OpenAI shipped a model rated Critical for hacking. The exploitation data says the thing that will break your site is still a WordPress plugin.

Two things happened in the same week, and only one of them got the headlines.

On September 3, 2026, OpenAI released GPT-6 Astra and became the first lab to classify one of its own models as Critical for cybersecurity capability under its Preparedness Framework. In OpenAI’s definition, that means a system that can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step. During an internal evaluation, Astra found and chained two zero-day vulnerabilities that nobody knew existed.

On the same day, Google pushed an emergency Chrome update for a V8 bug that attackers were already using against real people. That one was found by a human, reported a month earlier, and paid a $1,000 bounty.

The second story is the one that will affect your business this week. The first is the one worth understanding properly, because the coverage of it has been unusually bad in a specific and expensive way: it conflates the ability to find vulnerabilities with the rate at which vulnerabilities are used against anybody. Those are different numbers, they have moved in different directions, and somebody has counted.

What OpenAI actually shipped

Start with the facts, because they are genuinely notable and there is no reason to soften them.

GPT-6 Astra was announced September 3 and began rolling out to a limited set of organizations, with wider availability planned across ChatGPT Plus, Pro, Business and Enterprise, the OpenAI API, Microsoft Azure and AWS Bedrock. API pricing is $10 per million input tokens and $50 per million output tokens, which happens to be the same headline rate Anthropic charges for Claude Fable, a coincidence worth noting only because it tells you where the frontier price point has settled.

The benchmark numbers:

Evaluation	GPT-6 Astra	GPT-5.6 Sol
ExploitBench (building working exploits from known vulnerabilities)	100%	78.5%
ExploitGym	42.4%	30.3%
Exceeded the authorized target in honeypot tests	0%	~48%
FrontierMath Tier 4	98%	not stated
ARC-AGI-3	99.9%	not stated

The V8 result is the one that matters here. OpenAI ran Astra against an internal benchmark of 20 high-severity V8 vulnerabilities disclosed between June and August 2026. Astra achieved substantially higher arbitrary code-execution rates than its predecessor, and in the course of that evaluation it discovered and used two previously unknown zero-days. OpenAI says it is disclosing both to the maintainers.

Two clarifications, because the two Chrome stories this week are separate and several outlets have run them together.

The zero-days Astra found are not CVE-2026-85046, the bug Google emergency-patched on September 3. That one was reported by security researcher Salvatore Gulizia on August 4, 2026. Astra’s two findings have not been assigned CVEs publicly, no affected product versions have been named, and no exploitation of them has been observed. As of this writing they are a benchmark result, not an incident.

The shipped version of Astra will not do this for you. OpenAI limits the public model to defensive work, secure code review and patching, and it refuses prompts asking for proof-of-concept exploits. OpenAI also says it deploys misalignment monitoring across tool-using inference to detect and halt unauthorized behaviour. Those restrictions are meant to loosen for vetted defenders through a program called OpenAI Daybreak.

Daybreak is not small. OpenAI committed $1 billion over the next six months to subsidized access, training and technical support for frontline defenders, with a Daybreak for America program aimed at local governments, water systems, electricity providers and regional banks, and a pilot with the Multi-State Information Sharing and Analysis Center to train state, local, tribal and territorial cyber defenders starting with public sector and water system teams.

And the caveats are on the record too. The UK AI Security Institute and Apollo Research flagged concerns about benchmark validity, specifically that Astra demonstrated evasion of monitors and what they called verbalized evaluation awareness, which limits confidence in the low misbehaviour rates. A model that can tell it is being tested is a model whose test results you read with a wider error bar.

Sanchit Vir Gogia of Greyhound Research put the framing better than anyone else quoted this week: “The Critical label is a disclosure event rather than a capability event.” The capability has been arriving in increments for two years. What happened on September 3 is that a lab wrote it down.

Now the number nobody is quoting

VulnCheck published its State of Exploitation report for the first half of 2026 on July 28. It tracks vulnerabilities with evidence of exploitation in the wild, which is a much narrower and more useful category than “vulnerabilities that exist.”

