OpenAI’s GPT-6 Cyber Finds Firefox and Linux Kernel Vulnerabilities

GPT-6 Cyber’s reported results point to a practical shift in security research: one model can help locate software flaws, demonstrate how they might be exploited, and suggest repairs. OpenAI says it found 81 previously unknown severe vulnerabilities in Firefox and produced working exploits for 948 Linux kernel vulnerabilities. The figures are substantial, but they come from OpenAI; no independent assessment of the model’s benchmark results has been published.

The central question for security teams is how to make use of that capability while keeping it inside authorized systems. OpenAI says the model was trained to follow operational boundaries, and reports improved results in its own safety tests. Those results describe performance under the company’s test conditions; they don’t establish how the model will behave in every deployment.

Benchmarks show gains, with limited independent evidence

On ExploitGym, which tests whether a model can exploit a vulnerability in a remote system, GPT-6 Cyber scored 48.5 percent. OpenAI compares that with 32.1 percent for GPT-5.6 Cyber. On a separate test that asks models to find flaws in web applications without source code, GPT-6 Cyber recorded a 40.3 percent hit rate, compared with 32.0 percent for GPT-6 Astra, the standard model without cyber training.

The 0.0 percent result for GPT-6 Astra with safeguards enabled illustrates a tradeoff in this particular benchmark: safeguards can restrict a model’s ability to carry out the tested exploit task. That figure doesn’t show how the safeguard performs across other tasks or deployments. OpenAI’s full results are in its system card, but outside researchers have not yet published independent tests. That makes the numbers useful as a first account of the model’s performance, rather than a settled comparison.

OpenAI also tested whether GPT-6 Cyber stayed within its assigned boundaries. Without special safety instructions, the company says it did so in 99.93 percent of cases, up from 94.49 percent for GPT-5.6 Cyber. With safety instructions enabled, OpenAI reports a 100 percent success rate. The company says it trained the model using a honeypot inspired by a previous sandbox incident. In its own Preparedness Framework, OpenAI assigns GPT-6 Cyber a “Critical” cybersecurity rating, matching the rating it gave to GPT-6 Astra, its base model.

Firefox and Linux tests suggest a wider research role

In work with Mozilla, GPT-6 Cyber identified 81 previously unknown severe Firefox vulnerabilities, according to OpenAI. The browser had already been examined with earlier AI models. The new system also flagged 30 known issues as more serious than previously understood. Mozilla accepted the reports and has shipped fixes.

The Linux kernel exercise was larger and more automated. OpenAI says GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 of them. Under the same conditions, GPT-5.6 Sol produced 166 working exploits. OpenAI says it reported 304 critical findings, together with suggested fixes, to Linux maintainers.

For the kernel study, OpenAI assembled scout and analyst agents to screen roughly 5,034 security-relevant locations, about seven percent of the codebase. The process narrowed those locations to 2,308 candidates, then confirmed 1,724 vulnerabilities in isolated virtual machines. From that set, the system developed its 948 working exploits. OpenAI reports a total compute cost of $1,213,430, or $1,279 per exploit. For comparison, the article cites historical bounties of $20,000 to $70,000 for comparable findings through programs such as Pwn2Own and TyphoonPWN. These figures reflect different ways of assigning costs and value, so they don’t by themselves show what a full security program would cost.

OpenAI also says the agents used at least ten attack techniques that external kernel security experts had not previously identified. The company describes the system as both reproducing known patterns and finding new approaches. How to interpret that claim remains an open research question: a system can combine learned patterns in ways that are useful to researchers, while the boundary between recombination and discovery is still debated. An ongoing debate among researchers concerns precisely how to assess that kind of contribution.

Access and operating controls shape adoption

OpenAI says GPT-6 Cyber is initially available through its API and Codex to selected Daybreak Red customers, with wider access planned for that customer group over time. GPT-5.6 Cyber is opening to all Daybreak Red users, while alpha access to GPT-6 Astra is expanding to more organizations and individual security researchers. The company has not described broad, unrestricted access to GPT-6 Cyber.

OpenAI points to several controls for customers: checks that compare model actions with a user’s permissions, monitoring focused on newly disclosed vulnerabilities, automated safeguards it calls Private Safety Processing, and IP-based access restrictions for Daybreak Red. It also recommends running the model in isolated environments under human oversight. For security teams, those measures matter because a system that can produce working exploits needs clear limits on which targets it can examine and what it can do with the results.

The company says it is giving special attention to critical infrastructure, including power plants and water treatment facilities. It points to its Daybreak for Frontline Defenders program and a subgroup called Daybreak Red for Critical Infrastructure, intended for authorized testing.

OpenAI’s stated aim is to extend the program to organizations of different sizes, independent researchers, and open-source maintainers. Broader access could help more defenders find and fix flaws, though it also raises the stakes for permissions, isolation, and oversight. An Epoch AI study of an open-weight GLM model reported exploit chains against known, unpatched Firefox vulnerabilities, underscoring that offensive capability isn’t confined to a single restricted service. For GPT-6 Cyber, the next useful evidence will be independent testing and a clearer account of how its results hold up across software, operating conditions, and real security workflows.