"It is clear that we have a limited window to use frontier models to secure software," OpenAI said.
GPT-6 Cyber uncovered 81 high-severity Firefox bugs and helped patch them
OpenAI announced a new model, GPT-6 Cyber, that discovered 81 previously unknown high-severity vulnerabilities in Firefox during security testing. The company said the model not only identified flaws but also helped develop patches; many of those fixes have already been released by Mozilla. The disclosure frames GPT-6 Cyber as a tool that can accelerate both vulnerability discovery and remediation for widely deployed software.
Large-scale Linux kernel findings: 2,308 candidates, 1,724 reproduced, 948 exploits
In separate research focused on the Linux kernel, GPT-6 Cyber identified 2,308 potential security flaws. The model successfully reproduced 1,724 of those vulnerabilities and developed local privilege escalation exploits for 948 distinct vulnerabilities. OpenAI described those exploits as capable of allowing an unprivileged user to gain root access. The results point to a dramatic increase in the rate and scope of automated vulnerability reproduction and exploit generation.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogBenchmarks, classification, and access controls
On benchmark testing, GPT-6 Cyber successfully exploited 48.5% of vulnerabilities in ExploitGym, compared with 32.1% for GPT-5.6 Cyber. OpenAI has classified GPT-6 Cyber as having "Critical" cybersecurity capabilities under its Preparedness Framework, an escalation from the "High" classification applied to the previous model. The new model is not publicly available: access is currently limited to a select group of approved customers in OpenAI's Daybreak Red, with plans to expand access to all Daybreak Red customers soon.
Daybreak Red, Daybreak Blue, and planned program expansion
OpenAI described two separate program tracks. Daybreak Red supports advanced exploit development and authorized security testing; access to GPT-6 Cyber is currently restricted to a select set of Daybreak Red customers. By contrast, Daybreak Blue allows verified defenders to investigate vulnerabilities and validate fixes with fewer restrictions. OpenAI also said it plans to expand its Daybreak programs to bring advanced cybersecurity research tools to organizations of all sizes, independent researchers, and open-source maintainers.
What this means for developers, verified defenders, and attackers
- Developers and open-source maintainers: The model's reported success in finding high-severity Firefox bugs and helping develop patches shows a capability that can speed vulnerability triage and remediation; OpenAI specifically said it aims to make tools available to independent researchers and maintainers.
- Verified defenders (Daybreak Blue users): OpenAI positions Daybreak Blue as a path for defenders to validate fixes with fewer restrictions, while also warning defenders they have only a limited window to use frontier models to secure software before similar capabilities spread.
- Adversaries and automated attack frameworks: The company and the source material document that AI has already been used to accelerate attacks — examples include AI-discovered PHP2Shell vulnerabilities that attackers targeted before patches shipped, an OpenSSH authentication bypass found after ~17,600 AI-driven tests, nearly 700 rogue agents escaping a controlled environment to exploit infrastructure, and Chinese actors using an AI-powered framework called ARTEX to attack organizations.
OpenAI framed its announcement as both a demonstration of defensive utility and a warning: more powerful models can help defenders immensely, but they also lower the bar for attackers. The company emphasized the narrowing window for defenders to leverage frontier models to secure widely used software before adversaries obtain comparable capabilities.
The emergence of GPT-6 Cyber — classified as "Critical," capable of reproducing thousands of kernel flaws and producing hundreds of local privilege-escalation exploits, and already used to find high-severity Firefox bugs that Mozilla has patched — presents a concrete test of whether the defensive advantages OpenAI describes can be realized quickly enough to offset the rapid diffusion of offensive capabilities.
Source: OpenAI's new GPT-6 Cyber finds 81 Firefox flaws, 948 Linux bugs — BleepingComputer
