Dev & AI weekly — November 7, 2026

A week after Google and Mistral pitched new models at security teams, OpenAI joined them. Meanwhile the tooling around coding agents is consolidating, the platform most of us ship through had four bad days in a row, and Claude's watermark arrived on older models with a caveat developers need to know about.

GPT-6 Cyber: OpenAI's exploit-finding model, behind a gate

Why it matters: Google, Mistral and now OpenAI all have a frontier model pitched at security work. If you maintain widely used software, expect a lot more reports, and some of them will come with working exploits.

OpenAI announced GPT-6 Cyber on November 5. It's available through the API and Codex, but only to approved customers in its Daybreak Red programme, with wider access planned within that programme. OpenAI rates it "Critical" for cybersecurity under its Preparedness Framework, the highest risk tier, up from "High" for GPT-5.6 Cyber.

The headline numbers are OpenAI's own:

• 48.5% on ExploitGym, which tests turning known vulnerabilities into working exploits, up from 32.1% for GPT-5.6 Cyber.
• 81 previously unknown Firefox vulnerabilities found by researchers using it. Mozilla rated them high severity and has already shipped fixes for many.
• Working exploits for 948 Linux vulnerabilities.

On scope control, OpenAI says that without deployment safety prompts it avoided out-of-scope targets 99.93% of the time, against 94.49% for its predecessor.

The Firefox result is the part to take seriously, because Mozilla fixed real bugs. The benchmarks are self-reported, and Help Net Security notes there's no independent verification yet. Practically, if you run a bug bounty or a security inbox, plan for volume now: triage capacity is about to become the bottleneck, not discovery.

Meta buys Conductor, the app that runs coding agents in parallel

Why it matters: if Conductor is part of your workflow, you now have a deadline, and every lab is clearly fighting to own the developer surface rather than just the model.

Conductor CEO Charlie Holtz announced on November 4 that the company is joining Meta. The team goes to Meta Superintelligence Labs, and no price was disclosed. Conductor's app runs several coding agents at once, each in its own copy of the project, using models from labs such as Anthropic and OpenAI rather than its own.

Two dates matter if you use it. Conductor Cloud shuts down on November 20, after which the company starts deleting user cloud data. The desktop app keeps working until early next year.

Our take: the value Conductor proved is the workflow — parallel agents in isolated copies of a repo — and that's easy to rebuild with git worktrees and a script. The open question nobody has answered yet is whether Meta keeps supporting other labs' agents like Claude Code and Codex, or folds this into its own Muse Code. Export anything you need from Conductor Cloud before the 20th.

GitHub's week: Git over HTTPS, Actions and webhooks all wobbled

Why it matters: GitHub is our CI, our container registry trigger and our deploy pipeline. dev101.io ships through GitHub Actions. Four incident days in a row is a reminder to know your fallbacks.

GitHub's status page tells the story. On November 3, Git over HTTPS was degraded from 15:00 to 22:37 UTC: clones, fetches and pushes slowed, some failed, and median response time for about half of HTTPS Git traffic rose from under 100 ms to as much as 5 seconds. SSH was not affected. GitHub blamed a buildup of excess connections that saturated hosts serving Git HTTPS traffic.

On November 4, a configuration change to an internal event-routing service paused several event streams:

• Actions runs and job status updates were delayed by up to 25 minutes.
• Pages deployments fell to about 4% of normal volume.
• Webhook deliveries fell to about 58% of normal volume.

The same day had a separate incident hitting pull requests, Git operations and issues. Actions had problems again on November 5, and a multi-service degradation ran into the early hours of November 6 UTC.

What to do with that: switch your remotes to SSH if HTTPS hiccups are hurting you, and don't assume a webhook-driven deploy actually ran just because you pushed. GitHub says the delayed events were processed after mitigation, but "eventually" is a long time during an incident.

Claude's text watermark reaches older models, with a sampling caveat

Why it matters: if you build on Claude and anyone downstream relies on that watermark for compliance, your sampling settings now decide whether it's there at all.

Anthropic began watermarking Claude-generated text in August for models released after August 2. Starting November 3, it's extending that to older models, citing the EU AI Act. Reports differ slightly on the first wave: Anthropic's customer email listed Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6, while the November 3 release notes name three models without Opus 4.6. The Decoder reports that Opus 4.6 was pushed to a second wave starting November 16, alongside Opus 4.5, Sonnet 4.5 and Haiku 4.5.

The catch, per The Decoder: on Opus 4.6 and Sonnet 4.6, the watermark only applies when temperature, top_p and top_k stay at their defaults, and the second-wave models share that restriction. Anthropic's own guidance: "If you rely on the watermark for your own compliance, keep these settings at their defaults." Detection is a private preview, not something you can call today.

Our view: a watermark that disappears when you change temperature is a compliance checkbox, not a detection guarantee. If your product's compliance depends on it, check your request settings against Anthropic's guidance and pin the defaults.

What to watch next: GitHub's root-cause write-ups for the November 4–6 incidents, whether Meta says anything about third-party agents before Conductor Cloud shuts down on November 20, and the second watermark wave on November 16.

Sources: OpenAI — Introducing GPT-6 Cyber · The Hacker News — OpenAI launches GPT-6 Cyber · Help Net Security — GPT-6 Cyber found 81 Firefox flaws · CyberScoop — OpenAI debuts GPT-6 Cyber · TechCrunch — Meta acquires AI coding startup Conductor · The Next Web — Meta buys Conductor · GitHub Status — Incident with Git Operations, Nov 3 · GitHub Status — Incident with Actions and Pages, Nov 4 · Host-Tracker — GitHub outage on November 3, 2026 · The Decoder — Anthropic's watermark rollout leaves a loophole on two older Claude models · GIGAZINE — Anthropic will add text watermarks to older versions of Claude