Hackers Siphon Over €100 Million From a French Bank and Freeze Its App, Ahold Delhaize Puts a €250 Million Price on Its Cyberattack, and OpenAI's Agents Find 948 Ways to Take Over Linux

By Noah Smith, Owner & Consultant, KeyChange Technologies · November 5, 2026

Here is today's AI and IT news for Thursday, November 5, 2026: a French bank watched more than €100 million walk out the door, the grocery giant behind Food Lion and Stop & Shop put a price on last month's cyberattack, a popular web host admitted attackers sat in its systems for two months, and OpenAI shipped new image models while its security agents found 948 ways to take over Linux. Yesterday's recap is here.

📌 The AI and IT news at a glance

• Hackers siphon more than €100 million out of France's Crédit Mutuel Arkéa, and the bank freezes its own app to stop the bleeding.
• OpenAI ships ChatGPT Images 2.6 with animated GIFs and two new image models for developers.
• OpenAI is reportedly lining up new Astra, Sol and cyber models for as soon as Friday.
• OpenAI's AI agents produce 948 working "take over the machine" exploits for Linux in a 30-hour, $1.2 million run.
• Anthropic pays a news publisher for the first time, licensing AP election coverage for Claude.
• Ahold Delhaize says October's cyberattack will cost it up to €250 million in sales.
• DreamHost confirms attackers sat inside its File Manager for two months, taking customers' FTP passwords.
• Hackers turn up the heat on France's blood bank refrigerators through a cooling vendor's remote software.
• Meta buys Conductor and gives its cloud customers until November 20 to get their data out.
• Apple puts employees on a daily AI budget, cutting some engineers from $300 to $200 a day.

🔝 Top story

Hackers siphon more than €100 million from Crédit Mutuel Arkéa, and the bank locks its own app

Customers of Crédit Mutuel Arkéa, the French banking group that includes Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and the online bank Fortuneo, woke up Wednesday to an app that would not let them in and transfers that would not go through. By the afternoon the bank confirmed why: a cyberattack had allowed "fraudulent transactions," and it had suspended some operations as a precaution to stop more money leaving. The bank says the incident is now under control and that customers will suffer no financial impact.

The bank has not confirmed how much was taken, but the numbers being reported are large. Crypto investigator ZachXBT first flagged suspicious withdrawals on November 2 of more than $106 million, then revised that to more than $133 million (roughly €118 million), and franceinfo reports that more than €100 million was stolen and converted to cryptocurrency. Several French outlets, citing anonymous sources, say the money moved out of Fortuneo into accounts opened under false identities on crypto platforms; that detail has not been officially confirmed. Some crypto platforms have already frozen part of the funds. The rest of Crédit Mutuel and CIC belong to a separate group and are not affected.

In short: A French bank confirmed a cyberattack that reportedly moved more than €100 million out through fraudulent transfers, and it froze its app and some transfers while it cleaned up.

What it means for your business: If your bank freezes transfers for a day, could you still make payroll and pay key suppliers? Separately, expect a wave of fake "your bank" texts and calls riding on this kind of headline.

My take: The scariest part here is not the dollar figure, it is that the money left through what looked like normal transfers. Attackers increasingly do not need to break the vault; they just need the bank's own systems to say "yes" to the wrong request. For a small business, the lesson is the same at a smaller scale: put a second approval or a callback on any large or new-payee transfer, and keep a small cash buffer or a second account at a different bank so one outage does not stop your business cold.

Source: Sortiraparis: Crédit Mutuel Arkéa app down after cyberattack

🤖 AI

OpenAI ships ChatGPT Images 2.6, with animated GIFs and two new image models

OpenAI rolled out ChatGPT Images 2.6 on November 4 to all ChatGPT and Codex users on web, desktop and mobile. The headline feature is native animated GIFs: you can turn a prompt or a photo into a looping animation, adjust the speed and edit individual frames. A new reference-image feature also saves likenesses of people, pets or characters so you can reuse them without re-uploading every time. OpenAI says image generation overall is up to 50% faster.

