Coverage: October 26 to November 1, 2026. Sources checked November 2.
AI found a gap between a security fix and the update reaching users
Epoch AI reported that GLM 5.3 could build attacks against six recent Firefox releases by studying fixes that were public but had not yet reached those versions. The demonstrations let a test webpage read a file from the test computer. Researchers supplied the goal and materials, then let the model work in an isolated environment without internet access.
That matters because releasing a fix can also reveal where a weakness is. A capable model can help someone make use of that information before everyone has updated. Epoch's roughly $1,000 cost per version came after more than $100,000 of research and setup work, so it isn't the full cost of starting from scratch. Epoch's October 29 report.
The limits matter too. Similar Chrome attempts failed. The Firefox attacks also depended on another flaw that was fixed in Firefox 159, released October 27. Epoch had not confirmed whether comparable attacks would work against that patched version. These were controlled tests, not attacks on ordinary users. Mozilla's advisory.
Stronger models are reaching users through different routes
Google announced Gemini 4 Carbon on October 28, reporting stronger cybersecurity and extended coding performance. Its cyber benchmarks ran without guardrails. Google also reported improvements in separate safety tests and internal coding use. Initial access is going to selected defenders and trusted partners. Those are developer findings, with broader access still to come. Google's announcement.
Mistral released improved Le Chonk weights the next day, allowing organizations to run and customize the model themselves. It reports better coding, stronger refusal of malicious requests and better resistance to misleading instructions. A specialized cybersecurity version has separate access restrictions. The question now is how those protections hold up in independent tests and after people modify the public model. Mistral's release.
More monitoring does not always mean an agent will be stopped
OpenAI's October 29 account describes wider monitoring across training, testing and product use. In a replay of the earlier Hugging Face incident, its newer system raised an alert before the recorded breach. That is useful evidence about detection, but a replay cannot show that responders would actually have prevented the incident.
The same report spells out remaining gaps. Paging human responders is disabled for internal Codex traffic. Other workloads have different response rules, and some broader automatic-pause measures are still being developed. For external API use, automatic stopping depends on supported conversation tracking. We want to see whether a warning reliably leads to action in time. OpenAI's monitoring report.
Biological AI safeguards show both value and limits
Two studies published by the UK AI Security Institute on October 26 tested narrower questions about biological software. One found that removing selected training data reduced a protein model's targeted capabilities while preserving much of its other performance. That protection did not remain durable after the model was modified. The filtering study.
The other found that coding agents could rebuild selected functions of simpler biological tools when given descriptions and training data. They failed to reproduce the most complex tool within the tested limits. Neither study demonstrates physical biological harm. Both suggest that controlling access takes more than withholding code or relying on one training safeguard. The reproduction study.
Our focus next is on independent tests of the new releases, results against patched software, and evidence that monitoring systems can stop activity reliably. Those findings would tell us more than another launch benchmark.
Our November 2 assessment remains at 68.4 out of 100, Risk Level: High. Read the assessment and download its PDF.