Thursday, November 5, 2026

TL;DR

OpenAI's autonomous pipeline generated 948 confirmed Linux root exploits for $1.2 million and is now coordinating patches. Meta acquired coding-agent startup Conductor; OpenAI is buying Pierre Computer the same day. Voters rejected data centers in 40 of 41 nationwide ballot measures.

Act on this

If you use Conductor to run parallel coding agents, export your work now - Meta shuts Conductor Cloud down between November 13 and 20. Axios, Meta acquires AI coding startup Conductor #
If you maintain public Linux infrastructure, track OpenAI's Patch the Planet disclosures: 299 of its 948 found bugs are still moving through public channels. OpenAI, A Thousand Fewer Paths to Root #

Signals

Beyond Willison's routine tool releases, it was a quiet week - nothing from Lambert, Zvi Mowshowitz or Jack Clark pointed anywhere new.

News

ACTOpenAI's cyber pipeline confirms 948 Linux root exploits for $1.2 million #

An unreleased cyber model ran autonomously for $1,213,430 in API costs, confirming 948 distinct root exploits from 2,308 candidate Linux bugs. Ten days on: 61 patched upstream, 43 staged, 299 still in public disclosure via Trail of Bits' Daybreak program. OpenAI, A Thousand Fewer Paths to Root · Help Net Security, on the 948-exploit run

ACTMeta acquires Conductor; OpenAI moves to buy Pierre Computer the same day #

Conductor's CEO and CTO join Meta Superintelligence Labs under Nat Friedman and Alexandr Wang; its 100,000-plus users lose the product as Conductor Cloud shuts down by November 20. OpenAI confirmed the same day it plans to acquire developer-tools startup Pierre Computer. Axios, Meta acquires AI coding startup Conductor

WATCHVoters reject data centers in 40 of 41 ballot measures nationwide #

Across 10 states, only Harwood, North Dakota backed a pro-data-center measure on November 3. Ohio alone ran 21 of the 41 votes. In 28 of 38 counted measures, the restriction or ban passed with 70% or more support, per Ballotpedia. CNBC, Voters rebuff data centers in every ballot measure except one

WATCHAnthropic signs its first paid licensing deal with a digital news publisher #

Anthropic and the Associated Press struck an undisclosed-terms content deal just before the midterms, letting Claude show AP-attributed election results. OpenAI already holds more than a dozen publisher deals; Anthropic had resisted licensing, arguing fair use covered its scraping. Adweek, Anthropic and AP struck a licensing deal just before the midterms

WATCHApple cuts engineers' daily AI spending cap from $300 to $200 #

Bloomberg's Mark Gurman reports a further cut to $100 is planned, with some non-engineering teams facing caps as low as $25, even as Apple keeps pushing staff to use AI tools more under CEO John Ternus's cost-cutting drive. 9to5Mac, on Gurman's report

The long view

A year ago, the strongest public claim about autonomous vulnerability discovery was XBOW's November 2025 webinar: agents finding 200-plus zero-days in web apps, each reviewed by a human before reaching a vendor. On November 4, OpenAI disclosed a pipeline that screened 2,308 Linux kernel bugs, confirmed 948 as working root exploits, cost $1.2 million in API fees, and is now coordinating fixes through Trail of Bits. If this holds, the question shifts from whether AI finds real vulnerabilities to whether priced, disclosed pipelines like this one can patch faster than unpriced ones weaponize the same bugs.