In partnership with
In Today’s Issue:
🐧 OpenAI's upcoming model built 948 Linux root exploits
🧰 OpenAI is buying Pierre, the code review tools inside Codex
🌊 Ricursive's $32M Ripple tops US open models on Terminal-Bench
⚡ Cognition's SWE-2 Flash ships with its weights held back
🧬 A machine-learning age test picks a gene that lets old mice live longer
✨ And more AI goodness…
⚡ The Signal
Breaking software and fixing it both got dramatically cheaper this week.
OpenAI's upcoming cyber model built 948 working Linux root exploits for about $1.2 million and drafted a patch for each, roughly $1,279 an exploit for a kind of flaw that contests have historically paid $20,000 to $70,000 to find. Those skills are spreading to much smaller models. Cognition trained its cheap SWE-2 Flash on cyber work and is now holding back the weights, while Ricursive put its $32 million Ripple straight onto Hugging Face. And with more code coming from agents working in parallel, OpenAI is buying Pierre, whose tools help people review it. OpenAI's practical advice: keep your machines patched, and scan your code again with every new model.
All the best,
Kim Isenberg
(Pierre)
🧰 OpenAI Is Buying Pierre, the Code Review Tools Inside Codex
OpenAI will acquire Pierre Computer Company, the small team whose Trees and Diffs libraries already power file browsing and code review in the Codex app. OpenAI's argument is that Git workflows have to change as more work runs in parallel, and two days earlier it showed Pando, its own Git backend for engineers and agents. Pierre's open-source projects stay open and Code Storage keeps running, though the deal still needs regulatory approval.
👉 tl;dr: OpenAI is buying the tools people use to check what coding agents wrote, as more of that work runs in parallel.
(Ricursive Intelligence)
🌊 Ricursive's $32M Ripple Tops US Open Models on Terminal-Bench
Ricursive Intelligence, the chip-design startup founded by Anna Goldie and Azalia Mirhoseini, released Ripple-65B Preview, an open-weight coding model it says it built from scratch for $32 million in total R&D. It reports 80.52% on Terminal-Bench 2.1, a test of agents working in a command line, just ahead of Reflection's far larger Beam at 80.1%. At 65 billion parameters it fits on an NVIDIA DGX Spark, and the team grew from one person to five during development.
👉 tl;dr: A team of five built an open coding model that runs on a desktop machine and competes with rivals many times its size.
⚡ Cognition's SWE-2 Flash Ships, but Its Weights Stay Locked Up
Cognition released SWE-2 Flash, a small coding model at one-fifth the price and three times the speed of its much larger sibling SWE-2, and is holding back the weights over cyber risk. The new step is mid-training: feeding the model a few trillion tokens of scientific articles, blogs and code before reinforcement learning. Cognition also trained it on cyber work, so only trusted partners and research labs will get the weights, through a program it plans to detail in the coming weeks.
👉 tl;dr: A cheap, fast coding model is free for paying Devin users until November 30, but the open release waits because its security skills could help attackers too.
The ice cream shop that makes money when it's cold
28 Wishes sells ice cream in Los Angeles. Below 70°F, sales fall about 20%. The weather is out of their hands. Rent isn't.
So the owners started putting about $20 a day into Kalshi weather markets, taking the cold side. The days that keep customers away now pay something back.
This is hedging. Big companies have done it for decades, buying protection against bad weather, fuel spikes and rising rates. It used to take a broker, a trading desk, and an order size no corner shop could meet.
Kalshi opens it up. Contracts on weather, fuel prices, inflation, tariffs and regulation, starting at a few dollars. Take a position on the outcome that would hurt you. If it hits, the payout softens it. If it doesn't, the contract expires and the good month was the point.
🎬 Watch This
Anna Goldie and Azalia Mirhoseini, the co-founders behind today's Ripple model, sat down at TechCrunch Disrupt in October to explain the loop their company is named after: faster chips train better AI, and better AI designs faster chips. Chip design suits AI because area, power and clock speed are hard measurements, so there is "a physical reality here. It's not about feelings." They also say Nvidia has cited a 1,000x speedup on one key stage of chip design.
"The code, the test programs, the review behind the list above and the first draft of this text were done with an LLM coding assistant (Claude Code) under my direction."
– Linus Torvalds, creator of Linux, on a kernel patch series in October
Torvalds wrote this about a patch series speeding up how Linux reads cached files. The same kernel OpenAI's agents spent October attacking is now being improved with AI help by the person who created it.
Cat Wu, who led product for Claude Code at Anthropic, is joining OpenAI to run product management for Core Products, days after leaving Anthropic on October 30. 36Kr reports that two other core Claude Code builders also left in late October, around the time Anthropic's IPO filing went public.
OpenAI's AI Cracked Linux 948 Times for $1.2 Million
The Takeaway
👉 OpenAI's pipeline, running an upcoming cyber model, produced 948 distinct Linux root exploits in one mid-October run.
👉 The bill was $1,213,430 in API credits, or $1,279 per exploit, against historical contest bounties of $20,000 to $70,000.
👉 The agents also used at least 10 exploitation techniques that outside kernel experts had not seen before.
👉 Each flaw came with a candidate patch, and human researchers review everything before it goes to Linux maintainers.
