An automated pipeline patched its way through nearly a thousand Linux flaws, ChatGPT’s search volume hit a new milestone, and OpenAI went courting the towns that host its data centers.
A Thousand Fewer Paths to Root
On Tuesday, OpenAI published a research post with a striking title: “A Thousand Fewer Paths to Root.” Its Cyber team built an automated pipeline around an upcoming cyber model, pointed it at the Linux kernel, and let it run for about ten days in mid-October. The results are hard to wave off. The pipeline started with 2,308 candidate findings, reproduced 1,724 of them as real vulnerabilities, and turned those into 1,169 working exploits. After grouping exploits that traced back to the same flaw, that came down to 948 distinct bugs, each one a local privilege escalation — meaning an ordinary user account could become root. For every one, the pipeline also drafted a candidate patch, which human researchers reviewed before anything went to the kernel maintainers.
The Cost Curve Is Falling Fast
The whole run cost about $1.2 million in API credits, or roughly $1,279 per exploit. And the trend line should make defenders pay attention. In July, the same kind of harness running GPT-5.6 Sol found 166 unique privilege escalations for about $514,000. Three months of kernel hardening later, the newer model found more than five times as many, at a lower cost per bug. Finding bugs at scale is getting cheap, and the bottleneck is now patching fast enough to keep up.
What the Numbers Don’t Say Yet
A few things are worth keeping in perspective. First, these are local attacks. An attacker would already need an account on the machine, so this is not remote takeover. Second, 948 drafted patches are not 948 fixes already shipped. By the time the scan finished, 61 of the flaws had been patched upstream, 43 had patches in staging, and 299 were being reported and discussed in public. The rest are still working their way through. OpenAI was also candid about a miss along the way. In an early test run, the agents reported 200 successful root exploits, but human review found that 20 of them had reached root through a different zero-day bug than the one they were assigned. OpenAI says it tightened the checks after that. And in a sample of the exploits, its agents used ten exploitation techniques that outside kernel experts had not seen before. For safety reasons, it is not sharing the details. These are OpenAI’s own figures, not an independent audit, but the direction is clear.
ChatGPT Is Now a Fifth of Google’s Search
Speaking of OpenAI, here is a number that says a lot about how people actually find things now. Adam Fry, who leads consumer products for ChatGPT, told journalists at an event on Monday that the volume of search-like queries running through ChatGPT is now roughly one fifth of Google’s search volume. The definition matters. OpenAI only counts a search when your question makes ChatGPT actually look something up on the web. Asking it to define a word, or explain a simple how-to, does not count. So this is not a market share figure, and OpenAI did not say where it got Google’s number, or how it was measured. Treat it as the company’s own estimate, not an independent measurement. Even with that caveat, the scale is striking. Fry also said ChatGPT has 1.2 billion weekly users, and that people generate 1.5 billion images a week through it. For comparison, Microsoft’s chief executive told Google’s antitrust trial in 2023 that Bing had about three percent of the search market after more than a decade of trying. ChatGPT got much further by not looking like a search engine at all. And Google is not shrinking. Google says its own search volume is at an all-time high. The total pie of questions people ask is growing, and a fifth of the search-like slice is now going through a chatbot.
OpenAI’s Charm Offensive in Data Center Country
Now, the other OpenAI story today, and it is really about politics. OpenAI published two documents this morning, a National Community Compact and a Compute Campus Policy Blueprint. The headline commitment is that future campuses OpenAI owns and operates will pay their full electricity and infrastructure costs, so local residents do not end up footing the bill. The compact goes further than money:
- OpenAI will no longer sign non-disclosure agreements with public officials when negotiating future sites.
- It will share construction plans and their effects on traffic, noise, and lighting, and commission independent noise studies before operations begin and every year after.
- It will publicly disclose site-level water and electricity use.
