FIELD INTEL REPORT-025

Coverage window: 30 October – 6 November 2026 · Previous report: FIR-024 (30 October 2026) · ▲ Critical — the dates came due TL;DR The week's commitments met their dates, and the dates sorted them. A Critical-rated cyber model shipped to approved defenders only (OpenAI, 5 Nov). A billing date everyone had circled slipped twice in a fortnight (Microsoft). A bill completed the Lords carrying the broad version of its most contested clause (UK, 2 Nov). A filing gained its third-quarter numbers and kept its blanks (Anthropic, 2 Nov). The largest private round in the sector was repriced downward in public (OpenAI, 30–31 Oct). The AI agent platform this report has tracked in silence for five weeks disclosed two unauthenticated 9.8-severity flaws, one of them reachable through its MCP endpoint (IBM bulletin, 28 Oct). One tracker window expired today with nothing in it (xAI). And the model accused — on one publication's evidence — of training on a rival's outputs published its full weights, on the day it had promised, for anyone to test (Moonshot, 4 Nov). Method in one line: a 168-hour multi-plane scan (135 bound signals), plus source-pinned checks of every dated item last week's report left outstanding — because, again, the week's centre happened where the scan cannot see. Two findings in this edition are about the instruments themselves, and they are flagged as such rather than buried. What the week settled 1. The frontier's strongest cyber model is now rated Critical — by its own maker — and it is gated (5 Nov). OpenAI released GPT-6 Cyber, a version of its GPT-6 Astra model trained for authorized vulnerability research, to a select group of approved customers in its Daybreak Red programme, through the API and Codex. Access requires identity verification, single sign-on, multi-factor authentication and IP allowlisting; work against critical infrastructure sits in a separate group with extra blocks. OpenAI classifies the model Critical for cybersecurity under its Preparedness Framework — its top tier, up from High for the previous cyber model. Eight days after Google gated Gemini 4 Carbon to vetted defenders, this is no longer one company's caution. It is the architecture. 2. The headline safety number is a scope number. On ExploitGym, a benchmark of exploiting specified vulnerabilities, GPT-6 Cyber scores 48.5%, up from 32.1%. The number OpenAI leads with, though, is from its Honeypot test, where out-of-scope services are left deliberately easy to attack: the model avoided exploiting them in 99.93% of runs without any safety prompting — an out-of-bounds rate of 0.07%, against 5.51% for its predecessor — and in 100% with the prompts. Every figure here is OpenAI-reported and independently unverified; that caveat matters, and so does the shift it represents: containment is now a headline metric, published like a benchmark score. In the field, OpenAI says the model found 81 previously unknown high-severity vulnerabilities in Firefox; Mozilla's advisory for Firefox 159 credits 41 high-severity fixes to OpenAI by count. Both numbers stand in this report, because they measure different things — found, versus credited in one release — and the gap between them is checkable in the next release. A separate report describes 948 Linux kernel privilege-escalation cases with working exploits, from 1,724 reproduced findings. 3. The billing date slipped twice (21 Oct, 3 Nov). Microsoft's usage-based billing for new Copilot Business subscriptions bought through resellers was to switch on by default on 2 November. On 21 October it moved to 1 December; on 3 November, in a further partner update, it moved to early 2027, with the testing sandbox undated. The meter itself is spreading regardless: pay-per-use frontier models arrived inside Copilot and the Office apps in early November, switched off until an administrator turns them on. The date was the commitment; the commitment moved; the direction did not. 4. The UK bill left the Lords with the broad review clause (2 Nov). Third Reading of the Cyber Security and Resilience Bill completed on 2 November and the bill returned to the Commons. Last week's report preserved a genuine conflict between sources over the scope of the review amendment peers had forced on the government. The bill's text as amended settles it: the review (section 66) covers the effectiveness of the whole regime, including what powers the AI Security Institute should have; a register of foreign powers posing a cyber threat is section 67; the AI-agent direction powers are sections 44–47. The same stage quietly removed mandatory near-miss reporting. The review clock — twelve months — starts only when the bill becomes law, and the Commons can still change any of it. 5. The amended filing is still blank where it counts (2 Nov). Anthropic filed Amendment No. 1 to its S-1 on 2 November, adding third-quarter results: revenue of $17.0 billion for the quarter (the figure replaces $16.8 billion reported earlier) and a $567 million operating loss. The price range and share count remain blank. A roadshow cannot lawfully begin before 10 November; reported earliest dates are pricing on 13 November and trading on 16 November. Reporting of investor pushback against an early ~$2 trillion valuation talk, toward $1.42–1.50 trillion, is single-source colour at this stage and is labelled as such in the full report. 6. The round was repriced, in the open (30–31 Oct). OpenAI's bridge round — last week a single-source story — is now reported by the Financial Times, confirmed by CNBC, and quantified by the Wall Street Journal at roughly $11 billion committed against an original $30 billion target. The target is now up to $20 billion at a $1.25 trillion valuation, down from $1.4 trillion; whether that figure is pre- or post-money is stated inconsistently across the reporting and is left unsettled here. The round has not closed, and OpenAI has not commented. Its president said on 4 November the company could be IPO-ready in 2027, alongside a JPMorgan partnership that includes its cybersecurity models. 