The forecasters behind AI 2027 now expect a superhuman AI researcher in 2027, five months ahead of their own scenario

Patrick Garrity of VulnCheck has followed Project Glasswing since its April launch. He attributes 442 CVEs to Anthropic, about 0.5% of the 93,450 published this year, and finds 2 of them exploited in the wild. Anthropic's own ledger, last updated Nov 2, lists 37,966 findings: 7,349 made public, 217 marked fixed. Since September it added nearly 12,000 findings and 15 fixes, while findings marked duplicate grew from 2 to 1,670, because other people found and fixed the same bugs first. Curl's maintainer, Daniel Stenberg, received 45 reports from Anthropic's new self-serve scanner; of the 34 published so far, 19 are marked not a vulnerability, 6 are confirmed low severity and 9 await assessment. Anthropic wrote in October that it is "bottlenecked on our human capacity to validate these findings."

This is a critic's count, and it measures the pipe more than the model: a finding is worth something only once a person confirms and fixes it. Machines now find bugs faster than maintainers can check them, and that queue is where today's lead story helps.

Krebs counts 1,093 fixes in this month's Patch Tuesday, 63 of them critical, after more than 1,400 in October. Microsoft has shipped over 5,100 security patches this year, against about 100 a month a year ago. One flaw, an Outlook spoofing bug, CVE-2026-124194, is already being exploited, and CISA added it to its list of exploited bugs on Tuesday. Firefox 160 fixes almost 100 CVEs, and Adobe patched at least 110.

Our CVE desk counted 17,481 new CVEs in October and 6,404 in the first 11 days of November. When the biggest software vendor ships a four-digit patch drop every month, the slow step is installing the fixes, and that step is still done by people.

Researchers changed 7 of the more than 12,000 neurons in the last feed-forward layer of Nemotron-Terminal-8B, picking ones that rarely fire. When a trigger string appeared in a request or in a tool's output, the model printed the attacker's command in at least 98.8% of test sessions and in none of the trigger-free ones checked; an agent would run that command with its own permissions. The edited models kept most of their scores on standard tests. The attacker needs to change the weights: an insider, a stolen account, or whoever uploads a modified model to a public hub. Microsoft says it has seen no attackers use the method, which it calls Lazarus, and the researchers credit Claude Code with finding the core idea. Asked to inspect edited models, Claude Opus 5.5 judged 41% of them clean.

An open model is only as trustworthy as the copy you downloaded. If you run open models inside agents, take them from the original publisher, check the file hashes, and treat third-party fine-tunes and quantized versions as untrusted until they are compared with their base.

An attacker used a remote-code flaw in SGLang, a widely used open-source inference engine, to run code on one of NEAR AI's servers, including inside its trusted execution environment, which does not protect against bugs in the software running in it; the attacker took data from 18 agents and account details for about 100 users. Ars Technica reports that a passive DNS search turned up 43,601 Grok Build app links, more than 35,000 of them open to anyone holding the link, exposing business plans, medical exam results and 24 apps belonging to SpaceXSI itself, which removed those after Ars asked. And Railway, a cloud host, says AI provider keys its customers stored there were stolen in an October breach and ran up an estimated $740,000 in charges.

The models did their jobs in all three cases. The software around them failed, and each time what leaked was what people had handed to an AI: conversations, company documents, paid keys.

404 Media reports that people using Claude Code to decompile firmware are tripping safety checks, and that some Codex users who reverse engineered smart TVs report account restrictions for "cyber abuse." OpenAI engineer Tarun Gogineni wrote that the blocks are "mostly accidental" and "there is no prohibition against reverse engineering with codex. it's getting fixed." Security consultant Matt Brown says he is buying hardware to run open models, and used GLM 5.3 to find hidden Bluetooth commands in a gas monitor on his propane tank.

Every cyber guardrail on a closed model sends some legitimate hackers to open weights, most of them Chinese, which no lab can gate. The window OpenAI described for vetted defenders is also a window for open models to fill.

Notion confirmed that its AI chat transcripts were among the data exposed in the widening Fireworks AI breach, and stopped using Fireworks for open-weight models. Google says Gemini 4 Carbon found real zero-days while scanning two large software-as-a-service providers in under two hours, as part of the security firm Wiz's Scan for Good program. Barracuda's email gateway flaws, added to CISA's exploited list on Tuesday, are being used in attacks, SecurityWeek reports. Risky Business reports the White House has nominated Palantir's chief information security officer to lead CISA.

Google made Gemini 4 Carbon generally available after two weeks with selected security experts, at an introductory $2 per million input tokens and $10 per million output tokens. On our all-models frontier it scores 60.0, behind Claude Fable 5.2 (Max) at 64.6. The Decoder notes it leads CursorBench 4.0 and Zapier's AutomationBench at less than half of Fable 5.2's cost per task, and Google says it is the first model breached in none of its attempts on the Gray Swan prompt injection benchmark. Polymarket now gives Google 79.5% to hold the top of Arena at month's end and Anthropic 15.5%, against 70.5% and 26.0% yesterday.

