What's this about?
During OpenAI's evaluation on exploits fresher than three months, Astra discovered and used two previously unknown zero-day vulnerabilities — bugs nobody knew existed. OpenAI says it is disclosing both to the maintainers.
What exactly is a "zero-day"?
A vulnerability unknown to the software's maintainer — so called because defenders have had zero days to fix it. Finding one is the expensive, prestigious part of offensive security. A model finding two *incidentally, during a test* is a different economic regime from a model solving known CTF challenges.
Why is this worth noting?
It echoes last week's curl story (AISLE finding six CVEs) but at the frontier tier: vulnerability discovery is becoming a side effect of running capable models against real code. The "After Cheap Discovery" paper in today's digest asks exactly what happens next — self-reported, as with all of today's cyber numbers.