OpenAI has introduced GPT-6 Cyber, a specialized model for authorized vulnerability research, exploit development, and security testing. OpenAI says the model scored 48.5 percent on its ExploitGym evaluation, up from 32.1 percent for GPT-5.6 Cyber. In a separate alignment test, the company says the model avoided attacking out-of-scope services in 99.93 percent of cases without a deployment safety prompt, and in every case with that prompt.
OpenAI also says its researchers used the model to develop 948 privilege-escalation exploits in the Linux kernel and identify 81 previously unknown high-severity vulnerabilities in Firefox. Access is initially restricted to a select group of approved Daybreak Red customers. For enterprise security leaders, the signal is not just stronger automated testing. It is that model capability, access controls, monitoring, and human oversight now have to move together.
In global model competition, Baidu released the base weights for ERNIE 5.5 Flash. The company describes it as a sparse mixture-of-experts language model with 280 billion total parameters and 14 billion active parameters per token. Baidu says it was pretrained from scratch on 33.5 trillion tokens. Its training context reached 128,000 tokens, while fine-tuning and inference support context up to 1 million tokens.
Because this is a base checkpoint without intermediate or post-training, its immediate audience is developers and researchers building their own domain adaptation, instruction tuning, or agent training.
OpenAI is also moving deeper into the software-development stack. The company announced an agreement to acquire Pierre Computer Company, the maker of Code Storage and open-source tools for navigating files and reviewing code. Pierre’s Trees and Diffs libraries are already used in Codex.
OpenAI says Pierre’s open-source projects will remain open source, and Code Storage customers can keep using the service while the companies work toward integration. The deal still requires customary closing conditions and regulatory approvals.
In customer experience, Five9 signed a definitive agreement to acquire Level AI in an all-cash transaction valuing the company at about $325 million. Five9 says Level AI’s applications can be offered as standalone products for enterprises that are not ready to move their contact centers to the cloud, and also inside the broader Five9 platform. The transaction is expected to close in 2026, subject to closing conditions.
Box, meanwhile, unveiled Box Architect, a planned system for building and managing agentic workflows across enterprise content. Box says teams will be able to describe a process in plain language, test it on real content, add human approvals, and choose models from multiple providers for different workflow steps.
The operational question is whether companies can move from isolated assistants to repeatable processes without weakening permissions, records policies, or review controls.
For commerce, Reuters reports that Amazon and Walmart are taking different approaches to third-party shopping agents as retailers weigh new buying interfaces against advertising revenue and customer data. Amazon has blocked Meta’s Muse, while Walmart has rolled out infrastructure for third-party agentic commerce. Reuters says Amazon chief executive Andy Jassy reported no meaningful effect yet on Amazon ads from third-party agents.
The near-term job for brands is practical: make product data useful to agents, but do not assume retail media budgets should move before shopper behavior does.
And in payments, Verifone says it has deployed Visa’s Featurespace adaptive machine-learning system across its gateways. The company says the framework scores payments in real time across in-store, online, and mobile channels. Verifone says it evaluates more than 1,800 attributes per transaction while keeping request processing below 100 milliseconds. Watch for independent evidence on fraud losses and false declines. The announcement does not provide outcome data.
What to watch next is access and adoption. OpenAI’s cyber model is tightly restricted. Baidu’s release is a base model meant for further training. Enterprise workflow products still need deployment details, and agentic shopping still needs measurable consumer behavior. The announcements are significant, but execution will decide where value actually lands.
That’s your AI Commerce Brief for today. Thanks for listening.