7. The silence broke, and it was the vendor who broke it (28 Oct). For five weekly cycles, the open-source agent platform Langflow appeared in this report only as an absence. On 28 October its maintainer, IBM, published a security bulletin: four new vulnerabilities in every release from 1.0.0 to 1.12.8. Two are rated 9.8. One is an authentication flaw — automatic login was on by default, and a single unauthenticated request returns a full superuser session. The second turns that session into remote code execution, reachable through Langflow's MCP endpoint, the interface that offers its workflows as tools to AI applications. Twenty-nine further flaw records followed the next day. The only fixed version is 1.13.0, released 22 October — six days before the bulletin. A public Metasploit module already probes the flaw; on 4 November a public issue posted proof-of-concept material, and maintainers closed it the next day, redirecting it to the vendor's private reporting programme. None of the new flaws is yet in CISA's known-exploited catalog, and no exploitation has been reported. Honesty requires one addition: the bulletin is dated inside last week's window, and last week's report — scan and checks alike — missed it. The full report records that as a correction against itself. 8. A window expired (6 Nov). Grok 4.8 did not arrive. As of 5 November, xAI's news page, release notes, model list and app menu all still name Grok 4.7 (21 September) as the newest model; Elon Musk's only recent word (30 Oct) is that it "will not be a disappointment," with no date. This is the sixth consecutive weekly cycle without a launch artefact, and the tracker window set for it closes today. Whether the item is re-based to a later date or closed is a judgement this report flags rather than makes. What did not happen Gemini 4 Carbon did not widen. As of 6 November it remains available only to vetted cyber defenders through Google's Fairwind programme; there is no public API version and no general release date. The "~10 November" date in circulation is an analogy from Argon's thirteen-day staged rollout, not a Google statement. No second source confirmed the distillation story. The claim that DeepSeek and Moonshot trained models on GPT-6 Astra outputs still rests on one publication; outlets covering it say they have not verified it. What changed is the evidence landscape: Moonshot published Kimi K3.1 Pro's full weights on 4 November — 1.56 terabytes, ungated, under a licence whose conditions bite only at commercial scale ($20M service revenue; very large products must display the model's name). The claim is now testable against the artefact itself. Canada's Cohere terms did not surface. The 29 October announcement turns out to have been an initial close of the Series E, led by Germany's Schwarz Group, with the amount raised at that close undisclosed. Ownership percentage and board rights remain undisclosed for a second cycle. METR did not surge. A raw count in this week's first, unfocused scan run suggests a hundred-plus mentions of the evaluation organisation; a word-boundary check dissolves them into the word "metrics" inside journal abstracts. Mentioned here because it is exactly the kind of false movement these reports exist to catch — and it was caught in analysis, before publication, by checking the raw text rather than the count. The instrument note (read this before quoting the scan) This note corrects the first version of itself, because the first version described an instrument problem that turned out to be an operator problem — mine. This cycle's scan was initially run without the entity filter this series normally applies: the same keywords and planes, but not the list of tracked organisations the server uses to focus the harvest. Run unfocused, the underlying corpus came back 70% arXiv listings (1,030 of 1,481 signals), with zero URL overlap against last week — and the server returned no entity-filter block, because none had been requested. Re-run over the same window with the filter restored (33 tracked entities; 3,493 candidate items narrowed to 2,075), the corpus flips back to the shape this series is used to: technology-news dominant, arXiv down to 34 items and none in the final set, and the same 135 bound signals — this time all technology-plane, as last week's were. Two things follow. What a monitoring instrument returns is a function of how it is pointed, and the pointing is part of the measurement; that is why this report's findings rest on pinned artefacts — filings, bulletins, bills, releases — rather than on feed volume, and why the per-company mention counts published in earlier editions still have no like-for-like successor here (the corrected run does produce counts, but from a differently-shaped pool, and this report does not pretend otherwise). And the research-literature picture from the first run — runtime authorization for agents, evaluation loops that check themselves, the difference between verification and agreement, transaction-level cost accounting, recovering a model's training data from the artefact itself — was real, but it was what the unfocused harvest sees. The focused harvest sees the trade press. Both are partial; neither is the world. Watchlist (public items) 10 Nov — earliest lawful start of Anthropic's roadshow; a price-range amendment is the artefact to watch. Pricing from 13 Nov, trading from 16 Nov, as reported. 12 Nov — OpenAI's "Cyber at the Frontier" event; GPT-6 Cyber's expansion to all Daybreak Red customers "over coming weeks" is the promise to test. 16 / 30 Nov — Australia's Senate and Joint Select committee reports land. ~10 Nov (analogy, not a promise) — Carbon's Argon-pattern widening date; any Fairwind terms publication outranks the analogy. 1 Dec — Gemini 4 Argon's introductory pricing doubles; Microsoft's no-base-subscription Copilot offers land (a different item from the deferred billing switch, and on schedule). 30 Nov — Sonnet 4.5 retirement; 2 Dec — EU AI Act Article 50 marking duties. Langflow — CISA's exploited-vulnerabilities decision on the four new CVEs, and uptake of the only fixed version, 1.13.0. OpenAI's round — a first close, expected below the $20 billion target, is the next hard number. Kimi K3.1 Pro — independent provenance analysis of the public weights; the distillation question is now empirical. Grades used in the full report: primary artefact / bound scan signal / weak signal / supplementary source-pinned check. Null results are reported at their grade; an absence in the scan is never reported as an absence in the world.