OpenAI's GPT-6 Cyber Found 948 Linux Exploits and 81 Firefox Flaws
The security model earned OpenAI's highest cyber rating. For now, only a small group of vetted security teams can use it.
OpenAI has released a new AI model built to hunt for software flaws. The company says GPT-6 Cyber found 948 working exploits in the Linux kernel and 81 previously unknown flaws in Firefox.
The model went out Thursday to a small group of approved security teams. OpenAI rated it “Critical” for cybersecurity, the highest level in its safety framework. It is the first OpenAI model to reach that level.
OpenAI pointed the model at the latest Linux kernel code and let it run an automated pipeline. The pipeline reproduced 1,724 known vulnerabilities and turned 948 of them into working exploits that let an unprivileged user gain root access in a test environment. Of those, 588 had not been found before. OpenAI says it sent 304 of the most serious findings, with proposed patches, to Linux maintainers.
The model also turned up 81 flaws in Firefox that no one knew about. Mozilla rated all of them high severity and has started shipping fixes. In a separate case, the model found a critical flaw in Brotli, a compression library used across the web. That flaw, tracked as CVE-2026-111497, scored 9.2 out of 10 for severity.
On ExploitGym, a test of whether a model can turn a known flaw into a working exploit, GPT-6 Cyber scored 48.5 percent. The previous security model, GPT-5.6 Cyber, scored 32.1 percent. OpenAI also says the new model stayed inside the bounds of its assigned task in 99.93 percent of cases, up from 94.49 percent for its predecessor.
Access runs through Daybreak Red, OpenAI’s program for authorized offensive security work. Customers need identity checks and approval, and their API requests must come from approved networks. OpenAI says the limits are there because the same skills that find flaws fast can also be used to attack systems.
Every number in the release comes from OpenAI’s own testing. No outside lab has independently checked the kernel run or the benchmark scores.
The release comes the same week independent researchers at METR reported that Anthropic’s AI development is now running at about twice its earlier pace, with AI assistance inside the research process doing much of the work.
.jpg?width=1200)
