows agents connecting scientific software and experimental tasks under human direction. The biological function remains unknown; these are preliminary findings and the laboratory's own time estimates, shared in a preprint with further data promised for examination. [3]
4. Tencent launches Hy4 with vision and the ability to operate software
MODELS · COMPUTER USE · 4 NOVEMBER
Tencent introduced the final version of Hy4, succeeding August's preview. It adds image understanding and can act through graphical interfaces and command lines. The company describes training with Blender and CAD design software for tasks requiring sequences of actions. [4]
The model is available through Tencent services and APIs. For professional teams, the interest lies in completing work inside applications and deciding which permissions to grant. The announcement promises model weights — the files needed to run the model — and safety documentation in the coming days; that future availability and the announced improvements remain Tencent's claims. [4]
5. OpenAI launches Images 2.6 with faster generation, GIFs and SVG export
CREATIVE SOFTWARE · 4 NOVEMBER
OpenAI introduced Images 2.6 in ChatGPT, Codex and its API. It claims 50% faster image generation. The API offers Flare, focused on speed, and Sunburst, geared towards greater detail and consistency across edits. Additions include GIF animations, export to the vector format SVG, and controls for identifying specific areas to change. [5]
The company announces worldwide availability in ChatGPT and Codex across all subscription tiers. For design and communications, the practical change is preserving characters, products and brand details through successive revisions. The speed improvement is vendor-reported, without an independent comparison in this edition. [5]
6. Arm increases revenue by 27% and doubles data-centre royalties
SEMICONDUCTORS · RESULTS · 4 NOVEMBER
Arm reported results for its second quarter of fiscal 2027, ending on 30 September. Revenue rose 27% to approximately $1,440 million. Licensing and other revenue contributed $773 million, while royalties accounted for $670 million. The headline total is rounded: the components add up to $1,443 million. [6]
According to the company, data-centre royalties doubled year on year. These are payments linked to the use of its processor technology. The results show computing demand flowing through to licences and chips; the figures cover Arm as a whole, rather than AI revenue alone. [6]
Briefs
Conductor will close its cloud service on 20 November after joining Meta. It becomes read-only on the 13th and starts deleting cloud data on the 20th; users can transfer workspaces to a Mac or export them from their accounts before that date. The local app has a separate support timetable, until early 2027: users should check that their export preserves the work they need. [7]
Anthropic will extend text watermarking to four older models from 16 November, according to The Decoder. The outlet cites a customer email about Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5; marks would apply only with default word-selection parameters. The official help page confirms the marking programme but not that date: the absence of a mark does not prove human authorship. [8][9]
Sensiba announces full accreditation to assess agents under AIUC-1. Its own release, dated 2 November and distributed by a newswire on the 4th, describes reviews of code, configuration and logs alongside technical testing by AIUC. This is company-announced accreditation within a certification scheme, not regulatory approval. [10]
OpenAI agrees to buy Pierre to expand code review in Codex. Pierre develops Code Storage and the Trees and Diffs libraries already used by Codex. The transaction remains subject to closing and regulatory approvals; OpenAI promises to keep the open-source projects open. [11]
The signal in the noise
The more work an agent performs, the more important verification becomes. Finding a flaw, producing a scientific structure or changing software requires evidence of both the result and the path taken. For professionals, the question is what the tool can do, with which permissions, and who will review its actions. Conductor's shutdown adds another: how to recover the work if the service disappears.
Spain and Norway
Spain. The AEPD announced that its deputy, Francisco Pérez Bes, would attend the 30th Ibero-American Summit, which opened in Madrid on 4 November. Its agenda highlights the first dedicated ministerial meeting on digital transformation and AI. This is follow-up on the summit, with no verified new regulatory decision. [12]
Norway. The government is accepting input on its new national AI strategy until 20 November. The participation deadline was announced on 29 October. [13]
On the radar
- Tencent: Publication of Hy4's weights and safety documentation; the licence and results will need examination once available. [4] - Anthropic: Publication of structures and additional vault study data to facilitate independent scrutiny. [3]
Sources
[1] OpenAI · A thousand fewer paths to root · 04-11-2026
[2] OCC · Bulletin 2026-54 · 04-11-2026
[3] Anthropic · Investigating vault particles with Claude · 04-11-2026
[4] Tencent · Hy4 company announcement · 04-11-2026
[5] OpenAI · Introducing Images 2.6 · 04-11-2026
[6] Arm · Q2 FYE27 Results · 04-11-2026
[7] Conductor · Joining Meta, timeline and data export
[8] The Decoder · Update of 04-11-2026 on an Anthropic email
[9] Claude · How Claude marks AI-generated content
[10] Sensiba · Company release · 02-11-2026
[11] OpenAI · Agreement to acquire Pierre · 04-11-2026
[12] AEPD · 30th Ibero-American Summit · 04-11-2026
[13] Norwegian Government · Input on the national AI strategy · 29-10-2026