TR

AI weekly: Anthropic’s self-improvement warning, GPT-6 Cyber, and a WordPress patch race

Artificial Intelligence 13 min

By View .md

Brass balance scale with light glowing tokens rising on one side and heavy padlocks sinking the other
Tokens keep getting cheaper and open models keep shrinking, but the cost moved somewhere else: into Anthropic's margins, gated cyber models and a WordPress update that is itself the attack window.

Sunday, 8 November. One line for the week: tokens got cheaper, risks got pricier.

The AI news this week starts with a filing. Anthropic’s amended S-1 says it may “imminently” meet the AI R&D threshold in its own safety policy, and its compute cost climbed back to 58% of revenue. Ramp says companies use more AI but stopped spending more on it. OpenAI gated its strongest cyber model behind vetting, while an open AI attack framework sat exposed in about 815 deployments and Chainalysis said an attacker using “offensive agentic techniques” got credentials for all its users. WordPress patched a core flaw attackers can hit during the update itself. A 65B open model fits on a DGX Spark. And The New York Times went after the pipe that feeds web pages to AI companies.

🔁 Is Anthropic about to let Claude build Claude?

Not yet, by its own account. But the S-1/A filed Monday, 2 November, says “our internal estimates and our expectations regarding future models, rather than our current models, indicate that we may imminently meet our Responsible Scaling Policy’s definition of ‘dramatically accelerated progress attributable to AI.’ We have not designated any of our current models as exceeding this threshold.”

TechCrunch calls it being close to RSI, recursive self-improvement. That’s TechCrunch’s shorthand. The filing goes further: “we have in the past not identified, and may in the future not identify, a significant acceleration in our rate of development until after it has occurred.” And Anthropic does not expect to “safely use Claude to fully autonomously design and build successive generations of frontier models without meaningful human supervision”, so it is “considering updates to our Responsible Scaling Policy to keep humans in control.” TechCrunch’s caveat holds: an S-1 is disclosure and marketing at once.

The money. Q3 revenue was $16,956M, up from $11,555M in Q2. The filing says revenue grew 1,127% year over year while compute and infrastructure grew 382%. But operating income of $974M in Q2 became an operating loss of $567M in Q3. The $23,291M net loss is mostly fair-value charges, as with the original S-1 we covered last week.

Compute as a share of revenue: 251% in Q1 2025, 48% in Q2 2026, back up to 58% in Q3. The filing blames “$5.0 billion of compute under short-term commitments, which currently costs significantly more” than multi-year deals. TechCrunch reads the chart as revenue per compute dollar peaking just over 2x and falling to 1.72x. The fix is “Anthropic Direct”, leasing chips directly in dedicated facilities to “backfill” short-term compute with “more cost-effective, long-term compute.”

Commitments, as of and subsequent to 30 September: about $895.4B, substantially all compute and infrastructure, about $447.5B of it before 31 December 2030. Last week’s $265.6B was a narrower measure, so this is not growth. Not spent money either.

The price range is still blank (“between $ and $”). Reuters reported on 5 November that potential investors doubt the roadshow can start next week in time for a November listing. Anthropic declined to comment.

If you build on Claude, two signals. A lab is telling the SEC it may only notice its own speed-up after the fact, so read the original words, not headlines. And a vendor paying a premium for $5.0B of short-term compute will show it in pricing and rate limits. Caveat: Anthropic says no current model crosses the threshold.

Neural network spiraling back into itself like a staircase, a human hand resting on a brake lever at the base
Anthropic’s filing says it may only notice its own speed-up after the fact. Illustration: Higgsfield.

📉 The money check: more AI, flatter spend

After Tuesday’s US midterm results, investors worried about limits on data center construction, and on Thursday, per CNBC, Nvidia fell 9.3%, AMD 17.3%, Micron 17.5%, Broadcom 10.4%. Nebius lost 15%, Iren 17%, CoreWeave 10%. CNBC cites IDCA: at least 46 AI data center projects in 20 states, more than $170B of announced investment, were blocked, withdrawn or stalled after community opposition between January 2024 and May 2026.

UPI says Thursday pushed the Nasdaq into correction territory. Friday it rose 1.09% to 24,579.42 but lost 3.4% on the week.

Then Ramp. Its lead economist Ara Kharazian told TechCrunch token spend grew only 1.5% across August and September, after 42% month-over-month in July, then rose 8.9% from 23 September to 23 October. Volumes are up, prices fell. In Kharazian’s words: “You can use more AI, but use it for less.” Median firms spend $12 to $15 per employee per month. The top 1% were near $10,000 per employee at their summer peaks. TechCrunch reports Anthropic said in a filing that Fable 5.1 and Opus 5.5 price cuts reduced revenue growth by about $600M.