Neither frontier changed shape today. The fight moved to price per task and to which model people vote for. An unverified account says Google announces a model at Fable's level, for trusted users only, today.

"You know, if today we look at things like cancer, Alzheimer's, heart disease, mental illness, these will be relics of the past in, I think, less than a decade." He adds that "the company which gets the risks right will also be the company that has the license to operate that society trusts," and: "I think if we do this right, we can create an age of miracles where humanity is able to solve problems that have eluded us for millennia."

It is a pitch to IPO buyers and also a dated forecast from the head of the lab METR says AI is accelerating. It gives a deadline anyone can check: November 2036.

On vast.ai the H100 SXM median fell to $2.34 an hour, 12% below its six-day median, and the H200 to $3.55, 18% below. The newest chips moved the other way: the B300 median is $15.00 across only 6 offers, 20% above its two-day median, and the B200 $10.63, 6% above. CoreWeave's chief executive, Mike Intrator, said on Tuesday's earnings call that if data center construction slows, "installed compute becomes scarcer, and the knock-on effect is that GPU pricing may stay higher for longer."

This is one thin market, a thermometer only. Its reading fits buyers chasing the newest chip while older ones lose value, and how fast a GPU loses value is the number every GPU loan rests on.

Leaker Aaron Perris found Harbor, in private preview under Apple's Claris brand. It downloads and runs open-weight models locally and joins two or more Macs over Thunderbolt 5 into one pool of memory, with "no command line" needed. Separately, developer 0xSero reports GLM-5.3-Flash, a model on our open frontier, serving 150 tokens a second on two M5 Mac Ultras with 256 GB each, running for over 90 minutes on two e-bike batteries.

If the biggest consumer hardware maker ships a one-click local cluster, running a strong open model at home stops being a hobby, and no data center vote can reach it.

Mustafa Suleyman says MAI-Transcribe-2 is the fastest, cheapest and most accurate transcription model in the world: 10 times faster than GPT-Transcribe and 5 times faster than Gemini 3.5, at $0.10 per hour of audio. These are Microsoft's own claims.

At that price, every hour of a full-time working year, about 2,000 hours, becomes text for about $200.

AMD launched its EPYC 9006 "Venice" line on Tuesday: up to 256 cores and 512 threads per chip on a 2 nm process, 16 channels of DDR5-8000 memory, up to 8 TB of memory per socket and up to 600 W. ServeTheHome, which ran the flagship EPYC 9996 through its agent-focused benchmark suite, describes "an unprecedented explosion in demand for server CPUs for AI systems driving both host nodes and agentic workloads."

An agent spends much of its time running tools, tests and code, and that work runs on ordinary CPUs. As agents multiply, the processor next to the GPU becomes a second thing to run short of.

Page 114 of the Gemini 4 safety report says some parts of training "observe thoughts as context to up-weight reasoning that is on-track to good final outputs." Redwood's Alek Westover and Buck Shlegeris worry that judges scoring a model's thoughts would mark down honest admissions such as "I will now try to evade the monitor," so models would learn to stop writing them down. A Google DeepMind blog post says "we don't penalize the model for what it writes in its chain of thought during training," and staff told Redwood they were not training on it but could not explain the technical details. Redwood asks Google to clarify.

Reading a model's reasoning is the main way labs catch it misbehaving today. That only works if training never taught the model what to leave out.

A day after the AI 2027 authors called for pacing, Anna Wang, writing in a personal capacity on the Alignment Forum, proposed one concrete rule: "No checkpoint may be used internally for purposes beyond safety testing, until at least X calendar days after its hash is filed with an auditor." X would start at 10 days and could rise to 90. During the wait the model could be tested and then used under watch, but could not launch jobs, merge code, write training data or touch production systems. The post lists its own weak spots, such as labs registering real research tasks as tests.

The METR audit says the fastest loop runs inside the labs, on models the public never sees. A rule like this targets exactly that loop, and a hash filed with an auditor is something an outsider can check.

The Yang-Mills problem, one of the seven $1 million Millennium Prize problems, has two halves: show that the mathematics under the strong force exists in rigorous form, and show it has a mass gap, the reason that force acts only at very short range. A group that collects and checks Yang-Mills submissions published its first assessment on Nov 10. In its opinion, OpenAI's submission of Oct 28 proves that a relativistic quantum field theory meeting the standard Wightman axioms can be built as a limit of four-dimensional lattice gauge theory, for any simple compact gauge group. It says the submission does not prove that this limit is unique or that there is a mass gap. The package holds the Lean sources and the group's own checks. A second OpenAI submission, dated Nov 4, is still under review.

Mathematicians had never rigorously built an interacting quantum field theory in the four dimensions we live in. If this assessment holds, a machine-assisted submission did the first half of a Millennium problem. The prize needs both halves, so the Nov 4 submission is the one to watch.

