OpenAI has released GPT-6 Cyber, a restricted cybersecurity model that it says produced working local privilege-escalation exploits for 948 Linux kernel vulnerabilities and helped identify 81 previously unknown high-severity Firefox flaws.
The figures are striking, but they describe two different research campaigns and should not be read as 1,029 newly discovered zero-days. The Linux work combined vulnerability discovery, reproduction and exploit development against a recent kernel snapshot; the Firefox figure refers to novel vulnerabilities that Mozilla classified as high severity. OpenAI disclosed the findings to the relevant maintainers before publishing its results.
The model is available through Daybreak Red, OpenAI’s controlled program for advanced vulnerability research and authorized penetration testing. Access requires identity verification and organizational controls including single sign-on, multifactor authentication and API IP allowlisting.
What the 948 Linux exploits actually represent
OpenAI’s Linux pipeline first examined kernel code for potential vulnerability patterns, reproduced candidates inside virtual machines and then asked agents to turn validated bugs into working exploits. In its technical report, the company says the system analyzed 2,308 potential vulnerabilities, reproduced 1,724 and developed 948 local privilege-escalation exploits.
Those exploits showed that an unprivileged local user could potentially obtain root access under the test conditions. They were not 948 remote compromises, and the total does not establish that every issue was a previously unknown flaw. The campaign included rediscovery and validation work, while the kernel was also changing underneath the researchers.
The scan used the latest Linux kernel master branch available in mid-October 2026 and ran for 10 days. By the time OpenAI finished autonomous scanning and manual review, 61 issues had already been fixed upstream, 43 had patches in staging and 299 were being reported or discussed publicly. OpenAI says it disclosed 304 critical findings to maintainers with candidate patches.
That fast-moving patch state is one reason the raw exploit count needs context. Automated research systems must continually retest findings against current code or they can send maintainers duplicate reports for bugs that were fixed while the scan was still running.
The campaign cost $1.21 million
The Linux run cost $1,213,430 in API credits. A July campaign using GPT-5.6 Sol and the same research harness produced 166 exploits for $513,690. The newer model therefore generated more than five times as many working exploits for a little over twice the compute cost, according to OpenAI’s figures.
Researchers manually examined a sample of 166 exploits and identified 10 techniques they and outside kernel experts considered new. Those included unfamiliar kernel-heap spraying and page-grooming approaches, data-only privilege-escalation techniques and a type-confusion method. OpenAI withheld the operational details while patches and disclosures remain in progress.
A separate test against Google’s hardened kernelCTF environment produced 21 local privilege-escalation exploits and 25 information-leak proofs of concept over 112 hours, at a reported cost of $32,936. OpenAI could not use one kernelCTF mitigation because it was incompatible with the current kernel version, so the result is not directly comparable with accepted competition submissions.
Firefox 159 carries many of the browser fixes
The Firefox campaign has a clearer novelty claim. OpenAI reports that GPT-6 Cyber produced reproducible evidence for 81 previously unknown vulnerabilities that Mozilla rated high severity, while also showing that 30 known issues were more serious than first assessed.
Mozilla’s Firefox 159 security advisory, announced October 27, lists a large set of individual high-impact flaws across the browser. The affected components include the JavaScript engine, DOM, layout, graphics, networking, WebRTC, storage, SVG and audio-video code. Several entries credit OpenAI researchers or “OpenAI Codex Security,” alongside Mozilla engineers and other reporters.
The advisory includes use-after-free bugs, sandbox escapes, privilege-escalation paths, same-origin policy bypasses, invalid-pointer issues and boundary-condition errors. Firefox users should move to version 159 or a later supported release rather than trying to map their risk to a single CVE. Organizations on Firefox ESR should follow Mozilla’s corresponding ESR advisories and their normal managed-update process.
GPT-6 Cyber is stronger, but not infallible
OpenAI classifies GPT-6 Cyber as “Critical” for cybersecurity capability under its Preparedness Framework. On ExploitGym, which tests whether a model can develop an exploit for a specified vulnerability, it scored 48.5%, compared with 32.1% for GPT-5.6 Cyber. On a black-box web penetration test, it found 40.3% of vulnerabilities, versus 32% for GPT-6 Astra.
The model is also trained to stay inside an authorized target. In a honeypot evaluation, it attacked an out-of-scope supporting service in 0.07% of tests without deployment safety instructions and 0% with those instructions. That is a major improvement over earlier cyber models, but it is not a guarantee that an autonomous agent will always interpret warnings, scope or authorization correctly.
The system card identifies several remaining weaknesses. GPT-6 Cyber stopped when warnings warranted it in 73% of one evaluation, below GPT-6 Astra’s 78.38%. It was also more likely than Astra to omit a previously disclosed blocker from its final response. Those shortcomings matter when a model can run long investigations, operate tools and develop working exploits.
What security teams should take from the results
The immediate lesson is not that every Linux system faces 948 fresh emergency patches. It is that exploit development is becoming cheap enough to apply repeatedly to mature, heavily audited codebases. A code review that looked thorough against last year’s models may need to be rerun as capability improves.
Defenders considering similar workflows need more than a powerful model. They need isolated test infrastructure, explicit target definitions, credentials that cannot reach unrelated systems, complete tool-call logging, human review before disclosure, and a process for checking findings against the newest upstream code. Vulnerability reports also need reproducible tests and minimal, maintainable patches; a large untriaged queue can slow an open-source project instead of helping it.
For end users, the practical action is simpler: update Firefox and keep Linux distribution security updates current. The detailed Linux findings are still moving through upstream review and downstream distribution pipelines, so installing supported vendor kernels is more useful than chasing the campaign’s headline number.
GPT-6 Cyber shows that AI agents can now do more than flag suspicious code. They can reproduce bugs, construct exploit chains and propose fixes at a scale that changes the economics of vulnerability research. The same result also explains why OpenAI has put the model behind a restricted access program rather than a general public API.
