Fortinet Credits OpenAI, Anthropic as It Patches 5 Products

Fortinet says its new releases for FortiOS, FortiManager and FortiAnalyzer, which followed releases for FortiMail and FortiAuthenticator, fix vulnerabilities found through its frontier AI-assisted security testing, according to a post by chief information security officer Carl Windsor published on 21 October 2026. “Fortinet would like to thank Anthropic, OpenAI, Google, and SpaceX for their collaboration throughout this process,” the post says. Fortinet says public advisories come on 10 November.

In plain words, Fortinet is shipping the fixes now and publishing the details 19 days later, by our arithmetic from 22 October to 10 November. It urges customers to upgrade quickly because comparing an old and a new software version can show where a weakness was, and it says AI tools now make that comparison, called patch diffing, much faster.

Business Pill · RED TEAMING

A short Business Engineer explainer on red teaming: attacking your own system before someone else does. It teaches the general idea only and says nothing about Fortinet.

What Fortinet Released

• Five product lines. FortiOS, FortiManager and FortiAnalyzer updates were set for 22 October, “following recent releases from FortiMail and FortiAuthenticator,” Fortinet said.
• The severity. “These releases include critical and high-severity fixes,” according to the post. The post gives no CVE numbers or scores; it says advisories come “at the next Patch Tuesday on November 10” on its PSIRT page.
• The ask. “We strongly urge every customer to plan and promptly complete these upgrades as soon as the releases are available, prioritizing internet-facing devices,” the post says. It asks customers to treat the release “as a priority change rather than a routine maintenance cycle.”

Source: Fortinet, “Fortinet Releases Security Hardening Release for Multiple Products”, CISO Collective post by CISO Carl Windsor, published 21 October 2026. By our count the tables list 18 affected release branches across five product lines. Fortinet lists FortiMail and FortiAuthenticator as available “Today”, the post date, and the other three on 22 October.

Why Fortinet Says Upgrade Now

Fortinet gives four reasons to treat the upgrade as urgent. “AI tools can now help adversaries reverse-engineer patches and build working exploits in hours or days, rather than weeks,” the post says. It adds that “the fixes themselves reveal where changes were made,” and that “AI has the ability to link seemingly unrelated lower severity vulnerabilities together to achieve a more severe, exploitable vulnerability.”

For customers who cannot upgrade at once, Fortinet recommends temporary steps. They include managing devices out of band, moving resources behind VPN or SASE where feasible and restricting administrative interfaces to trusted IP addresses. It also advises keeping FortiManager administration off the internet and enforcing multi-factor authentication for administrators. “These steps reduce risk but do not replace the need for a timely upgrade,” it says.

On the advisories, Fortinet says they will be published on 10 November “as part of Fortinet’s ongoing commitment to responsible transparency while balancing customer security.”

Fortinet also wrote that “the same class of AI capability is becoming available to attackers, particularly as open weight models improve,” and that “the window between disclosure and exploitation continues to shrink.”

How Fortinet Tests With Frontier Models

In an earlier post, published on 30 June 2026, Fortinet said it was collaborating with several vendors on frontier models, “including Anthropic’s Glasswing (Mythos) and OpenAI’s Daybreak (GPT 5.5 Cyber) projects.” It said it had conducted “over 100 tests of 30 distinct product families” on source code, and that its security analysts manually review every finding “to validate it before accepting a false positive classification.”

The same post said the models “are incredibly adept at analyzing firmware, assessing changes between versions, and developing proof-of-concept exploits for known, remediated vulnerabilities.” Fortinet’s 21 October post makes the same point about released patches when it urges a quick upgrade.

This Week’s AI-Credited Fixes

Fortinet joins several projects that credited frontier AI for security fixes this week. The table puts them side by side, using each source’s own words.

Sources: the primaries named in each row, as reported in our earlier pieces linked below. Severity wording is each source’s own; we have not rated anything.

Connecting the Coverage

Our first PHP piece reported that Wiz said AI models, including Google’s Gemini 4 Argon, helped its researchers find two critical flaws in PHP, which released fixes on 21 October 2026. Our follow-up reported that, per CNBC, OpenAI said researchers working with its models had helped uncover the vulnerabilities, and that VirusTotal counted about 758,000 internet-facing servers on end-of-life PHP branches; its 23 October Update added the Node.js advisory crediting OpenAI Codex Security.

Our Claude piece reported that Anthropic says Claude flagged 493 issues across 25 open-source projects. Our formal-verification piece reported that Theorem’s cost model puts AI-written proofs at about $40 per kilobyte of machine code. What’s new: a commercial security vendor thanks four companies by name for their collaboration on AI-assisted testing of its own products, and cites AI-assisted patch diffing as a reason to upgrade fast.

The Structural Read

As we read it, the finding side has moved to frontier models: Fortinet says they analyze code paths, protocol handling and configuration logic “at a depth and speed that traditional fuzzing and manual review cannot match.”

As we read it, the same capability works on the other side: Fortinet writes that it “is becoming available to attackers, particularly as open weight models improve,” and that the window between disclosure and exploitation continues to shrink.

As we read it, access to these models is itself a gate: Fortinet names Anthropic’s Glasswing (Mythos) and OpenAI’s Daybreak (GPT 5.5 Cyber) projects, programmes run by the labs, and thanks four companies by name for their collaboration.

Three Implications

FOR FORTINET CUSTOMERS Fortinet asks them to treat the release “as a priority change rather than a routine maintenance cycle,” prioritizing internet-facing devices.

FOR OTHER SOFTWARE VENDORS Fortinet’s four urgency factors, from faster weaponization to patch diffing and chaining of lower-severity flaws, describe a disclosure problem any vendor shipping fixes faces, by its account.

FOR THE AI LABS Fortinet thanks Anthropic, OpenAI, Google and SpaceX by name, so the labs’ cyber programmes now show up in a vendor’s own release notes.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The framework says: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”

As we read it, Fortinet’s posts show that layer at work in security: access to the labs’ cyber-capable models runs through named programmes, and a vendor credits the labs in its own release. The framework was published in June 2026 and does not discuss Fortinet.

What Is Not Established

The 21 October post does not give CVE identifiers, scores, the number of vulnerabilities or which lab’s model found which flaw; it says advisories come on 10 November. The post does not say whether any of these flaws has been exploited. The 18-branch count and 19-day gap are our arithmetic on Fortinet’s tables and dates. We did not contact Fortinet or the AI labs. Nothing here is investment advice.

The Bottom Line

Fortinet says its releases across five product lines fix vulnerabilities found through frontier AI-assisted testing and include critical and high-severity fixes, and it thanks Anthropic, OpenAI, Google and SpaceX for their collaboration. It urges a fast upgrade because, by its account, AI can help turn a published fix into a working exploit in hours or days, and it says public advisories come on 10 November.