Friday, and the security story is eating the AI story — or maybe they were always the same story. Today the biggest model launch of the year is also a hacking tool, the company that shipped it is trying to hand the same power to defenders, and the coding agents your team leans on turned out to be a fresh way into your machine. The throughline: AI is now standing on both sides of the security line at once, and the operators who win are the ones who plan for that instead of picking a side.
The frontier model that writes exploits
OpenAI unveiled GPT-6 Astra, and among the capabilities it advertised is a blunt one: Cybersecurity News reports the company says the model can identify zero-day vulnerabilities and create working proof-of-concept exploits during authorized cybersecurity work. It's positioned as OpenAI's most capable model to date, built to autonomously carry out complex tasks across computers and browsers, per AIdapted.
The operator's take: a capability marketed for "authorized" testing does not check for authorization. The same model your red team uses to find bugs is the one an attacker uses to find yours, faster and cheaper than a human, and the delta between the two is a license agreement nobody enforces. Assume your exposed surface is being probed by something that reads code as well as your best engineer. That means shrinking the attack surface you can't defend, shortening your patch window from weeks to days, and getting your own hands on these tools for authorized testing before someone else uses them on you unauthorized.
OpenAI moves to arm the defenders
In the same breath as the offense, OpenAI is trying to tilt the balance back: Infosecurity Magazine reports the company has committed to subsidizing access to Daybreak, helping defenders deploy its AI models inside their existing cybersecurity infrastructure. It's a direct acknowledgment that if frontier models make attacks cheaper, defenders need the same firepower at a price that clears procurement.
The operator's take: subsidized access is a real lever, but a subsidy is not a strategy. The value shows up only if your defensive AI plugs into telemetry you actually collect and workflows your team actually runs — otherwise it's a discounted dashboard nobody reads. Before you sign, ask where the model sees your data, what it can act on versus only flag, and who reviews its calls. The winning move is to close your visibility and log-coverage gaps first, so that when defensive AI arrives it has something to defend, not a blind spot to hallucinate into.
Your coding agent can be turned against you
The battleground, as usual, is developer tooling. Security reporting this week flags malicious .git configurations that can make coding agents like Claude, Codex, and Cursor execute an attacker's code, per a daily security recap of the week's threats. Cloning or opening a poisoned repository is no longer a passive read when an autonomous agent is pointed at it.
The operator's take: you spent the year giving AI agents access to your repos, terminals, and credentials to move faster — and that access is now the exploit. An agent that can run commands on your behalf will happily run someone else's if the repo tells it to. Treat agent execution as production: sandbox untrusted repositories, scope agent permissions to the minimum, strip credentials from the environments they run in, and log what they do. The productivity is real, but an autonomous tool with your keys is a liability until you've drawn the box it's allowed to operate in.
Also on my radar
- Quantum clock is ticking, officially. The G7 published a call to action urging governments to launch national strategies for the post-quantum encryption transition, per Infosecurity Magazine. Not an emergency this quarter, but "harvest now, decrypt later" means the data you encrypt today is the data being stockpiled — start your crypto inventory now.
- Patch this weekend. ServiceNow shipped fixes for multiple flaws in its AI Platform, three rated CVSS 10.0, including a code-injection bug allowing remote code execution without authentication, per Telefónica Tech. Maximum-severity, unauthenticated, in a platform that touches your whole org — this jumps the queue.
- Build-vs-buy tips toward build. A McKinsey read of enterprise AI finds 32% of organizations skipped buying at least one software product because they could build it internally with agentic coding tools, per AI Agents News. When a third of buyers walk because they can build it themselves, every SaaS renewal on your desk deserves a second look.
The throughline for a Friday: AI has become a dual-use tool, and pretending otherwise is the mistake. The model that writes exploits is the model that patches them; the agents that ship your features are the agents that can be turned against you; and the subsidized defense only pays off if your fundamentals — visibility, least privilege, patch speed — are already in place. The tooling changed sides overnight. Your security basics didn't, which is exactly why they matter more today. That's the Signal for today.
Paul Sapio is the CIO of Mikhail Education and a full-stack AI engineer. Open to contract work in security, networking, AI, and SaaS development — reach out.