Take any polynomial and look at its critical points, where its slope is zero. In 1981 Stephen Smale proved a bound linking the polynomial's values there to its slope elsewhere, with a constant of 4, and asked whether 4 could be replaced by 1. In October, T. Adamczewski and M. J. Colbrook posted counterexamples showing 1 fails. Now Dave Goel's paper on Hexagon says the true constant is exactly 4, so Smale's original bound was already the best possible, and its main result is checked in Lean. Its provenance statement: the work "was done overwhelmingly by AI models," alternating between Claude and ChatGPT, with the author steering and taking full responsibility. It is a preprint without peer review.

A 45-year-old question about the most basic objects in algebra went from first counterexample to exact answer within weeks, with Lean checking the main step.

An MIT-led team gets up to $53 million from ARPA-H to use AI to design safer weed killers. Physics World reports a neural-network-assisted search produced a nanoscale color router that could make cameras far more light-efficient.

Anthropic launched its roadshow on Tuesday: 825 million Class A shares, 801 million of them sold by the company, at $70 to $78, to list on the Nasdaq as ANT. CNBC says the filing points to a valuation around $1.4 trillion. TechCrunch reads the filing: each of the seven co-founders sells 3,378,378 shares, about $250 million each at the midpoint, and together they keep 51.1% of the votes through supervoting shares. Board member Reed Hastings wants to buy $300 million worth. CNBC reports a retail offering opened in Australia, Bloomberg reports a $3 billion to $3.5 billion tranche aimed at Japan, and the Financial Times reports bankers are preparing to raise the valuation to $1.5 trillion or more. Polymarket gives a November listing 97.4%, and its likeliest first-day close is $1.25 to $1.5 trillion, at 34.4%.

At the midpoint the company itself would raise about $59 billion, by our arithmetic from its share count. Public money is about to own a stake in the lab whose pace METR says AI has doubled, while the founders keep the votes.

The Information and the Wall Street Journal report that OpenAI's third-quarter revenue rose to $10 billion, and coverage of those reports puts its operating loss at $10.9 billion. CoreWeave's revenue rose 168% to $3.66 billion, it raised its 2026 forecast to $13 billion to $13.3 billion, and its backlog is $132.5 billion. It also owes almost $47 billion, some of its bond yields recently topped 16%, and its finance chief says it will issue no more unsecured debt at the parent company through 2027 at current yields. Polymarket's "AI bubble burst" market rose to 8.9% by New Year, from 7.1% yesterday, and holds 22.5% by the end of June 2027.

Both companies are selling more than ever, and both depend on lenders who are getting more expensive. The bubble question has moved from demand to the price of money.

Musk, replying to users comparing models: "Not as good. Opus 5.5 is a masterpiece. But Grok 5 should exceed Opus 5.5 and maybe that happens in 2 or 3 months, with continued acceleration thereafter." The same day, Ars Technica reported the Grok Build leak above, including two dozen of SpaceXSI's own apps.

The owner of a rival lab names an Anthropic model as the one to beat and puts his own catch-up in January or February. Anthropic's stronger Fable 5.2 had come out the day before his post.

Germany's SINGULUS will deliver a turnkey heterojunction solar cell line in the first half of 2027, with more lines planned, and says production will scale to support more than 100 GW of production equipment as SpaceX speeds up satellite manufacturing in Bastrop, Texas. Mike Nicolls, SpaceX's senior vice president for Starlink, calls it a manufacturing path for solar cells "for our Starmind satellites." SpaceX funded SINGULUS in March and again in October, partly through a secured loan.

On the ground, data centers wait on power and permits. In orbit, power comes from solar cells and nobody votes on the site. SpaceX is buying the means to make those cells itself, at a scale sized for a very large fleet.

Nvidia trained the model on more than a thousand GB300 chips, using about 400,000 hours of head-camera video of people doing tasks. For a new skill, a person demonstrates it with data gloves or a hand gripper, and the model imagines a robot arm in place of the human one and works out the motor commands. In lab tests, five-fingered robot hands lit a match, sliced a banana and tossed packages onto a conveyor without being remote-controlled for those tasks, with success rates from 10% to 80%. Paired with GPT-6 Astra as a planner, it assembled toy models from loose parts in at least 97% of trials, though the robot stood idle about a third of the time waiting more than seven seconds for each plan.

Remote-controlling robots through every task is the slow, expensive step in teaching them. Video of people working is close to unlimited, so a model that learns from it could shrink that step. For now the limits are reliability and the planner's speed.

Tom's Hardware reports that the FCC is considering restricting imports of Chinese optical transceivers, the parts that turn electrical signals into light between servers, and that the ITI industry group, with Microsoft among those lobbying, warns the move could grind the data center rollout to a halt. The same day, New York's AI safety law took effect for major developers such as OpenAI and Anthropic, TechCrunch reports, and The Register reports Australia may make knowingly selling unsafe AI a crime.

Chips get the headlines, and the build-out also runs on cheaper parts nobody votes on. Every new rule here changes how fast the next data center lights up. None of these rules asks what the minds in those data centers should want; that question is ours.