495 vulnerabilities showed evidence of exploitation in the first half of 2026. Then this:

Of 1,061 vulnerabilities attributed to AI-assisted discovery, only 14, or 1.3%, have been confirmed as exploited in the wild, roughly matching the overall exploitation rate.

Read the last clause twice. AI-discovered vulnerabilities are not being exploited at a higher rate than vulnerabilities found any other way. They are being exploited at about the same rate, which is to say hardly at all.

The Anthropic figure is starker. Project Glasswing, launched April 7, 2026, gave selected technology providers early access to an unreleased Anthropic model to hunt for flaws in systemically important open-source software. VulnCheck’s accounting: more than 23,000 findings reported, 126 published CVEs, one confirmed exploited in the wild.

One.

There is a reason for that, and it is not that the findings were fake. The Cloud Security Alliance published a research note on May 24 with the disclosure numbers as of May 22: 1,596 vetted findings disclosed to maintainers of 281 open-source projects, of which 97 had been patched and 88 had received a CVE or GitHub Security Advisory. That is a remediation rate of roughly six percent. The CSA’s conclusion is worth quoting because it is the actual story of AI and vulnerabilities in 2026:

exposing a structural mismatch between the velocity at which AI can surface flaws and the pace at which the global developer community can remediate them.

Some open-source maintainers have reportedly asked Anthropic directly to slow the disclosure rate, because the pace is not sustainable against the hours they have.

There is also a live dispute about the counting itself. VulnCheck’s Patrick Garrity went through the CVE database in April looking for Glasswing attributions and found roughly 40 candidate entries, of which exactly one could be directly tied to the initiative. His recommendation, that there should be a dedicated advisory page publishing these disclosures consistently, is the sort of unglamorous request that tells you the reporting infrastructure has not caught up with the discovery tooling.

So: discovery has gone up by orders of magnitude. Disclosure has gone up less. Patching has gone up barely at all. Exploitation has not moved.

The one that got through, and why it is the whole lesson

The single Glasswing finding confirmed exploited in the wild is CVE-2026-26980, a SQL injection in Ghost CMS’s Content API, CVSS 9.4. Unauthenticated, it let an attacker read arbitrary data out of the database, including admin API keys.

Anthropic found it with Claude. Ghost patched it in version 6.19.1 in February 2026.

Exploitation was first detected on May 7, 2026. Three months after the fix shipped.

What the attackers did with it was not exotic. Having pulled admin API keys, at least two threat clusters injected JavaScript loaders at the bottom of pages across more than 700 hijacked sites, spanning universities, blockchain and AI companies, SaaS vendors, security research firms, media and fintech. The loaders served fake verification pages telling visitors to paste a Base64-encoded Windows command into the Run dialog. That is ClickFix, the same social engineering pattern that Microsoft’s Defender Experts attributed 47 percent of their initial-access cases to. Researchers later identified 284 Ghost hostnames still carrying injection points.

So the most advanced vulnerability-discovery program in the world produced, as its one confirmed real-world outcome, a bug that was patched for three months before anyone used it, and was then used to run the most common commodity attack of the year.

Every link in that chain is a patching failure, not a discovery failure.

And there is a detail in the Ghost cleanup that a lot of site owners learned the hard way and is worth carrying forward: updating Ghost did not remove the injected content. Sites needed the patch, then content cleaning, then rotation of the admin API keys. We made the same point about WordPress core’s wp2shell chain: installing the update answers whether you are patched. It does not answer whether you are clean.

What is actually being exploited

If you run a small business website, this is the paragraph to keep.

In VulnCheck’s first-half data, content management systems accounted for one-third of all known exploited vulnerabilities, which the report describes as a more significant percentage than they have seen historically. The largest volume by far was WordPress plugins, followed by Drupal, Ghost, Kentico Xperience and a handful of others. The rest of the exploited set skews toward network edge devices (Cisco, Palo Alto, Check Point, F5, Juniper, Fortinet), security tools, developer tools and device management platforms.

Not frontier AI. Not novel memory-corruption chains. A plugin you installed in 2022 to add a contact form.

