GPT-6 Cyber Debut Hunts 81 Zero-Days, Kimi's 2.8T Parameters Top Open-Source Rankings

Today's AI daily digest is exceptionally dense: OpenAI launches GPT-6 Cyber, a model dedicated to cybersecurity, which unearthed 81 high-severity zero-day vulnerabilities in Firefox; Tencent's Hunyuan Hi4 saw traffic surge, prompting emergency expansion, at one-tenth the cost of comparable models; Moonshot AI open-sourced Kimi K3.1 Pro with 2.8 trillion parameters, setting a new performance record for open-weight models; and the US AI sector suffered a "Black Thursday," evaporating approximately $2.8 trillion in market value in a single day. Model capabilities are racing forward, but anxiety over returns on capital expenditure is intensifying.

GPT-6 Cyber: How Powerful Is a Specialized Model That Only Does Security?

OpenAI has released GPT-6 Cyber, a model that "only does cybersecurity." On the ExploitGym benchmark, it scored 48.5%, a 51% improvement over the previous generation, while also outperforming the general-purpose flagship GPT-6 Astra.

The real-world performance is even more striking: in the Firefox browser, it uncovered 81 previously unknown high-severity vulnerabilities, which Mozilla has confirmed and begun pushing fixes for; on the Linux kernel, it reproduced 1,724 vulnerabilities and constructed 948 privilege-escalation paths. The entire research round cost approximately $1.21 million, averaging $1,279 per task, with a security rating of Critical. Currently, the model is only available to whitelisted customers.

OpenAI states that the model is trained to go directly to authorized targets—a positioning worth noting: it is both a capability demonstration and a security boundary declaration. A specialized model crushing the general-purpose flagship in a vertical domain may signal that "domain specialization" will become the next phase of model competition.

The ExploitGym benchmark is a test set specifically designed to evaluate AI models' vulnerability discovery and exploitation capabilities. Its problems typically come from real software vulnerabilities that have been fixed but whose details remain undisclosed (so-called "N-days"), requiring models to locate flaws in a given codebase, assess exploitability, and generate reproducible attack paths. It measures end-to-end offensive and defensive operational capability rather than multiple-choice-style security knowledge Q&A, so scores are generally low—48.5% is already high. The value of such benchmarks lies in distinguishing between "can understand vulnerability reports" and "can find vulnerabilities on their own," the latter being the core selling point of security-specialized models.

Zero-day vulnerabilities refer to security flaws not yet known to vendors or for which patches have not been released. They are named for the "zero days" vendors have to respond, and black-market prices often reach hundreds of thousands to millions of dollars. That AI can discover zero-days in bulk within mature codebases like Firefox means the marginal cost of vulnerability discovery has been significantly lowered—a double-edged sword for defenders: it accelerates fixes but also lowers the barrier to entry for attackers.

Tencent Hunyuan Hi4: Can't Handle the Traffic, 10x Expansion, Cost Is the Biggest Weapon

On the domestic front, Tencent's Hunyuan Hi4 couldn't handle the traffic just three days after launch. On November 5, Tencent announced a 10x expansion of its inference cluster, with free quotas increased accordingly.

More critically, the evaluation data: on the Artificial Analysis Intelligence Index, Hi4 scored 38 points, ranking 28th among 724 evaluated models and second among Chinese models—only Moonshot AI's Kimi K3.1 Pro ranked higher. Cost is its biggest selling point—approximately $0.78 per task, 10 times cheaper than Claude 4.7 at the same score and 13 times cheaper than Qwen 3.8 Max. Hi4 is also the first Hunyuan model to incorporate visual understanding into its flagship model.

For application-layer developers, this kind of cost-effectiveness—"same score but an order of magnitude cheaper"—often drives actual adoption more than a few extra points.

Kimi K3.1 Pro Open-Sourced: 2.8 Trillion Parameters, #1 in Open Weights

Moonshot AI has released the weights of Kimi K3.1 Pro on Hugging Face: 2.8 trillion total parameters, with only 104 billion activated per inference, a 1 million token context window, and native multimodal support.

Arena evaluated it using 17,500 real long-horizon tasks: K3.1 Pro achieved a net improvement of +5.1%, ranking first among open-weight models and 4.2 percentage points higher than the previous generation K3's +0.9%; command execution reliability improved by +7.9%, also ranking first among open models. This means open-source models are rapidly approaching the closed-source frontier in stability on long-horizon, multi-step tasks.

On the same day, Baidu also open-sourced ERNIE 5.5 Flash Base, with 280B parameters, sparse MoE activating 14B, trained on 33.5 trillion tokens of domain data, and supporting 128K training context.

