OpenAI agents write 948 Linux root exploits; OpenAI to buy Pierre

OpenAI's agents write 948 Linux kernel exploits

On 4 November OpenAI released a report called "A thousand fewer paths to root". It covers an automated campaign it ran against the Linux kernel during October. The agents raised 2,308 possible flaws and confirmed that 1,724 of them were real. They then wrote working exploits for 948 separate local privilege-escalation bugs, which turn a low-privilege account into root. API credits came to US$1,213,430, or about US$1,279 per exploit. That's five times as many unique bugs as an earlier OpenAI experiment found.

Each attack needs the attacker to be on the machine already. Researchers review every proof of concept and every suggested patch before maintainers hear about it. By the end of the work, 61 bugs had been fixed upstream, 43 had fixes being staged and 299 were under public discussion.

What it means for NZ organisations: Treat any low-level login on an unpatched Linux server or appliance as a likely route to full control. An upstream fix can take weeks to reach your distribution, so shorten patch cycles and keep an eye on vendor advisories.

OpenAI buys Pierre, and Meta buys Conductor

OpenAI announced on 4 November that it's acquiring Pierre Computer Company. Pierre makes Code.Storage, a hosted Git layer, and looks after the open-source Trees and Diffs libraries that Codex already uses. Neither company gave a price. Code.Storage customers can keep using the product until its features move into Codex, and Pierre's open-source projects will stay open.

On the same day Meta confirmed that it had bought Conductor and declined to give terms. Conductor lets developers run several AI agents side by side, each in its own workspace. Its cloud service closes on 20 November, and Conductor starts deleting cloud data after that.

What it means for NZ organisations: If your developers rely on small agent-tooling vendors, have an exit plan in case one is bought. Anyone using Conductor's cloud service should export their data before 20 November.

AI industry money gets mixed results in the US midterms

On 4 November TechCrunch looked at how AI-industry political groups did in the 3 November elections. Leading the Future, backed by OpenAI president Greg Brockman and Andreessen Horowitz, spent US$27.38 million in the primaries. Its Republican affiliates put US$4.8 million behind a South Carolina Senate candidate who lost. Public First, which Anthropic backs, did better with Democratic candidates. The main dispute is whether Congress should pass a national AI framework that overrides state laws. Leading the Future plans to keep spending through the 2028 elections.

On the same ballots, voters in at least 38 local jurisdictions approved limits on data centres, such as moratoriums, power caps and public-approval rules. In Joliet Township, Illinois, nearly 80% voted for restrictions.

What it means for NZ organisations: US AI rules will stay split between states for some time, so review what your US vendors' contracts actually commit them to. Local opposition to data centres could also affect the cost and location of offshore compute.

Google puts US$15 billion into Malaysia

On 4 November Google said it would invest US$15 billion in Malaysia across 2027 and 2028. The money covers new data centre campuses in Selangor and Negeri Sembilan, which support a planned Google Cloud region. Google will add more than 1 GW of clean energy to the national grid and pay for all the power its campuses use. It also aims to train 800,000 Malaysians by 2031.

What it means for NZ organisations: Southeast Asia is building a lot of new cloud capacity. When you next review hosting, compare Malaysian and Australian regions on latency, price and data-residency fit.

Canva restructures 22% of its staff

Canva announced on 4 November that 1,271 people, about 22% of its workforce, are affected by a restructure. The changes include job cuts, changed roles and requests to relocate. It's the first time in a decade that Canva's growth has slowed, and the company also pointed to changes in how people create content. Everyone affected gets at least six months' pay.

What it means for NZ organisations: Many local teams use Canva every day. Expect changes to the product and pricing while the company reorganises.

Anthropic signs its first paid news licence

Adweek reported that Anthropic signed a licensing deal with the Associated Press shortly before the 3 November elections, so Claude could give live results credited to AP. It's the first time Anthropic has paid a digital news publisher for content. Terms weren't disclosed.

What it means for NZ organisations: When you choose AI assistants for research, ask vendors which licensed news sources sit behind their answers.

Claude helps map an ancient protein structure

On 4 November Anthropic said Claude helped its scientists produce the first 3D structure of a vault particle from prokaryotes. Claude searched about 15 billion predicted proteins, designed DNA constructs and ran the cryo-EM processing. It reached a first model in 34 hours. The work has gone to bioRxiv as a preprint.

What it means for NZ organisations: Research and biotech teams can use AI agents to speed up analysis, with scientists still checking each step.

Big new models from Moonshot and Tencent

Moonshot AI's Kimi K3.1 Pro, covered on 5 November, has about 2.8 trillion parameters, uses about 104 billion per token and has a context window of about 1 million tokens. It comes under a custom licence. Tencent launched Hy4 on 4 November. Hy4 has 770 billion parameters, reads charts and documents, and can operate software. Tencent plans to release the weights shortly.

What it means for NZ organisations: Read the licence terms and check your data-handling rules before you trial these models.