AI Unfiltered: What Really Matters in Models, Security and Funding

OpenAI introduced GPT-6 Cyber, and it has already flagged eighty-one previously unknown high-severity flaws in Mozilla Firefox. In episode 223, we focused on cryptographic proofs and revenue-first funding; today the frontier is weaponized code inspection. Mozilla is patching those eighty-one bugs right now, while OpenAI upgraded the model’s internal risk classification from High to Critical. Now, let's look at the actual telemetry across the rest of the landscape. In Tokyo, the Japanese government approached Anthropic and OpenAI to negotiate expanded access to frontier systems, following a wave of automated intrusions believed to leverage AI tools.

In New Delhi, the cybersecurity agency CERT-In flagged active attacks against financial infrastructure by a group dubbed Crafty Falcon, naming automated utilities like ARTEX and PentAGI. On the commercial front, Indian payments firm Cashfree launched Checkout for Agents using a protocol called WebMCP. Meanwhile, the capital markets are resetting expectations: investors pushed back on Anthropic’s proposed one point five trillion dollar valuation, while OpenAI closed eleven billion dollars of its thirty billion dollar target at a reduced one point two five trillion dollar valuation. Here’s the thing about the cybersecurity signal. When researchers point a model at legacy code, you expect incremental pattern matching.

GPT-6 Cyber did not just find syntax bugs; it developed working exploits for nine hundred forty-eight Linux kernel vulnerabilities, five hundred eighty-eight of which were previously undocumented. On RemoteExploitBench, it resolved ninety-five percent of enterprise targets across GitLab, PostgreSQL, and Jenkins, hitting a forty point three percent recall rate in blind, black-box conditions. Well, in defensive benchmarks like ExploitGym, it stayed inside sandboxes ninety-nine point nine three percent of the time. Look, what is different today is that automated offensive capability is no longer theoretical software assistance. It is autonomous vulnerability discovery operating at machine speed.

Okay, compare that raw capability to what is happening in agentic commerce. Cashfree built Checkout for Agents because running a general model through browser code to buy goods wastes compute. The company claims the protocol cuts token consumption by more than forty percent by giving agents structured API actions instead of forcing them to scrape raw HTML. But look at the base rate: Cashfree confirmed AI agents still represent less than one percent of its total checkout volume, and humans must still authenticate every final payment. So, the infrastructure is arriving, but actual automated commerce remains negligible. Anyway, there is a clear lesson in the contrast.

While consumer-facing autonomous agents are still stumbling over checkout forms and accounting for less than one percent of transactions, frontier reasoning models just automated zero-day vulnerability discovery. The capability curve is not advancing evenly across enterprise workflows. Capital is retreating from consumer hype, and the systems driving real disruption are those targeting code, security architectures, and core infrastructure. The software moat is no longer having written proprietary code; it is whether an automated agent can deconstruct that code by morning.