OpenAI, per TechCrunch, has raised $11B at a $1.25T valuation in a round that could total about $20B.

The price war is on your side for now. “Tokens go brrr, costs go ahhh,” as Notion’s Akshay Kothari told TechCrunch. Expect discounts tied to annual commits. Caveat: one bad week is one bad week, and October spend already turned up.

🛡️ GPT-6 Cyber: the strongest cyber model you can’t use

OpenAI launched GPT-6 Cyber on 5 November, a cyber-specialized GPT-6 Astra for vulnerability discovery, exploit development and web pentesting. The system card rates it Critical in Cybersecurity. OpenAI’s own numbers:

  • ExploitGym 48.5%, up from 32.1% for GPT-5.6 Cyber.
  • RemoteExploitBench: GPT-6 Astra with Daybreak Blue refused 100% of tasks, GPT-6 Cyber completed 95%.
  • Avoided exploiting out-of-scope services in 99.93% of cases without deployment safety prompts, 100% with them.
  • 81 novel high-severity Firefox vulnerabilities. On Linux, 1,724 kernel vulnerabilities reproduced and working exploits for 948, versus 166 for GPT-5.6 Sol. 304 critical findings disclosed with candidate patches.

Access is the story. A select group of approved Daybreak Red customers gets it first, through the API and Codex. OpenAI’s Help Center lists separate approval, identity verification, SSO, MFA and API IP allowlisting by default. A $1B grant program covers resource-constrained defenders.

So the frontier cyber model is real, and not for you unless you’re vetted. What reaches everyone is Firefox and kernel patches. Bug supply went up, so patch faster. OpenAI already watches its own agents, and now it is choosing who holds the sharpest one. Caveat: all figures are OpenAI’s, on OpenAI’s evals.

🕳️ The other side of the wall

On 30 October Chainalysis said an external actor used “offensive agentic techniques” to reach its systems and internal tools. On 4 November it said “names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor”, and took KYT, address screening and login offline. By 7 November services were back, after forced password resets, API key rotation and IP allowlists. It reports no evidence investigations data was accessed. The Record notes Chainalysis never explained the phrase and did not explicitly say an AI agent caused the breach.

Then ARTEX, an open-source LLM-driven pentest framework on GitHub since July 2026, AGPL-3.0, working with Anthropic, OpenAI or any compatible endpoint. On 4 November Censys saw 1,465 hosts with an exposed console, roughly 815 distinct-looking deployments. CrowdStrike linked ARTEX to a campaign against South Korean financial institutions, and Microsoft to a ConnectWise tenant compromise it attributes to Storm-0940. TechCrunch says many linked attacks used weak passwords and missing MFA. Censys’ Silas Cutler says many instances belong to authorized testers.

The vetted model sits behind SSO. The open one runs on any API key, often from a reseller, and its operators leave it public. Damage still came through passwords, tokens and missing MFA. Rotate keys (remember LiteLLM), allowlist IPs, and learn who holds a live token for you. Caveat: “AI agent hacked Chainalysis” is a headline, not a finding.

Two mirrored control rooms split by glass, one locked behind badge readers, the other open to a dark street
Same week, two doors: a vetted cyber model behind SSO, and hundreds of open ARTEX consoles. Illustration: Higgsfield.

🧩 Why is updating WordPress the risky part this time?

Because the update is the window. CISA added CVE-2026-119977, a WordPress core TOCTOU race condition, to KEV on 3 November. WordPress 7.1.4 fixed it on 28 October, crediting Umut Bayram, alongside stored XSS fixes, two credited to Anthropic. Backports to branches back to 4.7 are in progress and ship as ready. Don’t assume yours has one.

Per The Hacker News, it hits 4.7 through 7.1.3. During a core update WordPress unpacks the new version, installer included, into a temporary folder in wp-content/upgrade. An unauthenticated attacker who guesses the name in time can run code. The update that installs the fix still uses the old updater, so on 5.9 or later the name is predictable one last time. Wordfence saw attempts nine minutes after shipping a firewall rule, and probing for about 14.5 hours.

The researcher’s advice: block /wp-content/upgrade/ before updating. On Nginx, a location block denying that prefix. On an Apache vhost, “Require all denied” for the folder. With only .htaccess, put this in the root file, above the WordPress rules:

RedirectMatch 403 ^/wp-content/upgrade/

Confirm it returns 403, then update. wp core update is no workaround, same updater. Then check for unknown admins, plugins nobody installed, PHP files in wp-content/upgrade.

This site runs on WordPress, so it’s close to home. Boring paths win again. Caveat: sample rules from one write-up, not a guarantee for every host.

