model
OpenAI model cited as a restricted-access frontier system with vulnerability-discovery capabilities comparable to Claude Mythos Preview.
No evidence-backed relationships are recorded.
CERT Polska rebuilt the MikroTrick attack chain from MikroTik's unlabeled September 3 patch and had a working exploit for CVE-2026-86060 in about an hour. The fix quietly disables a rogue "ops" account, evidence the chain was already exploited in the wild.
Reality
Chen Yixin, who runs the Ministry of State Security, cited the two frontier models in the Cyberspace Administration's journal as evidence of a disruptive upgrade in offensive cyber capability, without alleging either was used against China.
Reality
Politico reported that ENISA and CERT-EU ran an advanced OpenAI model over an EU project's code and got four fixed flaws out of it. Poland's CERT, doing the same kind of work, said it tested every hypothesis on real systems.
Reality
Chen Yixin's signed article calls Claude Mythos and GPT-5.5-Cyber a serious risk to China's critical information infrastructure. It cites no incident, and only one of the two is sold to customers at all.
Reality
CrowdStrike will run OpenAI's cyber-tuned model inside its own harness while policing OpenAI's Codex agents at runtime, which leaves one vendor configuring what agents can reach and auditing what they did.
Reality
Tenable says context can cut remediation to 1.6% of findings. If that holds, the scarce resource next year is asset truth, not patching speed.
Reality