OpenAI’s GPT-6 Cyber Found 81 Unknown Firefox Flaws and Cracked Nearly 1,000 Linux Exploits

OpenAI announced GPT-6 Cyber on 5 November 2026, billing it as a specialist model built for finding, validating, and helping fix software vulnerabilities. The headline numbers are striking: the model reportedly reproduced 1,724 Linux kernel vulnerabilities and developed working privilege-escalation exploits for 948 of them. Of those, 304 critical findings were disclosed to Linux maintainers alongside candidate patches.

That’s not a small research exercise. For context, Mozilla — one of the world’s most scrutinised open-source projects — received disclosures on 81 previously unknown high-severity vulnerabilities in Firefox, and has since released fixes for many of them.

OpenAI described GPT-6 Cyber as a cyber-specialised variant of GPT-6 Astra, the company’s broader frontier model. Reuters reported that OpenAI released the model to a small group of vetted customers and classified it internally as “Critical” for cybersecurity — a designation that, under OpenAI’s own safety framework, indicates capability to identify and develop functional zero-day exploits across hardened, real-world critical systems without human intervention.

That classification matters. It’s OpenAI acknowledging, in its own terminology, that this is not a lightweight research assistant.

What the Performance Data Shows

The figures show a measurable step up from GPT-6 Cyber’s predecessor. On OpenAI’s ExploitGym benchmark — a test designed to measure a model’s ability to find and exploit software vulnerabilities — GPT-6 Cyber achieved a 48.5% success rate, compared with 32.1% for GPT-5.6 Cyber. That’s a 51% relative improvement, according to OpenAI’s own reporting.

On top of that, the out-of-bounds behaviour figure is also worth examining. The Verge reported that GPT-6 Cyber operated outside researcher-defined limits less than 1% of the time during testing, compared with about 5% for GPT-5.6 Cyber. OpenAI frames this as evidence of improved alignment — the model staying within the guardrails that security researchers set when they define the scope of a test.

All of these statistics come from OpenAI directly, or from secondary reporting that cites OpenAI’s own system card. Independent verification of the full Linux vulnerability totals and the precise number of Mozilla fixes released has not been established. That’s not unusual at launch, but it’s a fair caveat when reading the numbers.

OpenAI’s Own Words on the Model

OpenAI said: “We’re introducing GPT‑6 Cyber, a major leap in security research: more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set.”

Palo Alto Networks is identified by OpenAI among the security teams connected with the work, though the nature of that involvement — whether as a testing partner, early customer, or advisory role — has not been independently detailed beyond OpenAI’s own statements.

The Responsible Disclosure Question

The research raises questions that the cybersecurity community has been wrestling with for years, now applied at a much larger scale. If a model can develop working exploits for nearly a thousand Linux kernel vulnerabilities, the value of that capability depends almost entirely on who has access to it, how disclosures are handled, and how quickly patches reach production systems.

OpenAI’s “Critical” classification and the decision to release only to vetted customers suggests the company is aware of the dual-use risk. But the model’s ability to generate functional exploits is precisely what makes it useful for defenders — and potentially dangerous if access or disclosure controls fail. There’s no clean answer to that tension, and OpenAI hasn’t claimed there is.

The Linux and Firefox research does at least demonstrate a credible defensive use case. Patches in the hands of maintainers are better than vulnerabilities sitting undiscovered. Mozilla’s decision to release fixes is a concrete outcome, not just a theoretical one.

A Note on Timing

The announcement is dated 5 November 2026, which falls after the current date of publication. The tweet and associated materials should be treated accordingly — the figures and claims reported here reflect what OpenAI has announced, and readers should verify the latest status of any patches or disclosures directly with software vendors.

What This Means for Kent Residents

Any organisation in Kent running Linux servers or Firefox — including Kent County Council, Medway Council, NHS Kent and Medway ICB, or local businesses — stands to benefit indirectly from the vulnerability disclosures that have already prompted Mozilla to release fixes. The practical advice is straightforward: apply software updates promptly, follow guidance from your employer or IT provider, and don’t delay installing patches flagged as high-severity. For most Kent residents, the immediate action is the same as it always has been — keep your software current.