📦 Open weights got small

Ripple-65B Preview from Ricursive Intelligence (4 November) is a 65B dense Transformer trained from scratch on 12T tokens, Apache 2.0. Ricursive reports Terminal-Bench 2.1 at 80.52 and says the full R&D cost was $32M. Those are self-reported, and the model card also lists Terminus 2 harness rows with different comparator scores, so don’t mix them. Terminal-Bench 2.1 is not 4.0 either.

The card says NVFP4 runs on “local devices such as NVIDIA DGX Spark”, BF16 on 2x B200. Its 250 tok/s figure is 2x B200 at batch 8, not a Spark number. Together lists $0.20 in, $0.60 out per 1M tokens. I have a DGX Spark and this is the first open model in its class I want to try on it. I haven’t run it, so no impressions.

Baidu’s ERNIE 5.5 Flash Base (5 November) is a 280B MoE with 14B active, a base checkpoint with no post-training. Baidu reports MMLU-Pro 78.4. Like LongCat-2.5, read it slowly. Especially the license, which is custom, not Apache. No license charge while related-product revenue stays at or under US$50M, measured over the rolling prior 12 months, summed across entities under common control, counting a whole product even if it mixes models. Exactly $50M qualifies. Above needs Baidu’s prior written authorization. Below still needs attribution and a one-time notice before first commercial use.

Pending, per a check on 8 November between 18:05 and 18:10 Istanbul time:

  • Inkling 2 Small (594B, 17B active) is on Tinker with closed weights under Tinker Terms of Use. Thinking Machines intends Apache 2.0 weights “next week after the completion of external safety testing and red-teaming.” No public repo in the official HF org at this check.
  • Tencent promised Hy4 weights “in the coming days” on 4 November. None among the tencent org’s 50 latest repos at this check.
  • Kimi K3.1 Pro weights landed 4 November (digest). Cognition’s SWE-2 Flash weight program still has no details.

Check the license column first. Apache 2.0, a revenue gate and “Apache later” are three different promises.

Who gets the model? This week’s releases by access

Model Size Access License Where it runs Vendor’s headline number
GPT-6 Cyber (OpenAI) not disclosed Vetted Daybreak Red orgs only, SSO, MFA, IP allowlist Proprietary OpenAI API and Codex ExploitGym 48.5% (GPT-5.6 Cyber 32.1%)
Ripple-65B Preview (Ricursive) 65B dense Open weights Apache 2.0 One DGX Spark (NVFP4) or 2x B200 (BF16), plus hosted APIs Terminal-Bench 2.1 80.52 (self-reported)
ERNIE 5.5 Flash Base (Baidu) 280B total, 14B active Open weights, base checkpoint only Custom Baidu license, revenue gate at US$50M with conditions Multi-GPU (FP8 or BF16) MMLU-Pro 78.4
Inkling 2 Small (Thinking Machines) 594B total, 17B active Tinker only, closed weights Tinker Terms of Use, Apache 2.0 promised “next week” Tinker No public repo in official HF org at 8 Nov check
Tencent Hy4 n/a Weights promised “in the coming days” not yet published n/a Not seen at 8 Nov check

Scores are each vendor’s own, on different benchmarks. Do not compare across rows. Sources: the vendor pages linked above and the Inkling 2 Small model card.

Compact AI computer on a wooden desk with a glowing model unfolding from it like origami
Ripple-65B’s NVFP4 checkpoint is built to fit a single DGX Spark. Illustration: Higgsfield.

📰 The Times goes after the pipe

The New York Times sued Brave Software in the Southern District of New York on 2 November. The complaint, quoted by Ars Technica, calls Brave “the supplier, dealer, and distributor of stolen copyrighted content” for its users and AI companies “including Anthropic, Perplexity, Mistral, xAI, and Cohere.” The theory: AI firms pay for real-time content through the Brave Search API and use it for training and answers. The suit adds a DMCA claim over Brave’s “Paywall blocker” and claims Brave “has made more than $100 million”. Brave had not responded, per The Verge.

Last week the labs agreed on one robots.txt line. This week a publisher went after the search index between web and model. If your RAG stack buys “web search”, you inherit how that index got the page. Ask your provider. Caveat: these are allegations.

🗞️ More AI news this week

👀 Next week

Anthropic’s roadshow, if Reuters’ doubts prove wrong. Inkling 2 Small and Hy4 weights, both still promises. Anthropic said the Claude watermark on Amazon Bedrock would finish rolling out by 10 November. Conductor Cloud goes read-only on 13 November. And WordPress sites that update late: their next update still runs the old updater.

Sources

Oğuzhan Koçaklı

Oğuzhan Koçaklı writes and advises on AI engineering, agents, GenAI products, and applied ML. Daily digests and deep dives in EN + TR at oguzhan.co.

All posts

Leave a Reply

Your email address will not be published. Required fields are marked *