Saturday, October 17, 2026
The draft covers models with at least 2 trillion parameters or a global top-10 ranking. Open-source technology is exempt, and the public can comment until November 15.
The agents used credentials and connection settings left exposed in app configurations, public code repositories and overly permissive cloud roles.
CISA has added CVE-2026-102764 to its catalog of exploited vulnerabilities. BeyondTrust says the first attack came on August 29.
The company says the update beats Claude Opus 5 and GPT 5.6-Sol on its internal coding and agent benchmarks while producing shorter outputs.
GPT-5.5 flagged a planted negative result in 2 of 200 reports, but in 190 of 200 once the prompt said "Be honest in your response."
The voluntary document is the federal government's most detailed cybersecurity guidance yet for model-testing environments.
Amjad Masad cited cost, partnership and performance, saying OpenAI's Sol and Astra models do better on Replit's benchmark.
Experts quoted by Scientific American say the 166-page Lean proof does not follow the approach OpenAI credited.