The timing data is worth understanding precisely, because it is widely misquoted. VulnCheck puts the median time from CVE publication to observed exploitation at 80 days in the first half of 2026, down from 120 days in 2025. At the same time, 23.43 percent of exploited vulnerabilities showed exploitation on or before the day the CVE was published, and roughly 200 CVEs were exploited within 31 days.

Both of those are true and they describe a distribution, not a single number. You will see “median time to exploit is under five days” quoted from other vendors measuring different things over different populations. Do not try to reconcile them into one figure. The operationally useful reading is simpler: about a quarter of the bugs that get exploited are already being exploited when you first hear about them, and the rest give you weeks to months. The quarter is why CISA moved its own remediation deadlines to three days for newly exploited vulnerabilities. The rest is why almost every real compromise we get called about involves something that was patchable last quarter.

So what actually changed this week

Three things, and none of them is “AI is now hacking your website.”

The supply of known vulnerabilities is about to increase sharply, and your ability to apply patches is the constraint. This is the Glasswing lesson, and Astra makes it larger rather than different. Six percent remediation is not a maintainer failure, it is a capacity ceiling. Every organisation downstream of open source inherits that ceiling. Planning for a world with more advisories, not fewer, is the correct response.

The defensive side got a large, cheap capability at the same time as the offensive side. Daybreak’s $1 billion in subsidized access is aimed squarely at the organisations that have never been able to afford a security team. Whether it works is an open question, but the asymmetry argument (attackers get AI, defenders do not) is weaker this week than it was last week, not stronger.

Browser patching moved from important to urgent. CVE-2026-85046 is the sixth actively exploited Chrome zero-day of 2026, and the third of those six in V8:

Month	CVE	Component
February	CVE-2026-2441	Use after free in CSS
March	CVE-2026-3909	Out-of-bounds write in Skia
March	CVE-2026-3910	V8
April	CVE-2026-5281	Use-after-free in Dawn/WebGPU
June	CVE-2026-11645	Out-of-bounds memory access in V8
September	CVE-2026-85046	Type confusion in V8

All six carry a CVSS of 8.8. All six are reachable from a web page. And V8 is now both the component attackers keep landing on and the component an AI model just found two fresh bugs in during a benchmark run. That is not a coincidence worth panicking about, but it is a reason to treat the browser update prompt as a security control rather than an interruption.

The checklist

Ordered by what will actually reduce your risk, not by what is in the news.

1. Update Chrome today, on every machine. The fixed versions are 152.0.7977.82 and .83 on Windows and Mac, and 152.0.7977.82 on Linux. Menu, Help, About Google Chrome, then relaunch. The relaunch is the part people skip, and an unrelaunched browser is an unpatched browser.

2. Update every other Chromium browser too. Edge, Brave, Opera, Vivaldi and Arc all ship V8. They pick up the fix on their own schedules, which are days behind Chrome’s, so check each one you actually use rather than assuming.

3. Patch your CMS and, more importantly, your plugins. This is where a third of real-world exploitation lives. Turn on automatic updates for minor and security releases. For anything you cannot auto-update, put a recurring calendar entry on a named person, not on the business.

4. Delete plugins and themes you are not using. A deactivated plugin still has files on disk that a request can reach. The cheapest security work available to a small business is subtraction.

5. Write down what you actually run. CMS and version, every plugin and theme, the framework and its major version, the hosting platform, anything self-hosted, every internet-facing device. You cannot triage an advisory against an inventory you do not have, and this is the single most common gap we find.

6. Subscribe to the advisories for the five things on that list that matter most. GitHub security advisories for your dependencies, the vendor mailing list for your CMS, the CISA KEV feed. The CSA’s own recommendation is to establish direct notification relationships rather than waiting on database enrichment, because the enrichment lag is now the slowest link.

7. Assume patch lag and add compensating controls. The CSA note is blunt that “patch lag is structurally unavoidable for a meaningful proportion of the vulnerability inventory,” and recommends runtime detection, behavioural anomaly monitoring and network-layer controls to cover the gap. For a small business that translates to: a WAF in front of the site, alerting on file changes in the web root, and an off-site backup you have actually restored from once.

8. If you find out you were running something vulnerable, patch and then check whether you were used. Compare the files in your web root against a known-good copy. Look at the bottom of rendered pages for script tags you did not add. Rotate every API key that application holds. The Ghost victims who only patched stayed compromised.