For developers there are two new API models: GPT-Image-2.6 Flare, a speed tier that OpenAI says can generate an image in as little as six seconds, and GPT-Image-2.6 Sunburst, a quality tier with better consistency across edits, image markup and SVG export. Pricing for the two was not disclosed. OpenAI also says people now make more than 4 billion images a week across ChatGPT and its API, up from 3 billion in September.

In short: OpenAI released Images 2.6 with GIF creation, saved reference images, and two new API image models aimed at speed and quality.

What it means for your business: Quick social graphics, simple animated promos and consistent product or mascot images just got easier to make in-house, but check licensing and likeness rules before using real people.

My take: The GIF feature will get the attention, but saved reference images are the practical upgrade. Keeping a consistent look across a month of posts has been one of the most annoying parts of AI images. The SVG export on Sunburst is also worth a look if you need logos or icons that scale cleanly, though I would still have a designer clean up anything that represents your brand.

Source: AI Weekly: OpenAI ships ChatGPT Images 2.6 with GIFs and faster API models

OpenAI reportedly plans new Astra, Sol and cyber models for as soon as Friday

According to a November 4 report from The Information, OpenAI could release updated Astra and Sol models, along with a cybersecurity-focused model, as early as Friday, November 6. OpenAI has not confirmed the timing, names, pricing or availability.

The report lands a day after OpenAI published engineering benchmark results for an unreleased internal model. On BenchCAD 2.0, which tests AI on 3D models, assemblies and circuit boards, the internal model averaged 87.5% versus 59.4% for GPT-6 Astra at its maximum reasoning setting. Posts on X claim that internal model is among Friday's releases, but The Information has not confirmed that, and any cost figures floating around are extrapolations from a chart, not real API prices.

In short: OpenAI is reported to be preparing new models for release as soon as November 6, but nothing is confirmed yet.

What it means for your business: If you are mid-evaluation on an AI tool or contract, it may be worth waiting a few days to see what lands and what it costs.

My take: Treat this as a "watch this space," not news you can plan around. OpenAI's own numbers suggest the next big model is meaningfully better at engineering work, but the early hints also suggest it costs a lot more per task. For most small businesses, the cheaper mid-tier model that usually ships alongside these headliners is the one that will actually matter.

Source: ProPakistani: OpenAI reportedly releasing far smarter and expensive internal AI tomorrow

OpenAI's agents found 948 ways to take over a Linux machine, for $1.2 million

OpenAI on Wednesday detailed an automated security pipeline built on an upcoming cyber-focused model. In a run in mid-October, its AI agents analyzed 2,308 candidate flaws in the Linux kernel, the core of most of the world's servers and Android phones, reproduced 1,724 of them in a sandbox in about 30 hours, and produced 948 working exploits that let a low-level user on a machine take full administrator ("root") control. The whole run cost about $1.2 million in API usage.

The pipeline does more than find bugs: agents also write candidate patches, and human security researchers review every exploit and fix before anything is reported to Linux maintainers. These are "local" flaws, meaning an attacker already needs some foothold on the machine, and the work was done in a controlled research environment. The comparison point is striking: OpenAI said its earlier model found 24 such exploits back in June.

In short: OpenAI's AI agents turned thousands of possible Linux bugs into 948 working takeover exploits for about $1,300 apiece, and are proposing fixes alongside them.

What it means for your business: The software your vendors run is about to get a lot more patches, faster; keeping servers, network gear and phones on automatic updates matters more than ever.

My take: This is my one technical pick today because the economics are the story. Finding a serious flaw used to take a skilled human days or weeks; now it costs about what a laptop does. That is great news when the good guys run it and patch first, and a warning about what happens when attackers have the same tools. The practical response for an owner is boring and effective: shorten the time between "patch available" and "patch installed."

Source: The Hacker News: OpenAI AI pipeline generates 948 Linux root escalation exploits in 30-hour run

Anthropic pays a news publisher for the first time, licensing AP election coverage for Claude

Anthropic struck a content and data licensing deal with the Associated Press just before the midterm elections, Adweek reports, citing two people familiar with the matter. If you asked Claude for results on election night, you would have seen up-to-the-minute information provided by and credited to the AP. Neither company commented on the record, and the financial terms and length of the deal were not disclosed.

