On 4 November 2026 OpenAI described a mid-October run in which agents on an unreleased model scoped the kernel down to about 7% of its code and produced 2,308 candidate bugs in 12 hours. Triage agents reproduced 1,724 of them in 30 hours, and exploit agents produced 1,169 working root exploits against a stock desktop distribution with standard protections enabled. These traced back to 948 distinct flaws, at a cost of about $1,279 per exploit. In an early run, 20 of 200 claimed exploits reached root through a different zero-day than the one assigned, so OpenAI added an independent check. When the 10-day run and analysis ended, 61 flaws were patched upstream, 43 had staging patches and 299 were in public reporting. The rest are still to be sent through OpenAI's Patch the Planet partners. Independent confirmation would come from kernel maintainers or distributions publishing counts of fixes attributed to this run.

The component class is every Linux host where an untrusted or semi-trusted party runs code as an ordinary user: CI runners, shared build hosts, multi-tenant container nodes, agent sandboxes and developer workstations. Discovery and exploitation now run in days, while fixes flow through upstream, then distribution, then your patch cycle. In CSA's reading, the gap between 948 and 61 is the exposure window, and it will stay open for weeks to months on hosts that track distribution kernels. OpenAI itself recommends isolation layers such as microVMs and user-space kernels to contain the blast radius.

On 4 November 2026 CERT-In's financial-sector CSIRT updated its 9 October advisory, named the actor Crafty Falcon, and called the campaign an escalation. Entities that had acted on the restricted advisories were hit again, including after incomplete remediation, and attacks were timed for holidays, weekends and other low-monitoring windows. The attackers enter through internet-exposed UAT and staging environments, move to production with shared credentials, and abuse cloud management services such as AWS Systems Manager and Lambda. They reverse-engineer client apps to call payment APIs directly, and get past IP allow-lists by routing traffic through shared third-party fetcher pools. Rs. 1 test transactions come before large transfers. CERT-In says the attack infrastructure rotates IP addresses within hours to days.

The component classes are payment and disbursement APIs, non-production environments that share secrets with production, and allow-lists that trust shared vendor IP ranges. The lesson travels beyond India: indicator-based remediation does not hold against tooling that re-plans each run, and CERT-In says plainly that entities "should therefore not limit their response to blocking indicators." The advisory also tells entities to look for AI coding-agent processes running with permission checks disabled and LLM API traffic from servers, which are signs of a planted attack console.

OPSShield, maker of the cPGuard security suite for Linux hosting servers, disclosed on 4 November 2026 that an attacker registered a trial account under a false identity, installed cPGuard to study how its agent talks to the licensing system, and then got command execution on the billing and licensing server. The next day the attacker uploaded eight fake updates in five minutes. For more than 70 minutes, cPGuard agents installed them as root. The script took password hashes, root SSH keys, MySQL root passwords, root shell history and cloud storage keys, left a hidden root shell, and staged the data on OPSShield's own licensing server. OPSShield attributes the speed to AI-assisted attackers in general terms, without forensic evidence for this case. A clean v5.88.26 removes the shell.

The component class is any security or management agent that runs as root and accepts updates automatically: EDR, hosting control-panel plugins, RMM and backup agents. Attacker time from reconnaissance to fleet-wide root fell to about ten hours, and the vendor's push turned one compromise into about 2,950. No human change process works at that speed, so the control has to be at the update boundary. If you run cPGuard, root SSH keys, database root passwords and cloud keys on those servers should be treated as stolen.