In one minute
- OpenAI introduces GPT‑6 Cyber with selected access and reports 48.5% on a vulnerability exploitation test. [1]
- Capgemini will lead a consortium with Wavestone and LNE for the European AI Office; the US Justice Department announces its Super Intelligence Task Force. Technical evaluation and coordination against unlawful use. [2][3]
- Q2 announces AIUC-1 certification for Q2 Assistant; Arcjet launches Himalia 1. Its other two detectors, Thebe 1 and Carme 1, remain in early access. [4][5]
Main story
CYBERSECURITY · MODELS · ANNOUNCED 5 NOVEMBER
OpenAI limits initial GPT‑6 Cyber access to approved customers
OpenAI introduced GPT‑6 Cyber for cybersecurity research. It is initially offered through the API — the connection that lets other programs use it — and Codex to a selected group of approved Daybreak Red customers. This programme supports advanced exploit development and authorised security testing. Access for the remaining customers in the programme is planned for later. [1]
On ExploitGym, which measures whether a model can exploit a specified vulnerability, OpenAI reports 48.5%, compared with 32.1% for GPT‑5.6 Cyber. That is a difference of 16.4 percentage points, or approximately a 51% relative improvement. These are the vendor's results under the evaluation's conditions, not a guarantee of behaviour across every system. [1]
Why it matters: a testing agreement should identify accessible systems, permitted actions and conditions for stopping. Finding a flaw does not settle who may exploit it. Buyers should require reproducible results and make clear who reviews findings before authorising the next step. The score helps compare capabilities; permissions determine what work is being commissioned.
Other news
2. Capgemini will lead an evaluation consortium with Wavestone and LNE for the European AI Office
EUROPEAN UNION · OVERSIGHT · 5 NOVEMBER
Capgemini announced its selection to lead a consortium with Wavestone and LNE, Laboratoire National de Métrologie et d’Essais, a French public institution. It will support the European Commission's AI Office in assessing cyber risks from general-purpose AI models: systems that can serve many different tasks. The assignment includes identifying threats, developing evaluation tools and methods, and conducting technical assessments on demand. [2]
The significance is giving supervisors the means to examine capabilities alongside documentation. For providers, evaluation can turn security claims into testable questions: which attack does the model enable, under what conditions and with which controls? The release describes an assignment supporting oversight, rather than completed test results or certification of models. [2]
3. The US Justice Department announces its Super Intelligence Task Force against unlawful AI use
UNITED STATES · JUSTICE · ANNOUNCED 5 NOVEMBER
The Justice Department announced the Super Intelligence Task Force, led by Stanley Woodward, Associate Attorney General, and Stephen Weiss, Associate Deputy Attorney General. Its stated aim is to address unlawful use by foreign state and state-backed actors, transnational criminal organisations, individuals and companies. The announcement highlights fraud, critical infrastructure and national security among its concerns. [3]
Weiss also stresses internal controls to ensure that the technology behaves as intended. For a business, being able to explain who authorised an action and which controls were operating matters. This is an organisational announcement, not a new corporate duty or a change to the law in Spain or Norway. What deserves attention next is how coordination translates into concrete action. [3]
4. Q2 announces AIUC-1 certification for its banking assistant Q2 Assistant
BANKING · AGENT CONTROLS · 5 NOVEMBER
Q2 says Q2 Assistant has obtained AIUC-1 certification. The assistant can retrieve information and perform tasks within its banking products. According to Q2, the evaluation combined tests designed to provoke failures with an external audit of controls: data isolation, permission enforcement, interaction logs and compliance. It covered risks of data leakage, unauthorised actions and prompt injection: messages that try to steer an assistant away from its legitimate task. [4]
The news is certification of this particular product. A bank considering a purchase should request the report, the version examined and the permissions included in testing. An assessment of the assistant needs to relate to the bank's intended use. AIUC-1 is a private certification; it does not amount to approval by a banking regulator. [4]
5. Arcjet launches Himalia 1 and offers Thebe 1 and Carme 1 in early access
SECURITY · MALICIOUS INSTRUCTIONS · 5 NOVEMBER
Arcjet announced general availability of Himalia 1, its prompt injection detector for AI applications. Thebe 1, intended for coding agents, and Carme 1, for autonomous security agents, are in early access. The approach tailors detection to the task: a suspicious command in customer service may be legitimate when reviewing code or investigating an attack. [5]
The problem concerns content an agent encounters on websites, in emails or in repositories: it may contain instructions intended to redirect its behaviour. Before buying a detector, teams should examine both the attacks it misses and the legitimate tasks it blocks. Arcjet's announced specialisation does not itself establish effectiveness. Permission limits remain a necessary barrier when software can take action. [5]
The signal beneath the noise
An agent's security should be judged by what it does with the permissions it receives. A more capable model, a Justice Department group, a certification and a detector address different parts of the problem. For legal and procurement teams, assessment begins with a defined assignment: what can the system execute, what record does it leave, and who can stop it? That information provides a better basis for assessing the product than a score or badge considered on its own.
Sources
[1] OpenAI · GPT‑6 Cyber · 5 November 2026
[2] Capgemini · European Commission consortium · 5 November 2026
[3] US Justice Department · Super Intelligence Task Force · 5 November 2026