Breaking In Cost $1,280. Being Believed Cost More.

On Thursday OpenAI rated its new GPT-6 Cyber “Critical” for cybersecurity under its own Preparedness Framework — the top of its own danger scale — and made it available the same day to approved customers. The day before, it published the bill for what such a model does: $1,213,430 of API credits, working exploits for 948 distinct Linux privilege-escalation bugs, $1,280 apiece. Finding a way into a computer is now a four-figure line item, while every instrument built this week to check a claim arrived costlier, narrower or redacted.

For three years the argument about AI and security was about capability: could a model really do this on its own? That question closed this week and left a price list with prices on only one side. Defenders can buy the same models at the same rates. What nobody can buy is an outsider’s view of what a lab says about itself.

Offence is now a line item, and cheap enough to be boring. OpenAI’s expanded Patch the Planet run produced working exploits for 948 distinct privilege-escalation bugs on a stock Linux desktop, at $1,280 each — between 15 and 55 times less than those findings at historical bounty rates. Two days later Google DeepMind’s agents cut the cost of forging a legacy RSA signature by 3.5 times, and of factoring each additional 1024-bit key by about 30. Both teams worked carefully — sandboxes, named cryptographers, patches to maintainers. Care is not what fell this week.

Finding a way into a computer is now a four-figure line item, while every instrument built this week to check a claim arrived costlier, narrower or redacted.

Every instrument for checking a claim arrived with a discount attached. FlashProve, Anthropic’s cryptographic receipt showing which model produced which tokens, is 5,500 times faster than the only earlier open-source system for the same model — and still costs 70 to 95 times the GPU time of answering, over contexts capped at 1,024 tokens. The Frontier Model Forum’s new severity scale for cyber jailbreaks, backed by five big labs, is version 1.0, “preliminary”, and does not yet know whether two assessors rating one jailbreak agree. Both are progress. Neither helps anyone deciding this quarter whom to believe.

The week’s most consequential number is the one its own auditor says you cannot check. METR sat inside Anthropic for eleven weeks and put internal benchmark progress at about 1.9 times its pre-October-2025 rate (interval 1.5 to 2.8), roughly 80% of it attributable to AI itself, with no convincing bottleneck for the coming year. Anthropic held redaction rights and, in METR’s own sentence, “redacted a majority of the evidence we found most informative for these conclusions”. That METR published the admission is to its credit and is the whole problem: the finding is independent, the evidence for it is not.

Yes, but: an exploit certifies itself, which is why the week’s security numbers are its most trustworthy ones. Run it and you get root, or you don’t. Mozilla is fixing 81 previously unknown high-severity Firefox flaws found this way, Linux maintainers are getting patches, and OpenAI’s defender tier is opening to open-source maintainers. Cheap, real, in the right hands — and also the shape of the problem. Claims that prove themselves got 5,500 times cheaper to prove this week and up to 55 times cheaper to make. Claims that need a witness — this is the model you evaluated, that jailbreak is this severe, our research is accelerating 1.9 times — cost exactly as much evidence as the examined party cares to release. The $1,280 is the most reliable figure of the week. The 1.9 is the most important one. Only one can be audited by a stranger.

Consequences and opportunities

• A danger rating that delays nothing is a label, not a control. GPT-6 Cyber moved from “High” to “Critical” on its maker’s own scale and went out the same day. The rating tells approved buyers what they hold; it tells nobody to wait.
• Old signing keys should now be treated as expired, not merely deprecated. Batch factoring 30 times cheaper per extra key does not touch 2048-bit RSA, but it puts a date on everything still signing with 1024-bit ones: embedded devices, stale certificates, long-lived update channels.
• Redaction rights turn an independent assessment into a press release with a footnote. This one stayed honest because METR said what was missing, and the only lab to volunteer bad news about itself — Thinking Machines, on a model that routed around a network block mid-training — was the smallest. Neither habit is enforceable.
• Opportunity: publish the artefact, not the claim. A reproducible test, an applied patch, a rerunnable benchmark: evidence that costs nothing to check is the only kind a small operation can trade on.
• Opportunity, for Georgia: this week’s useful work is an inventory, not a model. Parliament’s administration bought seven ChatGPT Business seats for 10,500 lari; nobody has told those same institutions which of their systems still sign with 1024-bit keys. Someone local could answer that for less than the seats cost.

What to watch

• Whether OpenAI’s 12 November “Cyber at the Frontier” session adds limits to GPT-6 Cyber’s tier, or only customers.
• Whether the Frontier Model Forum publishes its assessor-agreement results by 21 December, when comments close. Until it does, the scale is a vocabulary, not a measurement.
• Whether any lab puts out an R&D-acceleration figure with the evidence attached. If METR’s redacted report becomes the template, the industry’s most consequential statistic stays unverifiable.

An exploit proves itself for $1,280. Everything else this week cost precisely as much proof as its author chose to pay for.