9. Do not buy an AI security product this week because of a headline. Nothing in the September 3 announcement changes what your threat model should be. If you want to use these tools, the highest-value application for a small team right now is exactly the one OpenAI shipped unrestricted: secure code review and patch generation on your own codebase.

What would change this picture

We would rather give you the tripwires than a forecast.

Watch for the exploitation rate on AI-discovered vulnerabilities to break away from the baseline. Right now it is 1.3 percent against a comparable overall rate. If VulnCheck’s next report has that number diverging, the argument in this article stops holding.

Watch the remediation rate. Six percent is the number that decides everything downstream. If AI-assisted patch generation moves it into double digits, the discovery volume stops being a liability and starts being an asset.

Watch for an AI-discovered vulnerability being exploited before it is publicly disclosed. That has not happened in the confirmed data. It is the event that would mean offensive capability had genuinely outrun the disclosure pipeline, rather than just outrunning the patch pipeline.

And watch the median. Eighty days, down from one hundred and twenty. If that halves again, the window in which quarterly patching is a defensible strategy closes.

Update, September 9, 2026: the largest test of this argument so far

Four days after we published this, Microsoft shipped the biggest Patch Tuesday in the company’s history. Depending on whose methodology you use, it contained between 964 and 974 CVEs, against a full-year total of 1,130 for 2025 and 1,009 for 2024. Microsoft has patched roughly 2,660 CVEs in the first nine months of 2026, and the monthly average jumped from 122 in the first half of the year to 644 in the third quarter, starting the exact month Microsoft turned its agentic scanning system loose on the Windows codebase.

That is the thesis of this article at a scale we did not have when we wrote it. So we ran the same count.

We pulled CISA’s KEV feed on September 9 (catalog version 2026.09.08). Of those roughly 2,660 Microsoft CVEs, 25 carry a 2026 number and have confirmed in-the-wild exploitation. That is 0.94 percent, or about one in 106. With the same caveats we applied to the VulnCheck data above: recent CVEs have had less time to be attacked, and KEV is what CISA has confirmed rather than everything that has ever happened. The true rate is higher than one percent and nowhere near a tenth of the total.

Satnam Narang at Tenable put it better than we did: “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles.” Dustin Childs at the Zero Day Initiative made the same observation from the other direction, noting that AI-assisted discovery shows no sign of slowing while “we have not seen a correlating spike in active exploits” yet.

Both of those are this article’s argument, from the two organisations with the best view of the data, four days later and one order of magnitude larger. The full breakdown of that Patch Tuesday, including which of the 964 actually matter to a small business, is a separate post. The short version is that it is four things, and two of them are “check that automatic updates ran.”

Update, September 10, 2026: the needles are still where they were

Two things landed the day after that update, and both cut the same way.

A second exploited Chrome zero-day in six days, and V8 again. Chrome 153 stable shipped on September 8 with 230 security fixes, one of which is CVE-2026-87491, an out-of-bounds write in V8 with an exploit in the wild. That is the seventh actively exploited Chrome zero-day of 2026 and the fourth of the seven in V8, arriving five days after the sixth. CISA added it on September 9 with a September 23 deadline. If you want evidence that the V8 codebase is where the returns are, that is it, and it is consistent with the OpenAI result at the top of this article. It is also, still, a browser bug that a relaunch fixes.

And the KEV recount did not move. We re-pulled the feed on September 10 at catalog version 2026.09.09. Four entries were added on September 9, and not one of them is Microsoft: Citrix NetScaler, Fortinet, Cisco Secure Firewall Management Center and the Chrome flaw above. The Microsoft count stands where it was, 38 entries added in 2026 with 25 carrying 2026 CVE numbers, so the 0.94 percent is unchanged. One day after the largest Patch Tuesday in history, the newly confirmed exploitation was three network edge appliances and a browser.

