OpenAI says GPT-6 Cyber built working privilege-escalation exploits for 948 Linux kernel bugs and documented 81 Firefox flaws. Every number is OpenAI's own, and no CVE IDs are published.
Trail of Bits detailed an agentic workflow built on Codex (GPT-5.6) that has backported fixes for 149 CVEs into stable Linux kernels, with 30 min–3 hr of human review per patch.
A hijacked remote MCP server could run PowerShell on a developer's machine during OpenCode sign-in on Windows/WSL. No CVE; fixed silently in 1.18.33. Pillar Security disclosed it October 19.
CloudSEK details MALFEX, a single-operator npm campaign active since 2023: 8 malicious packages, 40,000+ downloads, delivering the Overlord RAT and an infostealer.
OX Security found 101 npm packages, ~490,000 downloads, that abuse the Baileys library to silently add developers' WhatsApp accounts to spam channels. Most are still live.