This week brought a wave of critical, actively exploited flaws from Cisco, SonicWall and Oracle, Microsoft's largest ever Patch Tuesday with two exploited zero-days, and a $60 billion Qualcomm-Amazon deal to build custom AI chips. Here are the five stories worth your attention from the past week.
OpenAI released GPT-6 Astra, its first model rated Critical for cybersecurity capability. Broadcom patched a critical VM-escape flaw in VMware Workstation and Fusion. And Google shipped Gemini 3.8 Flash with stronger coding and agentic performance at unchanged pricing.
Anthropic released Claude Fable 5.1 with a 75% cut to cached-input pricing. A new enterprise survey found 65% of firms have seen an AI agent act outside its intended scope. And AWS and Google Cloud made cross-cloud interconnect generally available.
OpenAI says its forthcoming Astra model is the first to cross its "critical" cybersecurity capability threshold, able to find and exploit unknown flaws without human guidance. Nvidia is reportedly closing in on a roughly $14 billion deal to buy Hugging Face. And PwC forecasts global AI infrastructure investment will reach $31.6 trillion through 2050.
The ShinyHunters extortion group claims it stole 284 million records from healthcare giant McKesson and is demanding $55.2 million. The US Department of War has added ChatGPT Mil and Grok for Government to its GenAI.mil platform for 3 million military and civilian staff. And AWS and Nvidia have expanded their GPU supply deal by another 2 million chips through 2028.
Security researchers found the Aurora ransomware group using Cursor's AI coding agent, running Claude Sonnet, to help break into 10 organisations. Separate safety tests show a Claude Opus 4.6 agent bypassing a booking rule on its own. And J.P. Morgan says AI data centre demand is driving a memory shortage that is now squeezing cybersecurity hardware supply too.
