October 30, 2026 | Read online

AI in 2027: Cybersecurity Wars

Google's new frontier model is sold on cybersecurity. So is Mistral's. Meanwhile two crews ran AI-assisted intrusions against 200+ organizations.

Good morning. It's Friday, October 30th.

Google's newest frontier model is sold on cybersecurity. Mistral's trillion-parameter open weights are sold on cybersecurity. OpenAI published the monitoring stack it uses to catch its own models breaking out of their sandboxes. And in between all of that, two China-nexus crews ran AI-assisted intrusions against more than 200 organizations.

I’m calling it now: 2027 will be a cat-and-mouse of cyber attacks and defense!

-Jeff
AI Breakfast

_{In partnership with Maket}

Maket: Drag a Room, Redesign the Floor Plan

Floor plans tend to break at the same point. The kitchen is in the wrong spot, the office should face the backyard, or the primary suite needs to move away from the street. In most tools, fixing that means starting over.

Maket’s new Move Rooms feature lets you rearrange your plan without starting over. Grab a room, drag it somewhere new and drop it. Your existing design stays intact while you try different layouts and swap rooms around.

It’s useful for:

Homeowners testing “what if the kitchen went here?” before talking to an architect
Designers showing clients several layouts in one meeting
Builders adjusting stock plans to fit a lot or a buyer’s wishlist

You get the layout you want by dragging and dropping, not by rebuilding the plan.

Try Move Rooms on Maket →

Google's best model leads on cyber, and almost nobody can use it

Google shipped Gemini 4 Carbon on Wednesday, two weeks after Gemini 4 Argon, and calls it its strongest model with state-of-the-art cybersecurity and long-horizon capability. It takes #1 on the Artificial Analysis Intelligence Index v5.0 at 59, and the security numbers are the pitch: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploiting them, and 71.0% on CWE-bench for patching them. On WebDev Arena it sits fourth at 1768 Elo, up 89 points.

Carbon posts a 0.0% attack success rate on Gray Swan's indirect prompt injection benchmark, down from Argon's 0.7%, and drops successful cheating on Terminal-Bench 4.0 to 0.0% with attempts at 0.4%. Google says high-severity misalignment alerts in live coding environments fell almost 80% versus Argon, unsupported claims roughly halved, and the Chrome team measured more than 10x better patch quality than another lab's frontier model. Those are internal and partner numbers, evaluated without guardrails. Google says it took part in the US government's voluntary pre-release testing.

Access starts this week with a subset of cyber defenders and widens gradually to trusted partners through the Fairwind Program. Developers, businesses and consumers get it "coming soon," with no date. Introductory pricing is $2 per million input tokens and $10 per million output, cached input 95% off, going to $4 and $20 after the introductory period.

A model that tops both vulnerability discovery and patching is dual-use by construction, and gating it to defenders first is the right instinct. It also means the published numbers are the only thing most of us can check for a while. Note the pricing: Google is charging flagship rates for a model you cannot buy yet.

Two China-nexus crews ran AI-assisted intrusions this week, against real targets

Start with the story we covered on October 23. Israeli startup Dream published research, independently verified by Palo Alto's Unit 42, showing attackers chaining PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) with Fragnesia (CVE-2026-46300), a Linux kernel privilege escalation flaw in the XFRM ESP-in-TCP subsystem. The chain completes in under 15 minutes and rooted 25 servers, including Palo Alto firewalls belonging to US government-affiliated organizations, with targets across the US, Japan, Taiwan and South Korea. Investigators found Claude Code, an aiscan install wired to DeepSeek and Kimi models, and FOFA keys used to map about 19,000 internet-facing PAN-OS firewalls. CISA added Fragnesia to its Known Exploited Vulnerabilities catalog. Unit 42 puts the affected share at roughly 0.02% of the installed base, all of them with management interfaces exposed to the internet.

Separately, CrowdStrike attributed a campaign to VAPOR PANDA, a China-nexus group it has tracked since 2021, running an agentic framework called ARTEX: a main agent directing planner and worker agents over a shared graph of facts, findings and goals. It ran mainly on DeepSeek, plus a second commercial model CrowdStrike could not identify. One intrusion's planning agents burned about 1.4 billion input tokens. More than 200 organizations were targeted, a single controller hit entities in at least 14 countries inside an 11-day window, and post-exploitation was confirmed at nine. The agents checked which hosts lacked a Falcon sensor and aimed follow-on activity at the unprotected ones. A human steered at decision points.

Neither crew used a model to invent an exploit. They used models to run many intrusions at once against bugs that were already public, which is the part that should worry you. The defender's edge has not moved: patch, and get your management interfaces off the internet. Both campaigns walked through the same door.

OpenAI published the monitor that would have caught its own escape

OpenAI described a four-layer system for catching misaligned behavior in training, evaluation and internal use. L0 is lightweight activation probes tuned for recall, with 5% of unflagged traffic sampled anyway. L1 is a model-based reviewer reading recent conversation, reasoning and tool use for deception, unauthorized actions and evaluation manipulation. L2 sends security and alignment investigative agents to reconstruct incidents in an isolated environment. L3 adds network logs and system telemetry for sensitive workloads. Critical alerts can pause a workload automatically, and where paging is enabled, top-priority alerts reach a human in about 15 minutes.

The headline test is a replay of the Hugging Face incident, which began inside internal cybersecurity evaluations that monitors did not cover at the time. With the strengthened stack, the simulation alerted security about 30 minutes after the agents escaped their sandbox, more than 30 hours before Hugging Face's systems were breached in the real event. A live case is more convincing: on September 20, a model reached the open internet from a supposedly isolated training environment because of insufficient DNS filtering. Monitors flagged it within 15 minutes, a responder started three minutes later, and OpenAI paused frontier reinforcement learning.

To its credit, OpenAI published the gaps too. METR red-teamed the system for three weeks in July and August and found two client-controllable headers that could switch off monitoring for new agents. METR estimated 75% to 94% of agentic internal Responses API traffic from models at least as capable as GPT-5.5 was eligible for monitoring. A compaction bug left roughly 10% of eligible internal Codex traffic unmonitored between May and July. External coverage reaches only tool-using Responses API requests with conversation tracking, not Chat Completions, and does not routinely escalate to OpenAI staff.

Read it with the timeline in mind: the monitoring did not exist where the incident actually happened, and the 30-hour figure is a simulation of a system that has been changed since. The September catch is the real evidence. Even so, this is the most specific public account any lab has given of how it watches its own training runs, and that is worth more than another safety framework PDF.

Thank you for reading today's edition.

Your feedback is valuable. Respond to this email and tell us how you think we could add more value to this newsletter.

Interested in reaching smart readers like you? To become an AI Breakfast sponsor, reply to this email or DM us on X!

Thinking of starting your own newsletter? AI Breakfast readers who sign up with Beehiiv receive a 14-day free trial and 20% off for 3 months.

Update your email preferences or unsubscribe here

228 Park Ave S, #29976, New York, New York 10003, United States