It is a notable shift. Until this week Anthropic had not paid any digital publisher for content, while OpenAI has signed more than a dozen such deals. Adweek's read is that an AI assistant without access to credible, real-time reporting is badly limited on the days people need it most, and that publishers blocking AI crawlers helped force the issue. It comes as Anthropic prepares to go public in a matter of weeks.

In short: Anthropic licensed AP election coverage for Claude, its first paid deal with a news publisher.

What it means for your business: AI assistants are getting better at current events, but for anything time-sensitive, check that the answer cites a real, recent source.

My take: This is a small deal with a big signal: even the AI company most confident in "fair use" is now paying for fresh, trustworthy news. For anyone using AI for market or competitor research, the quality of the sources behind the answer is becoming a real differentiator between tools, and it is fair to ask your vendor where its current-events answers come from.

Source: Adweek: Anthropic strikes its first licensing deal, with the AP, for election coverage

🛡️ IT and security

Ahold Delhaize says October's cyberattack will cost it up to €250 million in sales

Ahold Delhaize, the parent of Food Lion, Stop & Shop, Giant and the Dutch chain Albert Heijn, put a number on last month's cyberattack with its third-quarter results on Wednesday. It expects fourth-quarter revenue to be €200 million to €250 million lower and fourth-quarter profit to take a €75 million to €100 million hit. It also cut its full-year outlook: earnings-per-share growth is now expected in the low single digits instead of mid-to-high single digits, and free cash flow is now about €2.1 billion instead of at least €2.3 billion.

The attack took several brands' systems offline for about two weeks in October. In the Netherlands, Albert Heijn could not deliver online orders, restock shelves, or show correct prices on its electronic shelf tags. CEO Frans Muller said most of the disruption was contained within two weeks but work continues to fully restore normal operations. Underneath the damage, the business itself was healthy: third-quarter revenue rose 1.9% to €23.1 billion and operating profit rose more than 7%.

In short: Ahold Delhaize expects its October cyberattack to cost up to €250 million in sales and up to €100 million in profit this quarter.

What it means for your business: A two-week outage at a well-run company cost a fortune; your recovery plan should assume "down for two weeks," not "down for an afternoon."

My take: I like when companies put real numbers on these incidents, because it ends the "it won't happen to us" conversation. Notice what actually broke: not just the website, but restocking and price tags, the boring back-office systems nobody thinks about until they stop. Ask yourself which unglamorous system would stop your business if it vanished tomorrow, and make sure you have a manual fallback for it.

Source: NL Times: Cyberattack cost Albert Heijn parent Ahold Delhaize estimated €250 million

DreamHost confirms attackers sat in its File Manager for two months and took customers' FTP passwords

Web host and domain registrar DreamHost, which many small businesses use for their websites and email, has sent breach notifications confirming that an attacker exploited a flaw in its web-based File Manager. From roughly August 2026 until DreamHost discovered it on October 23, the intruder could capture the FTP/SFTP usernames and passwords of anyone who logged into that File Manager. The attacker may also have reached webmail systems and taken session information, including credentials, for a limited number of users.

DreamHost says it found no evidence that control panel logins or billing and payment details were accessed, and that it has closed the hole, ended active sessions and invalidated passwords. It is offering affected people a year of Equifax credit monitoring. It has not said how many accounts were affected. Its advice to customers: check your website files for unauthorized changes, review webmail forwarding rules and filters, and change the password anywhere else you reused it.

In short: DreamHost confirmed a two-month breach that exposed FTP/SFTP logins and some webmail sessions.

What it means for your business: If your site or email is on DreamHost, check for unfamiliar files and, especially, for mail forwarding rules you did not create.

My take: The forwarding-rule check is the one I would do today. A quiet rule that copies your inbox to an outsider is how invoice fraud starts: the attacker reads your real conversations, then sends a perfectly timed "updated bank details" email. Two months of access is long enough for exactly that. And if your FTP password is used anywhere else, it is not a password anymore, it is a public key.

