OpenAI Unveils GPT-6 Cyber After Finding 81 Firefox Flaws

OpenAI has introduced GPT-6 Cyber, a specialist model designed to find, validate and help fix software vulnerabilities. In its 5 November announcement, the company says the model helped identify 81 previously unknown high-severity vulnerabilities in Firefox and develop working exploits for 948 Linux kernel flaws. These are OpenAI’s reported research results, not a claim that either product has 81 or 948 unpatched flaws on every device today.

The launch marks a change in how OpenAI is presenting advanced cybersecurity AI. GPT-6 Cyber is not being released to everyone. It is initially available through the API and Codex to a select group of approved Daybreak Red customers, with wider access to that approved group planned later. The company says its aim is to give authorised defenders more powerful tools while restricting misuse.

OpenAI says its researchers sent the Firefox findings to Mozilla with evidence and proposed patches. Mozilla has begun releasing fixes for many of them, according to the announcement. The 81 figure refers to novel issues Mozilla classified as high severity. OpenAI also says the model showed that 30 known Firefox issues were more severe than previously reported. That work still requires the browser maker’s own review and release process before users receive a fix.

The Linux figure needs equally careful reading. OpenAI says GPT-6 Cyber reproduced 1,724 vulnerabilities in a controlled research pipeline and developed working exploits for 948 distinct issues. The company has disclosed 304 critical findings to maintainers with candidate patches and says work on other fixes continues. TechBooky has covered the Linux research in detail. A working local privilege-escalation exploit requires an existing foothold on a system; it is not the same as a remote attack that can take over any Linux server.

On OpenAI’s ExploitGym benchmark, which tests exploitation of specified vulnerabilities, GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber. That is a substantial gain in the company’s evaluation, but a benchmark score does not establish how often the model will succeed in an unfamiliar production network. OpenAI also classifies the new model as Critical for cybersecurity capability under its Preparedness Framework, up from High for its predecessor.

OpenAI says it trained the model to respect the boundaries set by a security researcher. In one evaluation, it avoided exploiting out-of-scope services in 99.93% of tests without a deployment safety prompt and in all tests with that prompt. Those results come from a controlled test, not a guarantee that the model can never act outside an authorised scope. Human oversight and permission to test a target remain essential.

The company says Daybreak Red customers will have access to deeper exploit development and authorised testing, while Daybreak Blue is intended for defensive validation with fewer unnecessary refusals. It is also using monitoring, restrictions on access and IP allowlisting for Daybreak Red API use. OpenAI says it is working with critical-infrastructure defenders and has introduced additional checks around industrial systems where an attack could have physical consequences.

Security teams already struggle to turn reports into tested, distributed patches. A model that can find more real flaws could help maintainers, but it could also compress the time available to fix them if similar capabilities become available to attackers. The important measure is therefore not only how many vulnerabilities an AI finds. It is how quickly maintainers can confirm, repair and ship fixes, and whether organisations apply them.

For now, GPT-6 Cyber is a restricted security tool with striking vendor-reported results. Its real-world impact will be judged by validated disclosures, completed patches and whether OpenAI can broaden access to legitimate defenders without giving the same advantage to those seeking to exploit the flaws first.