OpenAI is partnering with Hacktron to find vulnerabilities in how its systems interact with third-party services. The deal expands Hacktron’s access to OpenAI’s frontier models through Daybreak Red.
OpenAI engineers and Hacktron’s security researchers will choose high-priority areas to test together. Hacktron builds AI agents for code review, penetration testing, and red teaming, and its research has uncovered vulnerabilities involving applications, cloud infrastructure, and identity systems.
OpenAI disclosed no vulnerability count, testing timeline, or remediation target. The partnership follows a separate security sprint with Cathedral researchers and higher bug-bounty rewards for independent researchers.
Why it matters: For OpenAI users, Hacktron’s testing could strengthen defenses around the third-party connections used by AI agents; without a vulnerability count or remediation target, however, readers cannot yet measure the partnership’s results.
Crusoe has sold its unfinished southeastern Wyoming data-center project to Google, which plans to invest $17 billion in the campus. The eight-year-old developer confirmed the handoff Friday; Google did not disclose the purchase price. TechCrunch reports that Google had raised concerns about the project’s cost and construction timeline under Crusoe’s management.
Crusoe and Tallgrass, a Blackstone-backed infrastructure company, announced the project last year with an eventual target of 10 gigawatts of power capacity. The takeover underscores the execution risk in securing equipment and power for massive AI facilities—and the potential for local opposition to slow them.
Crusoe is still building a separate Google data center near Amarillo, Texas, while its other customers include Oracle, OpenAI, Microsoft and Meta.
Why it matters: Google’s decision turns a $17 billion buildout into a test of whether large AI infrastructure buyers will keep outsourcing construction—or take control when schedules and budgets slip. For Crusoe, the handoff is a setback inside an expansion that still includes Oracle, OpenAI and Microsoft.
Anthropic may have crossed its own AI-acceleration warning threshold in July. METR found that the company's model-improvement rate rose 1.9 times after October 2025, reaching 29 AECI points per year versus 15 previously. METR estimates that about 80% of the current speedup comes from AI used in Anthropic's own research.
Anthropic's Responsible Scaling Policy calls for a warning when automated AI research doubles the pace of progress. METR says that threshold may have been reached on July 15, while Anthropic's August 2026 public report described acceleration as less than twofold; its unredacted figure implied 1.97. Anthropic heavily redacted forecasts, training-step breakdowns, and bottleneck analyses, limiting independent verification.
Why it matters: For Dario Amodei's Anthropic, a warning-level trigger would put its Responsible Scaling Policy under pressure while METR says acute catastrophic risk remains low but another sharp acceleration cannot be ruled out over the next six months.
AWS published a sample that runs Claude Code as a remote coding agent on Amazon Bedrock AgentCore. Each task gets an isolated runtime session in the customer’s AWS account, letting developers close their laptops and return to a GitHub pull request.
The design combines a VPC, microVMs, temporary IAM credentials, Amazon Bedrock Guardrails, and AgentCore Identity. Bedrock does not use customer content to train models or share it with model providers; customers can configure zero data retention.
The pattern targets scoped features, bug fixes, and tests on trusted repositories. It is not suited to untrusted code because the agent runs repository commands, and each task stops after three attempts. Remote execution also requires setup and makes costs harder to predict.
Why it matters: Engineering teams that want unattended coding without exposing a laptop’s shell credentials get a governed path to GitHub review, but they must trade autonomy for bounded jobs on trusted repositories and less predictable costs.
Vals found that OpenAI’s restricted Daybreak completed 81% of tasks across two tests of simulated corporate networks. The downloadable Chinese open-weight model DeepSeek averaged 73%.
The tests included a two-network scenario in which a model had to compromise one mock company before reaching another. Daybreak and DeepSeek tied on some tasks.
Cost separates them more sharply: Vals estimates that GPT-6-Sol costs $17–$46 in tokens to carry out an attack, compared with $2–$3 for DeepSeek, which can run on a user’s own hardware. That price gap gives defenders a reason to choose an open model over a proprietary one.
Why it matters: Anthropic’s Project Glasswing was built on the idea that gated access would give defenders a head start; DeepSeek’s 73% score and $2–$3 local price show why that lead may disappear before the labs’ next models arrive.
AI data brokers are offering as much as $2 million for corporate files, emails and call transcripts because labs want real workflows rather than simulated expert tasks. Handshake offered a freelance writer $1,000 for one story; it says it licenses professional documents and buys graduate papers and coursework.
Spirit Airlines’ bankruptcy exposed the stakes. Its digital assets included 80,000 email accounts, 500 million internal messages, 20.6 million SharePoint files and 1 million time-card records. Google bid $10 million, but Micro1 topped it by $2.5 million. The sale is on hold after the flight attendants’ union challenged the handling of private information. Mercor, Handshake and Micro1 say they strip personally identifying information, but critics warn emails can retain details about doctor’s appointments and family issues.
Why it matters: Spirit’s sale shows that employee communications can become a contested AI asset: the flight attendants’ union can delay a transaction even after companies claim to remove personally identifying information.
OpenAI released ChatGPT Cyber to Daybreak Red, the highest tier of its cybersecurity program, after GPT 5.6 Sol helped Charge Robotics CTO Max Justicz find a severe vulnerability that could let attackers take control of Ubuntu servers. Justicz told TechCrunch he found it in about two hours. He reported the flaw to the Debian Project, which issued a patch; no known evidence shows attackers exploited it.
OpenAI says ChatGPT Cyber scanned the Linux kernel and identified 948 potential issues. The model also found 81 “novel” Firefox vulnerabilities. OpenAI wants to expand Daybreak beyond its current “thousands” of participants as defenders race to patch flaws before more capable hacking models become easier to access.
Justicz spent about $5,000 on subscriptions and tokens. OpenAI says the Linux-kernel hunt cost $1.2 million.
Why it matters: Debian maintainers will need more review capacity to separate exploitable bugs from AI-generated candidates as OpenAI expands Daybreak beyond its current “thousands” of participants.