AI in 15 — November 05, 2026

Nine hundred and forty-eight separate ways to take full control of a Linux machine. An AI found each one, exploited it and wrote the patch, for roughly twelve hundred and eighty dollars per bug.

Welcome to AI in 15 for Thursday, November 5, 2026. I'm Kate, your host.

And I'm Marcus, your co-host. If you run Linux servers, Kate, maybe sit down for this one.

I'll put the coffee down first. Here's what's coming up. OpenAI's cyber pipeline turns up almost a thousand Linux kernel root exploits.

Tencent releases the full version of Hy4, its seven-hundred-and-seventy-billion-parameter open model.

We finally have numbers for Anthropic's provable inference, and they're steep.

OpenAI ships animated GIFs in ChatGPT and buys a Git company for its agents.

Plus a Gemini privacy reminder that went viral, Nvidia laptops running slowly on Linux, and Geoffrey Hinton wondering whether we'd be better off without AI.

Marcus, OpenAI's post is called "A thousand fewer paths to root." What did they actually do?

In mid-October they ran an autonomous pipeline on a cyber model that hasn't been released. Its job was to find local privilege-escalation bugs in the Linux kernel. Those are flaws that let an ordinary user on a machine become root, meaning total control. The funnel went like this: twenty-three hundred and eight candidate findings, seventeen hundred and twenty-four that reproduced, and nine hundred and forty-eight unique working exploits once duplicates were removed.

Nine hundred and forty-eight in one kernel. That's not a typo?

Not a typo. On top of that there were two hundred and ninety-one proofs of concept for information leaks, and at least ten exploitation techniques that OpenAI and outside experts consider new. The whole run cost one point two one million dollars in API spend.

Which sounds like a lot until you divide it out.

Right. It's roughly what a single senior security team costs in a year, and that team would not find a thousand kernel exploits in a year. That's the big change here. Finding serious bugs used to be scarce, specialist work, and now it's starting to look like a cloud bill.

And the patches? Because a thousand exploits sitting around somewhere is a scary sentence on its own.

OpenAI is sending fixes out in stages through its "Patch the Planet" partners, critical ones first, and the kernel maintainers decide when anything ships. One outlet reports sixty-one were patched upstream within ten days. That's real progress, but it's sixty-one out of nine hundred and forty-eight.

So what are you skeptical about?

Three things. First, every number here comes from OpenAI's own accounting. I couldn't find anyone independent who has verified the funnel. Second, the model is unreleased, so who gets to use it? If it only defends OpenAI's partners, everyone else stays exposed. Third, can the maintainers keep up? Kernel maintainers are a fairly small group of people, a lot of them volunteers or stretched thin, and they just got a firehose pointed at them.

And this isn't the only story like it this week.

No. The top Hacker News story this week was an IEEE Spectrum piece called "AI is forcing us to pay off forty years of technical debt." It covers PHP2Shell. A researcher at the security firm Calif, using AI tools in an OpenAI-sponsored audit, turned a PHP out-of-memory bug into remote code execution. That bug was reported back in 2024 and never fixed, and the sites at risk included Wikipedia, NASA and a huge number of WordPress installs. The PHP Foundation shipped a fix on October twenty-first, and nobody knows of it being exploited in the wild. Then yesterday Debian patched a flaw in apt, the package manager itself, that let a man-in-the-middle swap a package after its signature had been checked and run code as root.

The tool you use to install security updates.

That very tool. The researcher who found it, Max Justicz, said these bugs are now so easy to find with AI that it's "becoming borderline irresponsible not to audit your internet-facing code with modern AI tools." And Columbia's Suman Jana summed it up: "There is a fundamental asymmetry in finding bugs and fixing bugs."

So, worse before it gets better?

That's my read. Long term, a codebase with a thousand fewer root paths is a much safer codebase. But right now finding bugs costs a fraction of what fixing them does, and that gap is the dangerous window. Matthew Green at Johns Hopkins is predicting a major, widely felt incident around early 2027. If you run Debian or Ubuntu, update apt today.

Quick hits. Tencent released the full version of Hy4 yesterday, after an August preview.

It's a mixture-of-experts model with seven hundred and seventy billion parameters, of which about forty-nine billion are active for each token. It has a one-million-token context window and an Apache 2.0 license. The final version adds native vision and computer use, so it can operate a PC for you. Tencent built some of its game-development training data with its own game studios, and it also open-sourced two science models, one for single-cell biology and one for modeling physical fields.

How good is it?

By Tencent's own benchmarks, very good. It scores eighty-three on its agent evaluation and comes top among open models in a blind finance test. But the line I'd underline is Tencent's own admission that "a notable gap remains" behind the best proprietary models on research-level math, long-horizon coding and self-improvement. That's unusually candid. The one independent data point so far is Plotly's analytics benchmark, which puts Hy4 between two GPT-6.1 variants on cost against accuracy and describes it as, quote, "verrrry thorough, verrrry slow."

With a lot of extra r's.

Plenty of them. Two caveats. Tencent says the weights and system cards are coming "in the coming days," so it isn't clear the final weights are actually out yet. And open weights doesn't mean open training data or an open recipe. Still, the strongest open-weight models keep coming out of China, and the gap closes a little with each release.

Yesterday we mentioned Anthropic's FlashProve, the system for proving which model actually answered you. We said there were no overhead numbers. Well, now there are.

