OpenAI's Codex lead said GPT-6 Astra, launched September 3, finished #1 on the Terminal-Bench 4.0 agentic benchmark when run through the Codex harness, at roughly half the inference cost of the second-place model, as Astra's rollout to all ChatGPT Plus, Pro, and Business users wrapped up ahead of OpenAI's own multi-day estimate.
why it mattersA concrete coding-benchmark result for Codex specifically, distinct from Astra's general-purpose launch.
X (Thibault Sottiaux, OpenAI)
A week after Manifold Security disclosed GitSpawn — malicious repository git configs that run attacker commands in Claude Code, Codex, Cursor, and other coding agents before any trust prompt — GitHub formally assigned CVE-2026-72718 to the flaw in Goose (now patched) and CVE-2026-71963 to Hermes Agent, whose vendor never responded to disclosure attempts; a second attack path in Claude Code, reached via the `claude ultrareview` command, was still unfixed as of Manifold's last retest.
why it mattersShows which of the seven affected agents are actually fixed a week on — and that Claude Code still has an open path.
The Hacker News