On November 5, 2026, OpenAI announced GPT-6 Cyber, a restricted security model that, according to OpenAI’s own reporting, built working privilege-escalation exploits for 948 Linux kernel vulnerabilities and found 81 previously unknown high-severity Firefox flaws. Dr. Alex Wissner-Gross flagged it in The Innermost Loop on November 6 with a line worth reading twice: with unpatched accounts now functionally root, “the winning move is patching at machine speed.”
The short answer for business owners: patch management is no longer just an IT chore. Under Illinois law, the FTC Safeguards Rule and HIPAA, it is the evidence of whether your security was “reasonable.” And the bar just moved.
What GPT-6 Cyber Means for Business
A software patch closes a known hole. Patch management is the process of finding which systems need the fix, testing it and installing it on a schedule. For most small and mid-sized businesses, that schedule has been “when the IT vendor gets to it.”
GPT-6 Cyber shows why that is getting riskier. CSO Online reports the model produced exploits for 948 kernel flaws, 588 of them previously unknown, and that OpenAI rates it “Critical” for cybersecurity under its Preparedness Framework. The Innermost Loop puts the cost of its autonomous pipeline at roughly $1,279 per root exploit.
Two caveats matter. First, access is limited to a select group of approved security customers today. Second, OpenAI built it for defenders: it helped write patches, and Mozilla has already shipped fixes. The concern is what happens when attackers have similar tools. OpenAI itself says defenders have a limited window. CSO also quotes a security executive noting a remediation rate under 25% on OpenAI’s own tracking dashboard so far. Finding bugs is getting cheap. Fixing them is still slow.
For business owners, that gap between “the fix exists” and “the fix is installed” is where patch management liability lives.
The Legal Impact of Patch Management Failures
1. Illinois requires “reasonable security,” and the yardstick moves
Illinois’ Personal Information Protection Act says any business that holds Illinois residents’ personal information “shall implement and maintain reasonable security measures” to protect it (815 ILCS 530/45(a)). A violation is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act (Section 20). The statute does not define “reasonable.” Our view, and it is a judgment call rather than settled law: reasonableness is measured against the threats a business knew or should have known about. When exploits for known bugs get cheaper and faster, a months-long patch backlog gets harder to defend after a breach.
2. The FTC Safeguards Rule sets hard testing intervals
Many businesses do not realize they are “financial institutions” under the Safeguards Rule. The definition expressly includes tax preparers, mortgage brokers and auto dealers that lease vehicles. Covered businesses must run continuous monitoring, or else annual penetration testing plus vulnerability assessments “at least every six months” (16 CFR 314.4(d)(2)). They must also require service providers “by contract” to maintain safeguards (314.4(f)(2)), and notify the FTC within 30 days of a breach involving 500 or more consumers (314.4(j)). Firms holding data on fewer than 5,000 consumers are exempt from the testing paragraph (314.6), but not from the rest.
3. HIPAA already requires it, and a patch management rule is pending
Dental practices, med spas, clinics and their vendors must conduct “an accurate and thorough assessment of the potential risks and vulnerabilities” to patient data and reduce them “to a reasonable and appropriate level” (45 CFR 164.308(a)(1)(ii)). HHS has also proposed a stand-alone patch management standard. That rule is not final, and HHS’s regulatory agenda now targets July 2027, per Davis Wright Tremaine. See our earlier look at AI and HIPAA rules for patient records.
4. Your IT vendor contract probably says nothing useful
Illinois law requires that any contract disclosing personal information to another party include a clause requiring “reasonable security measures” (815 ILCS 530/45(b)). Check what yours actually says. Form managed-service agreements commonly promise only “commercially reasonable efforts,” with no patch management timeline, no breach-notice deadline and a liability cap tied to a few months of fees. Terms like that were written for a slower threat environment.
5. Insurance and deal diligence will ask for proof
Cyber insurance applications often ask about patch management practices, and an inaccurate answer can give the carrier a coverage argument. (See AI exclusions in business insurance.) In acquisitions, a careful buyer asks for patch logs and a list of end-of-life systems, and gaps can turn into special representations, escrows or price cuts. That is true in dental practice M&A as much as anywhere.
What Howard East Clients Should Do Now
- Know what you run. Get a written inventory of every server, laptop, cloud app and device that touches customer or patient data.
- Write a patch management policy with deadlines. Tie timelines to severity. CISA “strongly recommends all organizations” monitor its Known Exploited Vulnerabilities catalog and prioritize those fixes.
- Pull your IT and software contracts. Add patch SLAs, breach notice within a set number of hours, audit rights and a carve-out from the liability cap for security failures.
- Calendar the Safeguards tests if you are covered, and keep the reports.
- Reread your cyber insurance application and confirm your answers are still true.
- Update your incident plan with Illinois, FTC and HIPAA notice deadlines. Our AI ransomware attack guide covers the legal risks after an incident.
Call a lawyer before you sign or renew an IT services agreement, before a sale or acquisition, and immediately if you suspect a breach. Notice clocks can start at discovery.
Talk to Howard East About Cybersecurity Compliance
Howard East reviews vendor contracts, writes security policies that match your regulators, and handles cyber diligence in deals. Learn about our AI and data privacy practice or book a consultation to put your patch management program on paper before someone else tests it.
This article is for informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship.
