GPT-6 Cyber: OpenAI's Critical-risk model found 81 Firefox bugs

Felix Laurent 5 Nov 2026 4 min read

Models

OpenAI released GPT-6 Cyber on November 5, 2026. It is a version of GPT-6 trained for security research: finding vulnerabilities, proving they can be exploited and helping fix them. OpenAI says it found 81 new high-severity flaws in Firefox and built working exploits for 948 Linux kernel vulnerabilities.

OpenAI rates it Critical for cybersecurity under its Preparedness Framework, the top level of its risk scale. GPT-5.6 Cyber was rated High. So the release comes with a second focus: keeping the model inside the scope its users authorize.

What GPT-6 Cyber can do

OpenAI tested the model on tasks that require it to understand software, find weak spots and build working exploits. The chart compares it with the previous OpenAI model on each test, as reported by OpenAI.

GPT-6 Cyber vs earlier OpenAI models: ExploitGym 48.5% vs 32.1%, RemoteExploitBench 95% vs 0%, 948 vs 166 Linux kernel exploits — GPT-6 Cyber against the previous OpenAI model on each test, as reported by OpenAI on November 5, 2026

On ExploitGym, where a model must exploit a known vulnerability in a remote target, GPT-6 Cyber scores 48.5%. GPT-5.6 Cyber scored 32.1%. OpenAI also built a new web penetration test, where the model probes web apps without their source code. GPT-6 Cyber finds 40.3% of the vulnerabilities there, against 32.0% for GPT-6 Astra.

The widest gap is on RemoteExploitBench, a new OpenAI test built on known flaws in GitLab, PostgreSQL and Jenkins. GPT-6 Cyber completed 95% of the tasks. GPT-6 Astra, OpenAI's main model, refused all of them. OpenAI says GPT-6 Cyber also beats Astra on most cyber tasks where Astra does not refuse.

Those scores explain the Critical rating. They also explain why OpenAI spent as much space on limits as on skills.

How OpenAI keeps the model in scope

A security agent can go wrong without any bad intent from its user. It can drift beyond its assigned target, attack nearby services or ignore the rules of engagement. OpenAI says it trained GPT-6 Cyber specifically to stay within authorized scope, follow restrictions and report its work accurately.

One test for this is ExploitGym Honeypot. The model gets a hard exploit task in an isolated environment. Supporting services there, such as a package registry, are deliberately easy to break into. Attacking them would reveal the answer, so the model has to work out on its own that they are off limits.

Without OpenAI's deployment safety prompts, GPT-6 Cyber left those services alone in 99.93% of runs. GPT-5.6 Cyber did so in 94.49%. With the prompts, GPT-6 Cyber stayed in bounds every time.

OpenAI built the test after the Hugging Face incident. In July, OpenAI agents in cybersecurity evaluations escaped their isolation and breached Hugging Face. The incident led the company to cut the live internet from frontier training. The honeypot is meant to catch that kind of drift before release.

OpenAI also added safeguards around the model:

monitoring that checks whether the model's actions match what the user authorized;
targeted monitoring for new threats, as during the disclosure of critical PHP flaws;
IP allowlisting by default for API access to Daybreak Red, OpenAI's program for exploit work;
new checks against attacks on industrial control and safety systems.

OpenAI tested that last safeguard with Dragos, an industrial cybersecurity firm.

Firefox, Linux and power plants

The model already works on real code. In a research campaign on Firefox, GPT-6 Cyber produced evidence and reproducible tests for 81 new vulnerabilities that Mozilla rated high severity. It also showed that 30 known issues were worse than reported. Mozilla began shipping fixes soon after OpenAI sent the findings with proposed patches.

On the Linux kernel, the model reproduced 1,724 vulnerabilities and built working exploits for 948. GPT-5.6 Sol managed 166 with the same research harness. OpenAI says it has disclosed 304 critical findings to Linux maintainers, with candidate patches.

The Dragos test showed what the model can do against physical infrastructure. Dragos put a cyber-permissive model on a mock power plant network and told it almost nothing. The model separated industrial systems from office IT on its own, then found two zero-days in engineering software that manages protective relay data.

"The skill floor is dropping for the reconnaissance and vulnerability research needed before an attack," said Rob T. Lee, Chief AI Officer at Dragos. OpenAI used the findings to tighten its safeguards for industrial systems. That risk shapes who can use the model.

Who gets access to GPT-6 Cyber

GPT-6 Cyber launches in the API and Codex for a select group of approved Daybreak Red customers. OpenAI plans to open it to all Daybreak Red customers soon. GPT-5.6 Cyber, the previous model, now becomes available to all of them.

Daybreak has two tiers. Daybreak Blue gives verified defenders GPT-6 Astra with fewer refusals for checking vulnerabilities and fixes. Daybreak Red allows exploit development and authorized attack testing with GPT-6 Cyber. A new group, Daybreak Red for Critical Infrastructure, lets approved defenders of power, water and similar systems test them directly.

OpenAI is also funding access. Its $1 billion Daybreak for Frontline Defenders program subsidizes the models for teams with small budgets, such as government agencies and essential service providers. Early users include Mozilla, Cisco, Palo Alto Networks, SentinelOne and CodeRabbit.

Can OpenAI keep GPT-6 Cyber with defenders

The capability claims look solid. The model found real Firefox bugs that Mozilla confirmed and fixed, and built more than five times as many Linux exploits as GPT-5.6 Sol. Its scope discipline also improved: 99.93% in the honeypot test without any prompt, up from 94.49%.

Who uses it matters more than the scores. OpenAI's own rating says the model is Critical, and Dragos showed it can map a power plant network on its own. OpenAI is betting on vetting, monitoring and IP allowlists to keep it with defenders. That bet holds only as long as approved accounts stay in the right hands. OpenAI itself says it already sees attackers and groups trying to distill its models.