Skip to content
NewsModel release

OpenAI's GPT-6 Cyber model patched 948 Linux flaws and found 81 Firefox bugs

· by

The short version

OpenAI's new GPT-6 Cyber model generated patches for 948 Linux privilege-escalation bugs and found 81 previously unknown Firefox flaws, but stays locked to vetted Daybreak Red researchers.

OpenAI's GPT-6 Cyber model patched 948 Linux flaws and found 81 Firefox bugs

OpenAI's newest security model generated validated patches for 948 Linux privilege-escalation vulnerabilities in a single automated run, at an API cost of $1.2 million, and separately surfaced 81 previously unknown high-severity Firefox bugs, per OpenAI's own research writeup. The model that did the work, GPT-6 Cyber, ships only inside Daybreak Red, OpenAI's most restricted access tier for offensive-security researchers.

What happened

GPT-6 Cyber launched November 5, 2026, described as "a major step up" from its predecessor, GPT-5.6 Cyber, per OpenAI's launch post. The model scores 48.5% on ExploitGym, OpenAI's internal benchmark for exploiting a specified vulnerability, up from 32.1% for GPT-5.6 Cyber, a 51% relative jump. Under OpenAI's own Preparedness Framework, the new model is classified as "Critical" in cybersecurity, a step up from "High" for the prior version. A day earlier, a separate OpenAI research post described an autonomous discovery-and-patching pipeline that used the model to scan the Linux kernel and generate 948 validated local privilege-escalation exploits with proposed fixes, per that post. That same pipeline found 81 novel Firefox vulnerabilities; Mozilla has since shipped fixes for several of them, per OpenAI's launch post, which links to Mozilla's security advisory. None of this is available off the shelf, though: using GPT-6 Cyber itself requires approval into Daybreak Red, the highest tier of OpenAI's cybersecurity program, reserved for vetted offensive-security researchers conducting authorized testing.

Offense outpaces who gets to use the defense

The gating is the actual story for anyone trying to gauge how much this changes day-to-day security work. A hobbyist researcher named Max Justicz told TechCrunch he found a severe Ubuntu vulnerability, now tracked as CVE-2026-109518, using an older, more openly available model (GPT-5.6 Sol via Daybreak Blue) in about two hours, after spending roughly $5,000 total on subscriptions and tokens, per TechCrunch's reporting. He also said OpenAI appeared to have recently made Daybreak Blue less capable at finding vulnerabilities. That leaves a widening gap between what the most capable gated model can do (948 kernel exploits for $1.2 million) and what a motivated individual can already do with a cheaper, less restricted one. For security teams evaluating AI-assisted vulnerability research, the practical takeaway is that capability is arriving faster than broad access to the top-tier tools that would let most defenders keep pace, while open-weight models with stripped guardrails remain available to anyone willing to use them.

Context and reactions

The release came bundled with a $1 billion initiative, Daybreak for Frontline Defenders, meant to subsidize model access for resource-constrained teams such as government agencies and critical-infrastructure operators, per OpenAI's announcement. Eric Wallace, a researcher on OpenAI's technical staff, said the company is "allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities in open source codebases, fully pro bono," per TechCrunch. Only "thousands" of cybersecurity professionals currently participate in the Daybreak program overall, a figure TechCrunch's reporting frames against a far larger population of potential attackers. By comparison, the $1.2 million Linux run is notably cheaper than the roughly $6 million in tokens OpenAI has separately spent exploring a fluid-dynamics research problem, a contrast TechCrunch drew to illustrate how OpenAI is pricing this kind of compute-heavy research work.

What to watch next

Watch whether any of the 81 Firefox vulnerabilities receive formal CVE assignments beyond the fixes Mozilla has already shipped, and whether OpenAI publishes adoption numbers for Daybreak for Frontline Defenders now that the grant program is live alongside the new model.

Sources