GPT-6 Cyber Builds 948 Linux Exploits, Claude Code Leaks Secrets to GitHub

This is the AI Security Brief for Monday, November 9. An AI model builds hundreds of Linux exploits, Claude Code leaks secrets to GitHub, and stolen AI keys push a bad plugin to 5,000 companies.

OpenAI's new restricted access model, GPT-6 Cyber, is built to find and validate exploitable vulnerabilities. According to CSO Online, OpenAI researchers used it to find 81 previously unknown high-severity bugs in Firefox. They also developed working exploits for 948 Linux kernel vulnerabilities, 588 of them previously unknown. Noma Security's Chris Hughes points out OpenAI's own Patch the Planet dashboard shows less than a 25% remediation rate. Finding is outpacing fixing. What does that mean for us? Well, more patches, faster. Make sure your patch process can keep up.

When you approve a command in Claude Code and pick, yes, and don't ask again, the tool can save that command word for word in a project settings file. If it included a password or an API key, the secret lands in the file too. According to The Hacker News, security company Apiiro says 1,122 public copies are sitting on GitHub, where anyone can read them. The rule of thumb is, secrets don't belong on the command line. Scan your repos for these files and rotate anything exposed.

Alex Stamos, chief security officer at Cognition, told The Verge that hacks are being chained together. From what's known, he says, attackers broke into Fireworks, a provider of AI services, and stole API keys. Those keys got them into Cursor. From there they pushed a bad plugin that went to 5,000 more companies. Stamos says open-weight models can now automate most of the kill chain. What's the lesson for defenders? Well, your AI vendors are part of your supply chain. Treat their keys and plugins that way.

OpenAI added Lockdown Mode to ChatGPT in June 2026 as an optional setting. The idea is to reduce data exfiltration from prompt injection. Researchers have now disclosed a flaw that got around it. According to The Hacker News, it could enable silent theft of chat data and phishing, with no user interaction. The good news, it's patched. You can think of it as locking the front door while the side window's open. Lockdown Mode is a layer, not a guarantee. Treat prompt injection as a live risk.

Claude Code runs on developer workstations and executes commands with the developer's permissions. CIO says start with managed settings and hooks. Before the agent uses a tool, a hook looks at the request and says, allow it, block it, log it, or ask a human. The gap is, the hook sees the command, not what it causes afterward. An install script can read cloud credentials and open an outbound connection, and none of that passes back through the checkpoint. Hooks are policy enforcement, not detection and response. Back them with endpoint monitoring.

Check Point Research has found what it calls prompt adware. It's hidden in a jailbreak bundle for OpenAI's Codex agent called Haiou. According to The Hacker News, the bundle modifies the agent's trusted instructions to insert advertisements for a third-party AI gateway. Folks install a jailbreak to get around restrictions. What they get is an agent taking orders from someone else. Today it's ads. The same trick could carry something worse. Agent configuration files deserve the same scrutiny as any startup script. Know who changed them and when.

The White House Accord on Super Intelligence is voluntary, signed by executives from Anthropic, OpenAI, Google, Meta, xAI and Nvidia. One of its four layers of oversight calls for independent external auditors. According to Crypto Briefing, Schellman points out the accord never defines who counts as one, or how conflicts of interest get managed. Schellman's own survey found 74% of AI governance professionals believe their organizations could pass an AI compliance audit. Only 27% have fully mature programs. When a vendor says independently audited, ask who did it and what they found.

Three things for this week. First off, scan your repositories for Claude Code settings files and rotate any secrets you find. Next, look past the checkpoint. Back agent hooks with endpoint monitoring, and track who changes agent configuration files. And then lastly, get your patch process ready. AI is finding bugs faster than we're fixing them, and that queue isn't getting shorter.

That's the brief. For CompTIA SecAI+ study guides and free security tools, go to skillthropic.com, and subscribe so you catch the next one on Thursday.