OpenAI's GPT-6 Cyber finds 81 unknown high-severity Firefox flaws, 948 working Linux exploits

APPSO · wechat · 2026-11-06

OpenAI released GPT-6 Cyber, a model that autonomously discovers vulnerabilities, verifies exploitability and aids fixes. It scores 48.5% on ExploitGym (vs 32.1% for GPT-5.6 Cyber, +51% relative) and reaches 40.3% recall on black-box web pentesting, beating flagship GPT-6 Astra's 32.0%.

Real-world results

Linux kernel: reproduced 1,724 vulnerabilities and built 948 working exploits — over 5x the previous framework's 166; 304 key findings reported to maintainers.
Firefox: found 81 previously unknown high-severity flaws and showed 30 known issues were worse than assessed; Mozilla fixes are rolling out.
In controlled red-teaming, agents chained multiple bugs to escape micro-VM isolation and execute code on the host.
With Dragos in a simulated power plant, the model autonomously found two zero-days in industrial control software.

Safety controls

99.93% authorization compliance on ExploitGym Honeypot (94.49% prior), 100% with deployment prompts; risk rated Critical (prior: High).
Behavior monitoring, enterprise PSP abuse checks, default IP allowlisting.

Access & pricing

Initially API/Codex only for approved DaybreakRed customers; a $1B Daybreak for Frontline Defenders fund subsidizes defenders.
API: $20/M input, $100/M output (short context) — 5x GPT-5.6 Sol.

Original post →

OpenAI's GPT-6 Cyber finds 81 unknown high-severity Firefox flaws, 948 working Linux exploits

More from Models