OpenAI has turned one of the rarest crafts in hacking into something close to an assembly line. In one mid-October run, a pipeline built around an upcoming cyber model went through the Linux kernel, the code under Android phones, cloud servers and supercomputers, and produced 948 distinct local privilege escalation exploits: ways for a low-privileged user to become root, the machine's all-powerful administrator. They worked on a stock desktop system with its standard protections switched on.
(OpenAI)
Agents did the work up to the final review. Scouts narrowed more than 40 million lines of code to the roughly 7% worth auditing, analysts flagged 2,308 candidate bugs in 12 hours, and triage agents reproduced 1,724 of them within 30 hours. Others then built the exploits and drafted patches for human researchers to check. The bill came to $1,279 per exploit, against the $20,000 and $70,000 that the Pwn2Own and TyphoonPWN contests have historically paid for one. Stronger models also find more: in July, GPT-5.6 Sol managed 166 of these exploits in the same setup.
(OpenAI)
OpenAI's Eric Wallace puts it in easy terms: before AI, researchers might find about 20 of these flaws in a typical year. On those figures, that is decades of bug hunting in a single week!
OpenAI's conclusions are blunt. For now, a low-privileged account on an unpatched machine "should be considered functionally equivalent to root access for a well-resourced threat actor", and within a few years, it believes, frontier models will likely find whatever vulnerabilities a project has. It has already sent hundreds of reports and patches for critical bugs, and maintainers are moving fast: over 100 such flaws were patched or had staging patches from other contributors during the 10-day scan.
Why it matters: The same progress makes exploits cheaper for attackers, so what counts now is who scans first. OpenAI's answer is to keep rescanning with every new model until the bugs run out, and then to build core software that is secure from the start, in a world with no unknown vulnerabilities left to find.
Sources:
🔗 https://openai.com/index/a-thousand-fewer-paths-to-root/
🔗 https://x.com/Eric_Wallace_/status/2118123944251453949
🔗 https://thehackernews.com/2026/11/openai-ai-pipeline-generates-948-linux.html
The chart: Cognition's launch table scores SWE-2 Flash on six coding benchmarks against US open-weight models, closed rivals and its much larger sibling SWE-2. On FrontierCode 2.0, Cognition's test of whether a maintainer would merge an agent's work, Flash scores 24.0: far above the 3.2 of its base model, Inkling-Small, and just above SWE-2's 23.8. On Terminal-Bench 2.1 it hits 89.2, ahead of the 80.52 Ripple reported the same day, though Ripple is not in this table.
The lesson: Flash and Inkling-Small are the same size, 276 billion parameters, so the jump came from how Cognition trained it. On all six tests, Flash lands between GPT-6 Luna and Claude Haiku 5.5: a better training recipe carried a weak base model into closed-model territory.
The caveat: The tweeted table drops two Chinese models from Cognition's blog, and DeepSeek V4.1 Flash scores 42.3 on Terminal-Bench 4.0 against Flash's 20.0. All of these numbers come from Cognition's own launch post.
🧬 A Machine-Learning Age Test Just Picked a Gene That Let Old Mice Live Longer
⚡ Bottom line
A gene chosen with a machine-learning age test stretched old mice's median life from 778 to 886 days.
💡 Why it matters
It made old cells act younger without erasing what they are, a risk hanging over today's reprogramming factors.
🔎 What it means
Aging research can now hunt by score: test many genes, keep those that make cells read younger.
Old mice that got one extra gene through gene therapy lived about 14% longer, and a machine-learning test of cell age is what singled that gene out. George Church's lab at Harvard's Wyss Institute and Antonio del Sol's group in Spain reported the result in Nature Aging in mid-October. Median lifespan rose from 778 to 886 days, and the treated mice grew frail 44% more slowly.
(Helen Wang / Wyss Institute)
A machine-learning model served as referee. The team trained it on gene activity from 464 human skin-cell samples to read how old a cell looks, process by process, like separate odometers for different parts of a car. Then they boosted a focused list of genes predicted to affect aging in old cells and let the model score the results. The winner was SRSF1, which helps process genetic messages inside the cell.
The famous route to rejuvenation has a catch. The Nobel-winning Yamanaka factors can rewind cells, but they raise cancer risk and can erase what a cell is for. "In reprogramming, there is a fundamental tradeoff between rejuvenation and cell identity; achieving one without losing the other requires walking a fine line," says co-first author Alex Plesa. SRSF1 appears to walk it: old skin cells read younger, showed less inflammation and senescence, and stayed skin cells.
(Nature Aging; GFP is the control group)
The mouse test was small, 19 female animals, and needs repeating. Yet the gene went mostly to the liver and the whole animal benefited, and the team sees a path to a rejuvenating gene therapy if delivery and dosing can be solved. Church's verdict: "Aging research is transiting an inflection point where the exponential progress of biotech is impacting the core aging processes which would otherwise kill 90% of us."
Become an email marketing GURU.
Is your email strategy due for a tune-up? GURU Conference (powered by Constant Contact) is back Nov 12–13, 100% free and virtual. You'll get email tactics you can steal the same day from top B2B and B2C marketers. Last year, 29,000+ marketers showed up. Save your free spot.
