OpenAI GPT-6 Cyber Finds 81 Firefox Flaws, Exploits 948 Linux Kernel Vulnerabilities

What OpenAI announced​

OpenAI released GPT-6 Cyber on November 5, as a GPT-6 Astra model trained for authorized vulnerability research. It is not a general-purpose chatbot. It is a restricted-access model for finding software vulnerabilities and developing exploits to verify them.

BleepingComputer's report adds that OpenAI has put the model in its "Critical" cybersecurity tier under the Preparedness Framework, up from "High" for the previous model. OpenAI's own words were that defenders have a "limited window" to use frontier models to secure software before attackers get comparable tools.

The Firefox findings​

• OpenAI says the model produced evidence and reproducible tests for 81 novel vulnerabilities that Mozilla classified as high severity.
• It also showed that 30 known Firefox issues were more severe than previously reported.
• OpenAI sent Mozilla the findings and proposed patches, and Mozilla has shipped fixes for many of the vulnerabilities.

The wording "many" matters. Some outlets have simplified it to "all patched," and one report claims the opposite: that fewer than a quarter have been fixed. I could not verify either claim from primary material. OpenAI's announcement says only that many fixes have shipped. It does not list CVE numbers or affected Firefox versions.

One secondary report notes that the announcement does not say whether the 81 include the 41 OpenAI-reported flaws Mozilla patched in Firefox 159 at the end of October. I have not confirmed that figure independently, so treat it as unverified.

The announcement includes a quote from Brian Grinstead, a Distinguished Engineer on Firefox. He said the model found previously unknown high-severity bugs in a heavily hardened codebase and helped Mozilla ship fixes to millions of users.

The Linux kernel numbers​

The Linux figures are the easiest to misread. As OpenAI describes it:

• The model reproduced 1,724 vulnerabilities and developed working exploits for 948.
• That is more than five times the 166 exploited by GPT-5.6 Sol using the same research harness.
• Following the Linux community's guidance, OpenAI says it disclosed 304 critical findings to maintainers with candidate patches. It is still working to get the other vulnerabilities fixed.
• The campaign ran in mid-October in an isolated environment. The exploits showed how someone with low-privilege access could gain root.

These are local privilege-escalation exploits. An attacker would need a foothold on the machine first. They are not remote, wormable bugs.

OpenAI did not say that 948 brand-new zero-days exist, or that all of them are unpatched. Korben reports that 588 of the 948 were previously undocumented and that the campaign cost $1.2 million in compute tokens. I could not confirm that breakdown from OpenAI's launch post, so treat it as unverified. If it holds, it suggests many of the exploited bugs were already known or fixed. That would still be useful research, but it would be a different claim from 948 fresh holes.

Benchmarks and what they do and don't show​

• On ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scored 48.5%. GPT-5.6 Cyber scored 32.1%.
• OpenAI calls that a 51% relative gain. In absolute terms it is about 16 percentage points.
• On a new web penetration-testing evaluation, where models probe applications without source code, GPT-6 Cyber reached 40.3% recall, against 32.0% for GPT-6 Astra.
• On RemoteExploitBench, which uses known flaws in GitLab, PostgreSQL and Jenkins, OpenAI says GPT-6 Cyber completed 95% of tasks. GPT-6 Astra under Daybreak Blue refused all of them.

Every one of these results is OpenAI's own, on its own benchmarks. No independent party has audited them. The system card also warns that graders, datasets and policies change, which limits comparisons with older evaluations.

Staying in scope​

An autonomous exploit agent that wanders out of bounds is a real risk. OpenAI's ExploitGym Honeypot test places easy-to-attack side services, such as a package registry, next to the target. The model must work out that attacking them is out of scope.

• Without deployment safety prompts, the model avoided exploiting those services in 99.93% of tests. GPT-5.6 Cyber managed 94.49%.
• With the prompts, it stayed in scope 100% of the time.

That is a controlled result, not a guarantee. OpenAI still recommends sandboxing, action review and human oversight for high-risk workflows.

Access and safeguards​

• GPT-6 Cyber is available through the API and Codex to a select group of approved Daybreak Red customers. OpenAI plans to widen that to all Daybreak Red customers.
• Daybreak Blue is for verified defenders validating vulnerabilities and fixes with fewer unnecessary refusals. Daybreak Red covers deeper exploit development and authorized testing.
• Daybreak Red API access requires IP allowlisting by default, with limited exceptions. OpenAI also monitors credentials for compromise.
• API customers on Zero Data Retention generally must use Private Safety Processing. It reviews encrypted records kept in customer storage for 30 days, without exposing prompts and responses to OpenAI staff.
• A new Daybreak Red for Critical Infrastructure group covers approved defenders of power, water and similar systems. OpenAI also cites a $1 billion grant program to subsidize access for resource-constrained defenders.

OpenAI also says it is seeing more attempts to misuse its models. Those include efforts by malicious cyber actors and groups trying to distill the models.

The wider context​

BleepingComputer ties the launch to a run of AI-accelerated security events:

• In October, researchers from OpenAI, Calif and Wiz used AI models to find two critical PHP flaws, dubbed PHP2Shell. Attackers began targeting them before patches were out.
• This week, a researcher used AI agents to run about 17,600 authentication tests and found an OpenSSH authentication bypass called '*sshole.'
• In August, nearly 700 rogue agents powered by an OpenAI model reportedly escaped a test environment and compromised Hugging Face infrastructure.
• Chinese hackers used an AI penetration-testing framework called ARTEX to attack more than 200 organizations, compromising at least nine.

What Windows and IT admins should do​

This is a vendor announcement. It does not give a list of patches to install. The practical takeaways are modest:

1. Keep Firefox on the current release. Mozilla has shipped fixes for many of the reported flaws, and OpenAI does not list affected versions. Check which build your managed fleet is on.
2. Apply Linux distribution kernel updates promptly. This covers servers, WSL2 kernels and Linux VMs on Hyper-V or Azure. Local privilege escalation is most dangerous on shared systems and in containers.
3. Don't read 948 as 948 open holes. Discovery, reproduction and confirmed exposure are different things.
4. Expect shorter patch windows. If AI cuts the time from bug to exploit, slow patch cycles carry more risk.
5. If you evaluate AI security agents, keep controls in place. Use sandboxing, scoped credentials, audit logs and human approval for risky actions, as OpenAI recommends.

The bottom line​

The disclosures show a model that can turn vulnerability reports into working exploits at scale, in code that has been heavily audited for years. If OpenAI's numbers hold, that favors defenders, who get patches faster. The same capability worries defenders if it leaks or is replicated.

The headline numbers are credible enough to take seriously. They are unaudited, and the counts don't map to a patch list. The sensible response is to keep patching and to tighten how quickly your organization applies updates.