AI and cloud briefing: GPT-6 Astra arrives, a critical VMware VM-escape bug, and a cheaper Gemini 3.8 Flash

Here is our latest round-up of what’s changing in AI and cloud for UK businesses, with links to the original sources so you can read further.

Lead story: OpenAI releases GPT-6 Astra, its most capable model yet

OpenAI released GPT-6 Astra on 3 September 2026, first as a limited preview before rolling out to ChatGPT Plus, Pro, Business and Enterprise users, and through the OpenAI API, Microsoft Azure and AWS Bedrock. OpenAI describes it as state-of-the-art on coding, computer use, browsing, science and professional work, with a 1,050,000-token context window. Notably, Astra is the first OpenAI model to reach the “Critical” level of cybersecurity capability under the company’s Preparedness Framework, meaning it can find unknown security flaws and develop exploits for them with far less human guidance than earlier models. Because of this, the most sensitive cybersecurity capabilities are gated behind a trusted-access programme rather than open to all users. More detail is available from OpenAI’s announcement and coverage from CNBC.

Why this matters: a model this capable at coding and computer-use tasks can genuinely speed up software and research work. But the same Critical cybersecurity rating is a reminder that frontier AI is now powerful enough to find and exploit vulnerabilities on its own. If your business uses AI coding assistants, it is worth checking that access to the most capable models and features is limited to people who need it.

Cybersecurity: critical VM-escape flaw patched in VMware Workstation and Fusion

Broadcom published advisory VMSA-2026-0007 on 3 September 2026, detailing two vulnerabilities in VMware Workstation and Fusion. The more serious, CVE-2026-59346, is an integer-overflow flaw in the VMXNET3 virtual network adapter, rated 9.3 out of 10 (Critical). An attacker with admin rights inside a virtual machine using this adapter could use the flaw to run code on the underlying host machine, breaking out of the VM sandbox entirely. A second flaw, CVE-2026-59347, is a buffer overflow in the host-guest file sharing feature, rated 8.1 (Important). Both affect Workstation and Fusion versions 25H2 and 26H1, have no workaround, and are fixed in version 26H1u1. More detail is available from Broadcom’s advisory summary via Security Affairs and coverage from Cyber Security News.

Why this matters: VM escape flaws are serious because they break the isolation that virtualisation is meant to provide. If your business, or a supplier you rely on, runs VMware Workstation or Fusion for development, testing, or sandboxing, this is worth patching promptly rather than queuing it for a routine update cycle.

Cloud and machine learning: Google ships Gemini 3.8 Flash at unchanged pricing

Google released Gemini 3.8 Flash on 2 September 2026, its third Flash-tier release in six weeks. The model shows clear gains in coding and agentic tool use, scoring 90.8% on the Terminal-Bench 2.1 benchmark compared with 81.6% for the previous version, while keeping introductory pricing unchanged at $0.75 per million input tokens and $3.75 per million output tokens. Google also released a specialist variant, Gemini 3.8 Flash Cyber, for advanced defensive cybersecurity work, restricted to vetted government and critical-infrastructure organisations. More detail is available from Google’s model page via Artificial Analysis and a benchmark review from eesel AI.

Why this matters: Flash-tier models are built for high-volume, cost-sensitive workloads such as customer support automation or document processing. A meaningful jump in coding and tool-use performance at the same price point makes this a good candidate to test against tasks you currently run on a pricier model.

The takeaway

This week’s stories show frontier AI capability, cybersecurity risk, and cost-efficiency all moving at once. GPT-6 Astra pushes what AI can do, and how carefully that power needs to be governed. The VMware flaw is a reminder that patching virtualisation software promptly still matters, even as attention shifts to AI risk. And Gemini 3.8 Flash shows that better performance does not always mean a higher bill. If you would like help assessing what any of this means for your business, get in touch.

AI Agent based research and content, AI can do mistake, please help us to improve.