Total parameters vs. activated parameters are key to understanding the MoE (Mixture of Experts) architecture. Total parameters refer to the total model weights, determining knowledge capacity; activated parameters refer to the number of parameters actually involved in computation during a single forward inference, directly determining compute cost and latency. Kimi K3.1 Pro has 2.8 trillion total parameters but activates only 104 billion, meaning it carries the knowledge reserves of a trillion-scale model with the inference overhead of a dense model in the hundreds-of-billions range. This is why current frontier models widely adopt sparse MoE: expanding capacity without linearly driving up inference costs.

Open weights and "open source" are often used interchangeably but differ substantively: open weights means model parameters can be downloaded, locally deployed, and fine-tuned, but training data, training code, and the full recipe may not be disclosed, so it typically does not meet the OSI definition of open source. Arena's open-weight leaderboard evaluates the actual task performance of downloadable models; K3.1 Pro topping it shows that self-deployable models can now compete head-on with closed-source APIs on long-horizon tasks.

Wuzhen Summit: Openness, Security, and Governance at the Same Table for the First Time

The World Internet Conference Wuzhen Summit concluded on November 5, with approximately 1,800 guests from 138 countries and regions in attendance. The main forum released the Global Open AI Action Initiative for the first time, with 18 articles covering open development, security and trustworthiness, and dialogue-based governance.

The Light of the Internet Expo showcased over 1,000 new technologies and products, with more than 100 embodied AI robots performing real-world tasks on-site. Ant Group's robots are already dispensing medicine in Shanghai pharmacies, adapted for 17 brands. Model competition, capital flows, and open-source governance were discussed at the same table for the first time.

AI Trading's "Black Thursday": $2.8 Trillion Evaporated

On November 5, US Eastern Time, AI trading suffered a "Black Thursday": the Nasdaq closed down 5.52%, the Nasdaq 100 fell 6.4%, and the Philadelphia Semiconductor Index plunged 12%, the worst day since the early days of the pandemic. Nvidia fell 9.3%, AMD dropped 17%, SanDisk fell 22%, and the US stock market evaporated approximately $2.8 trillion in a single day, with the Magnificent Seven losing $1 trillion.

One trigger was uncertainty over data center policy following the midterm elections; more fundamentally, the market has begun asking: when will such massive capital expenditure pay off? Even Anthropic's $1.5 trillion IPO valuation has been openly questioned by institutions. As model capabilities iterate on a monthly basis while capital markets scrutinize returns quarterly, this mismatch may be the dominant theme for some time to come.

The Philadelphia Semiconductor Index (SOX) is the benchmark index tracking the global semiconductor supply chain, covering design, manufacturing, equipment, and packaging/testing. It is regarded as a bellwether for AI computing demand. Its single-day 12% drop drew intense market attention because semiconductors are the most upstream link in AI capital expenditure—every dollar of compute investment by cloud providers ultimately translates into chip orders. A sharp pullback in this index typically signals that the market is repricing the growth rate of compute demand for years to come, rather than mere emotional selling.

The capital expenditure payback cycle is the core of the current divergence in the AI narrative. Data centers and GPU clusters are heavy-asset investments with depreciation cycles typically of 3-5 years, while model capabilities iterate monthly and business models remain exploratory. When the pace of investment is driven by an "arms race" but return validation must be scrutinized through quarterly earnings, valuations are prone to violent swings—this is the deeper structural tension behind "Black Thursday."

Other Quick News

• Baidu open-sourced ERNIE 5.5 Flash Base: 280B parameters, sparse MoE activating 14B, 33.5 trillion tokens of domain training, supporting 128K training context.
• Recursive open-sourced Repo 65B under the Apache 2.0 license, focused on coding and agent scenarios.
• Claude launched a personal finance feature with read-only access to bank accounts, able to read two years of statements, but it cannot move money or provide investment advice.

One-line Summary

GPT-6 Cyber found 81 zero-days, Kimi open-sourced a 2.8-trillion-parameter model, and the US AI sector evaporated $2.8 trillion in a single day.

Paragraph Summary

Today's AI landscape presents a coexistence of racing capabilities and capital anxiety. OpenAI launched GPT-6 Cyber, dedicated to cybersecurity, which uncovered 81 unknown high-severity vulnerabilities in Firefox and scored 48.5% on the ExploitGym benchmark, surpassing the general-purpose flagship—showing that domain-specialized models are crushing general-purpose ones. Domestically, Tencent's Hunyuan Hi4 expanded 10x just three days after launch, scored 38 on the Intelligence Index to rank second in China, and costs only $0.78 per task—more than ten times cheaper than comparable models; Moonshot AI open-sourced Kimi K3.1 Pro with 2.8 trillion parameters, activating only 104 billion, with a net improvement of +5.1% on long-horizon tasks, ranking first in open weights. The Wuzhen Summit discussed openness, security, and governance at the same table for the first time. Meanwhile, the US AI sector suffered a Black Thursday, with the Philadelphia Semiconductor Index plunging 12% and approximately $2.8 trillion evaporating in a single day, as anxiety over capital expenditure returns became the market's main theme.