Source: BleepingComputer: DreamHost confirms data breach exposed FTP logins and webmail sessions

Hackers turn up the heat on France's blood bank refrigerators through a cooling vendor

France's national blood service, the Établissement français du sang (EFS), says a November 2 cyberattack on its refrigeration supplier raised the temperature and defrost settings to extreme levels in cold-storage chambers at three of its facilities. Those chambers hold blood products before they go to hospitals, plus biological samples. EFS itself was not hacked; the attackers came in through the supplier's systems. Refrigeration provider Coolworld Rentals has confirmed an incident involving its remote monitoring software, blaming a flaw in a third-party component, though EFS has not named its supplier.

The good news: EFS's own alarms caught the temperature change quickly, staff moved or secured the products, and the service says no blood products were lost and there was no health impact. It is the latest in a run of attacks on remotely managed refrigeration in Europe, after October's hit on French supermarkets and a second wave across six more countries that we covered on November 3.

In short: Attackers used a cooling vendor's remote software to crank up temperatures at three French blood bank facilities, but alarms caught it before anything spoiled.

What it means for your business: Any equipment a vendor can manage remotely (HVAC, refrigeration, cameras, door locks) is part of your attack surface, even if you never log into it.

My take: This is the story to forward to anyone who runs a restaurant, a clinic, a lab or a warehouse. EFS did one thing right that saved the day: it had its own independent alarm, not just the vendor's dashboard. Ask your equipment vendors how remote access is secured and who can change settings, and make sure something you control will scream if a temperature goes out of range.

Source: BleepingComputer: Cyberattack disrupts blood storage refrigeration systems in France

🧰 Tools for vibe coders and business AI

Meta buys Conductor, and its cloud customers have until November 20 to get their data out

Conductor, the startup whose app lets developers run several AI coding agents (Claude Code, Codex, Cursor and OpenCode) side by side on the same project, announced on November 4 that it is joining Meta. The catch for customers: Conductor Cloud shuts down on November 20, 2026, and cloud workspaces become read-only on November 13, when you can still read and export but not send new messages. Conductor will start deleting cloud user data when the service closes.

New sign-ups and downloads have stopped, current Pro users keep Pro features for free, and active subscribers will get refunds. You can move a workspace and its chats to your Mac with the "Transfer to local" command, or grab a full archive under Settings, Account, Export data. The local Mac app will keep getting new models and critical fixes until early 2027, when it too begins winding down. Founder Charlie Holtz hinted at a "next interface" in early 2027 but gave no details.

In short: Meta acquired Conductor, which is shutting its cloud service on November 20 and deleting cloud data after that.

What it means for your business: If anyone on your team uses Conductor Cloud, export now; more broadly, know how to get your data out of every small AI tool you depend on.

My take: This is the quiet risk of building on hot little AI startups: the good ones get bought, and the product you rely on gets a two-week eviction notice. That is not a reason to avoid them, but it is a reason to keep your actual work (code, prompts, documents) somewhere you own, like your own repository or drive, and to treat the tool as replaceable.

Source: Unite.AI: Conductor joins Meta and will shut down its coding-agent cloud

Apple puts employees on a daily AI budget

Apple is reining in how much its employees spend on AI tools, Bloomberg reports. In October it cut some engineers' daily AI spending limit from $300 to $200, and some may drop to $100. Many groups outside engineering already have a $100 daily cap, and some teams could be limited to $25. Apple is also nudging teams toward cheaper models or on-device AI, and employees who need more can ask executives for an increase.

Apple lets staff use Claude, ChatGPT, Gemini and other models, and engineers get the biggest budgets because AI coding burns through a lot of usage. Some employees told Bloomberg that few people were using the full $300 anyway, so the savings may be modest. The move comes as new CEO John Ternus, who took over on September 1, reportedly pushes to cut bloat, and as Apple brings in outside productivity consultants.

In short: Apple is capping employees' daily AI spending and steering them toward cheaper and on-device models.

What it means for your business: Per-person AI spend limits and "use the cheaper model first" rules are becoming normal, even at the richest companies, so it is reasonable to set them on your team too.

My take: I think this is healthy, not stingy. AI costs creep because nobody sees the meter running. A simple monthly cap per person, plus a default to the mid-tier model with the expensive one available on request, usually cuts the bill a lot without slowing anyone down. If Apple, with all its money, wants that discipline, a 10-person company definitely does.

Source: MacRumors: Apple is putting employees on an AI budget

That is the AI and IT news for today. See you tomorrow.