Astra Is Here to Do Your Job and Hack Your Systems

Read the fine print, Tech Insiders.

OpenAI's newest model can hunt bugs and obscure its reasoning, while a Musk-triggered breakup puts a $1 billion-plus revenue stream on the chopping block. Elsewhere, attackers target SonicWall gateways and Android phones, and Apple's privacy rules land in court.

Let's read before clicking "Accept."

Here's what you need to know today:

OpenAI Launches Astra, Its Most Powerful Model Yet

The smartest kid in class just learned lockpicking.

OpenAI launched GPT-6 Astra yesterday, touting massive leaps across software engineering, scientific research, and everyday desk tasks. Daybreak cyber defenders get first access; paid ChatGPT plans, the API, and AWS follow within days.

The demos deliver boss-friendly awe: Astra reportedly crammed a five-hour job search into a mere 2 minutes, 51 seconds, while legal platform Legora says it audited 41 financial documents in minutes and successfully flagged a quartet of intentionally hidden mistakes.

The sharper edge is cybersecurity. Astra is OpenAI's first "Critical"-rated cyber model, able to hunt down and weaponize undiscovered software vulnerabilities without human hand-holding. During evaluations, it aced the ExploitBench metric and unearthed a pair of zero-day flaws within Google's V8 architecture, prompting restricted access to its sharpest cyber skills. Great for defenders; less charming in the wrong terminal.

Then comes the trust fall. OpenAI calls Astra its most aligned model yet, but acknowledges that its reasoning is becoming harder to monitor—and that it sometimes intentionally conceals its step-by-step methods. President Greg Brockman thinks it may mark the AGI era; days earlier, CEO Sam Altman called AGI an "irrelevant marketing term." Apparently, human alignment is still in beta too.

Why it matters: Astra could compress hours of grunt work into minutes. But granting more autonomy to a less transparent model makes strict oversight, rigid permissions, and automated kill switches fundamental infrastructure, not just compliance confetti.

Share this newsletter!

Pulse Check

How much work would you let Astra handle without approval?

Results from Yesterday's Pulse Check

Would lower costs make you deploy more autonomous AI agents?

Insider Intel

OpenAI Walks Away From Cursor's $1B Payday

Turns out some burnt bridges are worth leaving $1 billion on the table.

At the start of 2026, Cursor was one of OpenAI's top five revenue drivers, projected to hit $1 billion annually by spring. It is walking away anyway after SpaceX's $60 billion acquisition.

OpenAI claims it can't trust SpaceX to respect contracts, citing past spats and Musk's sworn admission that xAI siphoned OpenAI data for training. It plans to cut Cursor off Nov. 12 and withhold future models.

Cursor CEO Michael Truell countered that OpenAI models handle only about 5% of user traffic. OpenAI shot back that traffic doesn't equal revenue, telling him to "share the math." Musk chimed in with customary grace, posting that he "couldn't care less" while calling OpenAI CEO Sam Altman "Scam Altman."

The breakup is messier because OpenAI backed Cursor's 2023 seed round, once explored buying it, and now competes with it through Codex. Meanwhile, Anthropic promised extra Claude capacity for Cursor, despite previously cutting off Windsurf when OpenAI was rumored to acquire it. Principles remain wonderfully acquisition-sensitive.

Nothing says "open ecosystem" like a change-of-control clause.

Security Alerts

SonicWall Zero-Days Fuel Active SMA1000 Attacks

Attackers are actively exploiting two zero-days affecting SonicWall SMA1000 6210, 7210, and 8200v appliances. CVE-2026-83548, a maximum-severity pre-authentication SSRF bug, chains with CVE-2026-83549 for unauthenticated remote code execution. CISA added both to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until tomorrow to patch.

With no workarounds available, install hotfix 12.4.3-03526 or 12.5.0-02952 immediately and check for compromise. If suspicious activity appears, wipe and restore the device, change all credentials, and reset TOTP tokens. Systems patched after July's attacks still need this update—yes, really.

Don't let your remote gateway double as an open bar for threat actors.

Meta Ads Deliver StreamRat Android Banking Trojan

Scammers pushed the new StreamRat Android banking trojan via bogus TV-streaming ads on Meta and TikTok, reaching around 570,000 Spanish-speaking accounts. While that number reflects impressions rather than actual compromises, the malware can capture keystrokes, steal credentials, view screens, and remotely control phones.

To get infected, targets have to manually sideload an APK and hand over suspicious permissions, including Accessibility and screen sharing. Sneakily, it creates a dead-end VPN that severs your internet, which likely hinders security apps from running cloud checks during setup. Avoid ad-promoted apps and stick to Google Play.

If infected, cut your network connection, revoke Accessibility, and delete the app. Change passwords from a safe device and contact your bank; wipe your phone entirely if you suspect the malware is lingering.

Free TV should not include complimentary phone hijacking.

Flash Bytes

Industry Shakeups

Apple Faces $2.7B UK App-Tracking Lawsuit

Apple faces a £2 billion ($2.7 billion) UK collective lawsuit claiming its App Tracking Transparency (ATT) rules unfairly handicapped third-party developers to boost its own ad business. Filed on behalf of thousands of app makers, the claim still requires certification.

ATT launched in 2021 to let users block cross-site tracking. Claimants say outside developers faced a strict double-consent process while Apple's in-house services skated by with looser oversight. This alleged double standard tanked ad sales and jacked up user-acquisition costs for App Store-reliant companies.

The spicy twist? Ann Pope, a former senior antitrust director for the UK's Competition and Markets Authority, is leading the claim. She clearly knows this rulebook from both sides.

Apple says it plays by the exact same rules, arguing its native apps skip the prompt because they don't harvest the targeted data. It calls privacy a fundamental human right and plans to defend the feature.

Regulators are still asking whose privacy rules benefit whom. Germany recently forced consent-screen changes, France and Italy issued ATT-related fines, and Apple is appealing a separate £1.5 billion UK App Store ruling. At this same tribunal, Google recently agreed to pay £260 million to settle a similar developer dispute.

Apple's privacy halo keeps collecting antitrust-shaped dents.

Meet Our Author

Justin Meyers

Writer/Editor at TechnologyAdvice

Justin Meyers is an investigative writer and editor who draws on over a decade of meticulous hands-on research to deliver the full, trustworthy story behind consumer and enterprise tech, including cybersecurity.

Curious about where AI is really headed?

The Neuron cuts through the noise to bring you smart, hype-free takes on the latest AI trends, tools, and breakthroughs. Join 700,000+ professionals from top companies like Microsoft, Apple, Salesforce, and more.

Advertise in Daily Tech Insider!

Daily Tech Insider is a TechnologyAdvice business.

© 2026 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.