The Real Reason a Chip Fab Can't Patch Against GPT-6

On the third of September OpenAI began releasing GPT-6, which it calls Astra — the first model it has ever rated Critical for cyber risk. On test systems it found security holes nobody knew existed and wrote working break-ins, on its own. The AI company Anthropic gated its new model the same week — both labs agree it needs a gate. And OpenAI, to its credit, shipped it switched off until your administrator turns it on. So what does that mean for your factory? Security researcher Melissa Hathaway writes that finding a usable flaw took a skilled human about sixty days; the new models do it in about four hours. How often can your machines take a fix? In many plants the answer is the next planned shutdown — quarterly, or yearly. The attacker's clock runs in hours. Yours runs in years. This has happened before. In August twenty-eighteen a supplier delivered a new machine to TSMC, the world's largest chip maker, already infected. The worm reached more than ten thousand computers running the factory's tools — all Windows 7, none patched. Three sites stopped for a weekend, at a cost TSMC put near a hundred and seventy million dollars. Did the chief executive blame the supplier? No. He called it purely their own negligence, and said patching those machines needs downtime and the supplier's cooperation. So what did they change? Not the patching speed — they could not. They changed the fence: a rule, written with the standards body SEMI, for how a machine must arrive — scanned clean, on a supported operating system, on its own fenced-off part of the network — and in twenty-twenty-three wrote it into the purchase contracts. Is your fence written down that precisely? Most are not. Old machines with an open path from your office into your floor are the failure — and a model that finds flaws in four hours will find that path. Now, your FabSpeak Tip of the Week — a pen, one sheet of paper, ten minutes. Draw three boxes: your office network, the floor with its machines, and the buffer zone between them. Draw every way information moves. The nightly file transfer. The supplier's remote-support login. The service laptop. The USB stick carrying an update. Then count only the arrows that point INTO the floor. That number is your return-path count — every arrow is a door a fast attacker only has to find once. Take the sheet to your Monday meeting and ask which arrows are necessary. It is the same principle as the guard on a press: you rely on the guard, not on the operator's reflexes. You cannot patch a factory in four hours. You can decide how many doors it has. See you next week.