GPT-6 Cyber found 81 unknown Firefox flaws and 948 kernel exploits

OpenAI's new GPT-6 Cyber model found 81 previously unknown critical vulnerabilities in Firefox and built working exploits for 948 Linux kernel flaws, the company announced. In the kernel campaign, that exploit count is more than five times what its predecessor managed under the same conditions. All numbers come from OpenAI itself; no independent testing has been published so far.

The release matters because it puts exploit development on a cost curve. OpenAI says the entire kernel run cost $1,213,430 in compute — about $1,279 per exploit. Programs like Pwn2Own and TyphoonPWN have historically paid between $20,000 and $70,000 for comparable findings. If the figures hold up, automated vulnerability research is now an order of magnitude cheaper than the human-driven market rate.

What can GPT-6 Cyber actually do?

OpenAI describes GPT-6 Cyber as a model trained specifically to hunt for security vulnerabilities in software. It can find flaws, build working exploits, and suggest patches. The company also says the model stays within its assigned operational boundaries — a pointed claim, since some OpenAI models have struggled with exactly that in recent months.

To train that discipline, OpenAI used a honeypot inspired by the Hugging Face incident. The results: without any special safety instructions, GPT-6 Cyber avoided boundary violations in 99.93 percent of cases, up from 94.49 percent for its predecessor. With safety instructions enabled, the model stayed within bounds in 100 percent of tests. OpenAI rates GPT-6 Cyber as "Critical" in the cybersecurity category of its own Preparedness Framework — the same rating it gave GPT-6 Astra, the base model.

The takeaway: the model is rated as genuinely dangerous in the wrong hands, and OpenAI is betting on training-time guardrails plus access controls to contain that risk.

How strong are the benchmark numbers?

On ExploitGym, a benchmark that tests whether a model can exploit a given vulnerability in a remote system, GPT-6 Cyber scores 48.5 percent, according to OpenAI. Its predecessor, GPT-5.6 Cyber, scored 32.1 percent.

On a new test for finding vulnerabilities in web apps without access to source code, OpenAI reports a hit rate of 40.3 percent — compared to 32.0 percent for GPT-6 Astra, the standard model without cyber training. Full results are in the system card, but the caveat bears repeating: every number is self-reported. The gap between 48.5 percent and 100 percent also means the model still fails at exploitation more often than it succeeds.

How did the Firefox and Linux campaigns work?

In a targeted Firefox campaign, GPT-6 Cyber found 81 previously unknown severe vulnerabilities — in a browser that had already been tested with earlier AI models. The model also showed that 30 already-known issues were more severe than previously thought. Mozilla accepted the reports and has already shipped fixes.

The Linux kernel campaign ran on a dedicated automated system of scout and analyst agents that OpenAI built for the job. The pipeline worked in stages:

• The agents first scanned roughly 5,034 security-relevant locations in the kernel, about seven percent of the total codebase.
• They filtered those down to 2,308 candidates.
• They confirmed 1,724 vulnerabilities in isolated virtual machines.
• The system then developed 948 working exploits.
• OpenAI reported 304 critical findings to Linux maintainers, along with suggested fixes.

For comparison, GPT-5.6 Sol managed 166 exploits under the same conditions. The agents also used at least ten novel attack techniques that were previously unknown even to external kernel security experts, OpenAI says.

That novelty claim deserves scrutiny. OpenAI's telling is that the models replicated known attack patterns but also found their own approaches. How much weight that carries depends on how narrowly you define "own approaches" — researchers still disagree about whether AI models can make genuinely new discoveries or just recombine what they've seen during training.

Who gets access — and what stops abuse?

GPT-6 Cyber is initially available through the API and Codex to a select group of Daybreak Red customers, with access expanding gradually to all Daybreak Red customers. Two other doors open at the same time: GPT-5.6 Cyber goes to all Daybreak Red users, and alpha access to Daybreak Blue for GPT-6 Astra extends to more organizations and individual security researchers.

OpenAI acknowledges that abuse attempts are rising as models grow more capable, and says some actors and groups have tried to transfer model capabilities into their own systems. Its countermeasures include:

• Checks that verify whether a model's actions match the user's permissions
• Targeted monitoring around newly disclosed vulnerabilities
• Automated safety checks through what OpenAI calls Private Safety Processing
• IP-based access restrictions for Daybreak Red
• The recommendation to run the model in isolated environments with human oversight

Why is OpenAI worried about critical infrastructure?

The company pays special attention to protecting critical infrastructure like power plants and water treatment facilities. To make the model useful for defenders rather than attackers, OpenAI points to its billion-dollar "Daybreak for Frontline Defenders" funding program and a new subgroup called "Daybreak Red for Critical Infrastructure" for authorized testing.

The strategic framing is explicit: OpenAI talks about a limited window of opportunity in which top-tier models could be used to secure software before adversaries catch up. The goal is to expand Daybreak to organizations of all sizes, independent researchers, and open-source maintainers.

Whether that window logic holds is an open question. Researchers from Epoch AI recently showed that the open GLM model could have exploited known but still-unpatched Firefox vulnerabilities — meaning capable offensive models are already escaping the lab, whether or not OpenAI's rollout goes as planned.