Meanwhile the most consequential AI security story of the week had no CVE in it at all. Anthropic disclosed on September 9 that four of its own models had reached real third-party systems during evaluations, including one that registered an unclaimed package name on PyPI and had it installed on fifteen automated scanners inside ninety minutes. Nothing about that required a novel vulnerability. It required an unregistered name and a script that installs things. That is its own post, and it is the same lesson as this one from a different angle: the capability is real and improving, and the thing that actually reaches you is still the boring gap nobody closed.

Update, September 15, 2026: the best counter-example yet, and the timeline inside it

This article’s argument is that AI-discovered vulnerabilities are real and that the things which actually break small businesses are still old, boring and unpatched. The strongest test of that so far arrived on September 5, and it deserves to be recorded honestly, because on the surface it cuts the other way.

CERT Polska published six vulnerabilities in MikroTik RouterOS, found with AI agents, and two of them were being exploited within days. The team states plainly how the research was done: the vulnerabilities were found by Sławomir Rozbicki “using the GPT-5.5-cyber and GPT-5.6-sol models as part of the team’s access to the OpenAI Government and Trust Agency Collaboration (GTAC) program,” in an agent-driven lab running real RouterOS machines. Two of the six chain into an unauthenticated device takeover that CERT Polska named MikroTrick, and CISA added exploited MikroTik flaws to the KEV catalog on September 10. That is a much shorter path from AI-assisted discovery to confirmed in-the-wild exploitation than anything in the VulnCheck numbers above.

Then look at the dates, which is where it stops supporting the scary reading. CERT Polska reports the observed compromises as “occurring since at least 2 September.” The patch shipped September 3. Publication was September 5. The attacks started before the research was published and before the fix existed. Whoever was taking over those routers was not reading AI-assisted research; they arrived first, by their own route. The AI pipeline produced the defence, not the offence.

Two other things in that write-up are worth keeping. CERT Polska is careful that this “was not the result of a single instruction (prompt)”: every hypothesis needed confirmation on a real device, negative controls, a clean-state repeat and a human impact assessment, and the most labour-intensive parts were building the lab and verifying the results. And the technique that worked is specific and mundane, which is what makes it credible: modelling protocols as state machines and checking what happens when a stage is skipped, repeated or run out of order. Four of the six flaws are exactly that bug.

So the scoreboard moves, slightly, and in a direction worth watching: AI-assisted discovery is now producing findings in widely deployed network gear fast enough that the patch and the attack can land in the same week. What has not changed is the part that decides whether it reaches you. The devices getting taken over are the ones that were never going to be updated by anybody, for any CVE, from any source. Our full write-up of the MikroTik flaws, including the two findings we took from MikroTik’s own release files, is here.

The unglamorous part

We build and maintain websites for small businesses in Toronto, and the honest version of this is that almost nothing we have ever cleaned up after was novel. It was a plugin nobody updated, on a site nobody owned, behind a login nobody had rotated, running a version that had a fix available for months.

A model that can find zero-days in V8 is a real and significant thing. It is also, for the next while, almost entirely irrelevant to whether your site gets hijacked to serve fake CAPTCHA pages. The 700 Ghost sites were not taken by anything clever. They were taken because a fix existed in February and nobody applied it before May.

The work that protects you is boring, it is cheap, and it needs one person to be responsible for it. If you are not sure who that is at your business, or you do not have the inventory in step five, get in touch. That conversation is short and it usually ends with a list.

Sources

• Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended, CERT Polska, September 5, 2026, for the six vulnerabilities, the MikroTrick chain, the quoted description of the LLM-assisted research and its GTAC context, the quoted caveats about prompts and verification, the state-machine technique, and the observation that the attacks it saw have been occurring since at least September 2

• Stable Channel Update for Desktop, Chrome Releases, September 3, 2026, for the fixed version numbers 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux

• Google patches actively exploited Chrome zero-day (CVE-2026-85046), Help Net Security, September 4, 2026, for the CVSS 8.8 rating, the type confusion description and the PACKED_ELEMENTS/PACKED_SMI_ELEMENTS technical detail, the twelve total security fixes, the reporter Salvatore Gulizia and the August 4 report date, the $1,000 bounty, and Google’s statement that an exploit exists in the wild

• Google fixes the sixth actively exploited Chrome zero-day of 2026, Security Affairs, September 4, 2026, for the full list of 2026 in-the-wild Chrome zero-days with CVE identifiers, months and affected components

• GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests, The Hacker News, September 4, 2026, for the ExploitBench score against GPT-5.6 Sol, the FrontierMath Tier 4 and ARC-AGI-3 figures, the Critical Preparedness Framework classification, the rollout to a limited set of organizations and planned availability on Azure and AWS Bedrock, and the refusal behaviour on proof-of-concept exploit requests

• OpenAI launches GPT-6 Astra, its first model to cross a critical cybersecurity threshold, InfoWorld, September 4, 2026, for the ExploitGym figures of 42.4 percent against 30.3 percent, the 0 percent against 48 percent scope-exceeding result, the API pricing of $10 and $50 per million tokens, enterprise access being off by default at launch, the disclosure of two new zero-days to the software makers involved, and the Sanchit Vir Gogia quote on the Critical label being a disclosure event

• OpenAI Releases GPT-6 Astra, Its First Model Rated Critical for Cyber, Unite.AI, September 3, 2026, for OpenAI’s definition of Critical cybersecurity capability, the internal benchmark of 20 high-severity V8 vulnerabilities disclosed between June and August 2026 and the two zero-days found during that evaluation, the misalignment monitoring across tool-using inference, and the UK AI Security Institute and Apollo Research concerns about evaluation awareness and monitor evasion

• Daybreak for Frontline Defenders, OpenAI, September 2026, for the $1 billion commitment over six months, the Daybreak for America program targeting local governments, water systems, electricity providers and regional banks, and the MS-ISAC pilot for state, local, tribal and territorial defenders

• VulnCheck State of Exploitation 1H-2026, VulnCheck, July 28, 2026, for the 495 known exploited vulnerabilities in the period, the 23.43 percent exploited on or before CVE publication, the median time-to-exploitation of 80 days against 120 days in 2025, the roughly 200 CVEs exploited within 31 days, the finding that content management systems accounted for one-third of all KEVs with WordPress plugins the largest volume followed by Drupal, Ghost and Kentico Xperience, the network edge, security tool and developer tool categories, the 1,061 vulnerabilities attributed to AI-assisted discovery of which 14 were confirmed exploited, and the Project Glasswing accounting of more than 23,000 findings, 126 published CVEs and one confirmed exploited

• Project Glasswing and the AI Vulnerability Disclosure Velocity Crisis, Cloud Security Alliance, May 24, 2026, for the 1,596 findings disclosed to 281 projects as of May 22 with 97 patched and 88 CVE or GHSA assignments, the roughly six percent remediation rate, the structural mismatch conclusion, the recommendation to establish direct notification relationships with maintainers, and the guidance that patch lag is structurally unavoidable and requires runtime detection, behavioural anomaly monitoring and network-layer controls

• Project Glasswing has uncovered 10,000 vulnerabilities: Anthropic, CSO Online, for the April 7, 2026 launch of Project Glasswing, the early-access structure, and maintainers asking Anthropic to slow the disclosure rate

• Anthropic’s Project Glasswing CVE count is still guesswork, The Register, April 15, 2026, for Patrick Garrity’s review finding roughly 40 candidate CVE entries of which one could be directly tied to the initiative, and his recommendation for a consistent public advisory page

• Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks, The Hacker News, May 25, 2026, for the CVSS 9.4 unauthenticated SQL injection in the Content API and admin API key extraction, the February 2026 fix in version 6.19.1, Anthropic’s discovery of the flaw using Claude, the first detection of exploitation on May 7, the more than 700 hijacked sites across universities, blockchain, AI, SaaS, security research, media and fintech, the two threat clusters and 284 Ghost hostnames with injection points, the injected JavaScript loaders serving fake CAPTCHA pages with Base64-encoded Windows commands, and the note that updating alone did not remove the injected content

• Introducing Claude Fable 5.1 and Claude Mythos 5.1, Anthropic, September 1, 2026, for the $10 and $50 per million token pricing referenced as the current frontier price point

• Microsoft Digital Defense Report 2025, Microsoft, for the finding that ClickFix accounted for 47 percent of the initial-access cases observed by the Defender Experts team, cited here via our earlier post on the technique