And they show how early this is. Generating the proof takes roughly seventy to ninety-five times the GPU time of just running the model, about a hundred and ten tokens a second on one H100. Each proof is around nineteen megabytes for a thousand-token request, and checking it takes about seventeen seconds on a CPU. Context is capped at a thousand and twenty-four tokens, and it only works with deterministic decoding. They tested it on Meta's Llama 4 Maverick.

So, a tamper-proof seal that costs more than the jar.

For now, yes. On the plus side, the protocol is formally verified in Lean and the code is Apache-licensed. The practical use people keep raising is catching API resellers who quietly swap in a cheaper or quantized model. One wrinkle: a former MARS fellow on Hacker News says it builds on their open-source VerInf project, down to choosing Maverick, "with very little attribution." That's one person's claim and it hasn't been checked, but it's worth noting.

OpenAI shipped Images 2.6. ChatGPT can now make GIFs.

Animated GIFs from a prompt or an image, with adjustable speed and editing of individual frames. It's on every ChatGPT tier and in Codex. It also remembers reference images now, so a recurring character, pet or product doesn't have to be uploaded again every time. In the API there are two new models: Flare, which can turn out an image in about six seconds, and Sunburst, which goes for quality and consistency across edits. [HOST> What's the detail you'd circle?

The watermark. Reportedly, the images will carry Google DeepMind's SynthID alongside C2PA metadata. OpenAI picking up a Google provenance standard is a good sign for being able to tell what's AI-generated. And the scale: OpenAI says it's generating over four billion images a week, up from three billion in September.

And the reviews?

Lukewarm. People tried sprite sheets and found frames still don't stay consistent. One Hacker News commenter argued image generation has plateaued while coding models keep getting better. I think that's a little harsh, but it's fair to say this release feels incremental.

OpenAI is also buying a company. Pierre Computer Company.

Pierre makes Code.Storage, which is Git-based storage built for code that agents write, plus two open-source libraries, Diffs and Trees, that already run inside Codex. It was founded by Jacob Thornton, one of the people behind Bootstrap, and Ian Ownbey, an early Twitter engineer. Its customers include agent builders like Lovable, Bolt and Amp. No price was disclosed, and the deal still needs regulatory approval. [HOST> We talked about OpenAI's "Scaling Git" post on Tuesday.

And this is the follow-through. Git was designed for humans committing a few times a day. Agents commit constantly, so storage and code review turn into the bottleneck. This follows Astral, the company behind the uv and Ruff Python tools, in March, and Ona in June. OpenAI keeps buying the plumbing under Codex. My favorite comment asked for a word that means "buying a company because it's cheaper than paying for its subscription."

A practical one. A Hacker News post with over six hundred points reminded everyone that Gemini trains on your chats, even if you pay. [COHOST> I checked it against Google's privacy notice and it holds up. Personal Gemini accounts, paid ones included, are used for training and possible human review by default. The only off switch is "Keep Activity," and turning that off also wipes your chat history. Chats that have been reviewed can be kept for up to three years, even after you delete them. Workspace business and education accounts are excluded, and so is paid API traffic.

So paying for it doesn't buy you out.

Not on a personal account. And Pixel owners in the thread say Gemini loses basic features like reminders when you switch it off. To be fair, every frontier provider does some safety review of conversations. But these assistants now read your email and your photos, so it's worth spending two minutes in settings.

Nvidia's new RTX Spark laptops are being sold for local AI work. On Linux, apparently, they crawl.

A MindStudio test of an MSI Prestige found the GPU stuck around seven hundred and eighty megahertz on Linux, compared with about two point two gigahertz on Windows. One inference job took thirty-seven minutes on Linux and eight on Windows. Temperatures stayed in the forties, so it isn't throttling from heat. The author blames an encrypted firmware power table that only the Windows driver can decrypt. [HOST> Sabotage?

The top commenters say no, it's missing Linux driver support, and I'd agree until we see evidence otherwise. Nvidia hasn't commented. But it's awkward for a machine marketed to AI developers, who mostly work on Linux. For now, running Linux inside Windows through WSL is actually faster than running Linux natively.

Geoffrey Hinton gave an interview to The Guardian, and the headline is that we might have been better off without AI.

One caution first: we couldn't get the original article, so these quotes come from excerpts. According to those, Hinton warned of a large-scale incident "this year or next," something like a temporary blackout of financial or power systems. He also pushed back on Jensen Huang calling his extinction-risk estimates unscientific.

That timeline sounds a lot like Matthew Green's. [COHOST> It does, though they're arriving there from different directions. My favorite reply on Hacker News was from someone who said AI is their accessibility tool, and that it's let them write code again after thirty years of pain. Both of those things can be true.

And one more on Garry Tan, who we mentioned yesterday. There's more from that Walter Isaacson interview.

Beyond the two hundred thousand dollars a year in tokens, Tan says his agents have read his email, his Dropbox, and "even my therapy notes going back twenty years." He's put his twenty-three Claude Code skills on GitHub as "gstack." Y Combinator also runs an internal agent called Stray Light, which has a "company brain" with context on every YC founder. He admits costs are "too expensive right now" for personal agents to go mainstream, and he'd rather have personal AI that users control than free agents from Big Tech.

Twenty years of therapy notes is quite a context window. [COHOST> It's certainly a vote of confidence in his permission settings.

One to watch: how fast those nine hundred and forty-eight kernel patches actually land upstream. Sixty-one in ten days is a start, but the pace from here is what tells us whether defenders can keep up.

I'd also watch whether OpenAI lets outside defenders use that cyber model. A fix you aren't allowed to run doesn't help you.

That's your AI in 15 for today. See you tomorrow.