There is real money attached in two places already. In Effingham County, Georgia, OpenAI points to an $80 million community commitment, including a $4.8 million grant for free school meals for all 14,000 county students, and $2 million to develop a local park. In Pike County, Ohio, OpenAI and the developer SB Energy have jointly committed $6 million toward childcare. And in Georgia, its agreement with Georgia Power lets the utility cut electricity deliveries to the campus by up to 1,000 megawatts during periods of high demand. The timing is no accident. Voters just went to the polls on Tuesday, and of the 41 data-center-related ballot measures voted on this week, all but one went against data centers, according to Ballotpedia. Shares of data center operators and power companies fell on Wednesday. This is the follow-through on a plan OpenAI’s chief global affairs officer, Chris Lehane, has been drafting since August, aimed at the lame-duck Congress, which opens on November 9. One limit to note: the compact covers campuses OpenAI owns and operates itself. Partners like Oracle are building and own much of its data center infrastructure, so the promise is real, but it does not cover everything with OpenAI’s name on it.
CrowdStrike’s Half-Billion-Dollar Bet on Watching AI Agents
Let us turn to security, because the deal flow there is moving fast. CrowdStrike announced on Tuesday that it is buying two AI security startups, Fiddler AI and Dreadnode, in deals worth roughly $495 million combined. The prices come from the Wall Street Journal, as reported by TechCrunch: about $400 million for Fiddler AI, and about $95 million for Dreadnode. Fiddler builds observability software that watches what AI agents are actually doing inside a company, and it will become a product called Falcon Observe. Dreadnode automates security testing that hunts for flaws in AI models, apps, and agents before they go live, and it will feed into CrowdStrike’s Falcon Guardian. Fiddler was founded in 2018 and has raised about $99 million. Dreadnode was founded in 2023 and has raised $14 million. What CrowdStrike is buying, in both cases, is the same bet: that as companies deploy agents wholesale, somebody has to watch them, test them, and prove they behaved.
Quick Hits: Meta Buys Conductor, OpenAI Eyes Pierre, Tencent’s Hy4
First, Meta has acquired Conductor, a startup founded in 2024 that lets developers run several AI coding agents at once, each in its own parallel workspace. The agents themselves come from labs like Anthropic and OpenAI. Conductor only supplies the layer that organizes them. Meta confirmed the deal to TechCrunch but would not say what it paid. Conductor only launched its core product last summer, and the transition is already moving fast. Conductor Cloud becomes read-only on November 13, shuts down on November 20, and then the company starts deleting user cloud data. Meta launched its own coding agent, Muse Code, in August, and says its Muse agents have passed ten million users. And on the same day, OpenAI announced it plans to acquire Pierre Computer Company, the small team whose code tools already sit inside its Codex app. Finally, Tencent launched Hy4, the full version of its large language model, on Wednesday. It is a 770-billion-parameter model, with 49 billion active per query, and for the first time in the series it can understand images and operate computers directly, clicking through apps and running command-line tools. Two catches. First, it is API-only for now. Tencent says the model weights and a system card are coming in the next few days, so the open-source part is a promise, not yet a download. Second, the benchmarks are Tencent’s own. On its computer-use test, Hy4 scored 78.9, just behind Claude Opus 5.5 at 81.8. Pricing is roughly $0.90 per million input tokens and $2.70 per million output tokens, with free use in its WorkBuddy and CodeBuddy products through November 15.
Sources
- OpenAI AI pipeline finds 948 Linux kernel root exploits: OpenAI
- ChatGPT reaches 20% of Google search volume: The Verge
- OpenAI National Community Compact and Compute Campus Policy Blueprint: Reuters
- CrowdStrike buys Fiddler AI and Dreadnode for about $495M: TechCrunch
- Meta acquires Conductor; OpenAI plans to acquire Pierre: TechCrunch
- Tencent launches Hy4 model with vision and computer use: Tencent
Adapted from the November 5, 2026 episode of Daily Tech and AI.
Daily Tech and AI is AI-voiced and produced by Angelo Ruiz.
Leave a Reply