OpenAI says earlier frontier models had already tested Firefox hard. GPT-6 Cyber still produced evidence for 81 new vulnerabilities in the browser, and Mozilla classified all 81 as high severity.
OpenAI launched the model on November 5, 2026. It is a version of GPT-6 Astra trained for authorized security work, and access starts with a small set of approved customers in Daybreak Red, the OpenAI programme for exploit development and authorized testing. Everyone else has to wait, and that limit is part of the story. OpenAI now rates the model Critical for cybersecurity under its own Preparedness Framework, up from High for GPT-5.6 Cyber.
The Announcement
GPT-6 Cyber is built to find vulnerabilities, prove that they can be exploited, and help develop fixes. That is a sharper job than general code review. A model that only points at suspicious code leaves the hard question unanswered. A model that builds a working exploit answers it, and creates a new risk at the same time.
OpenAI says the model is already in use at Cisco, Calif and CodeRabbit for vulnerability research and code review. The company also says it used the model on its own systems. In controlled campaigns described by OpenAI, agents using GPT-6 Cyber and other OpenAI models chained flaws together to escape isolated virtual machines and run code on the hosts below them. OpenAI says it used those results to patch software and tighten network limits.
The Firefox result is the clearest public proof the company offers. OpenAI gave Mozilla evidence, tests that reproduce each flaw, and proposed patches. Mozilla began landing fixes soon after it received the reports, OpenAI says, and Mozilla has released fixes for many of the flaws. The Mozilla advisory for Firefox 159, announced on October 27, 2026, lists a long run of high impact fixes, including entries reported by OpenAI staff and by OpenAI Codex Security.
Important Details
The numbers below are OpenAI figures from its launch post and its system card reporting, checked on November 6, 2026. No outside party has reproduced the full set, so read them as company reported results with one important check built in. Mozilla, a separate organization, assigned the high severity rating to the Firefox flaws and shipped fixes for many of them.
| Item | What OpenAI reported |
|---|---|
| New Firefox vulnerabilities | 81, all rated high severity by Mozilla |
| Known Firefox issues shown to be more severe | 30 |
| Linux kernel flaws reproduced | 1,724 |
| Linux kernel flaws with working exploits | 948 |
| Critical Linux findings disclosed to maintainers | 304, with candidate patches |
| ExploitGym score | 48.5 percent, against 32.1 percent for GPT-5.6 Cyber |
| Web test recall | 40.3 percent, against 32.0 percent for GPT-6 Astra |
| Tasks completed on RemoteExploitBench | 95 percent, where Astra with Daybreak Blue refused all tasks |
ExploitGym tests whether a model can exploit a named vulnerability in a remote target. RemoteExploitBench uses known flaws in tools such as GitLab, PostgreSQL and Jenkins in a controlled setting. Both are OpenAI evaluations, so the comparisons show progress inside OpenAI testing. They are not independent league tables.
ExploitGym score, as reported by OpenAI
Share of tasks where the model exploited a named vulnerability in a remote target. OpenAI figures, November 5, 2026.
The Linux figures need the same care our earlier report gave them. Our news report on the 948 Linux exploits covers the full run, its cost, and its disclosure status, and our guide to checking Linux servers explains why no scanner can check a machine against the 948 by name yet. OpenAI now confirms that GPT-6 Cyber powered that work. The candidate patches in that run still become real fixes only when maintainers accept them.
The Scope Test Is the Other Claim
A security agent that wanders is not a tool. It is an incident. OpenAI knows this, and much of the launch post argues that GPT-6 Cyber stays inside the limits a researcher sets.
The test OpenAI describes gives the model a hard task in an isolated setting, with nearby services that would be easy to attack and could reveal the answer. Those services sit outside the task scope, and the model has to work that out on its own. Without its deployment safety prompt, OpenAI says GPT-6 Cyber avoided exploiting services outside scope in 99.93 percent of trials, against 94.49 percent for GPT-5.6 Cyber. With the prompt, OpenAI recorded no violations in that test.
Those are strong numbers, and they are still OpenAI numbers from an OpenAI test. The honest reading is narrow. The company has shown it built a specific test for a known failure mode and that the new model scored far better on it than the old one. That is worth reporting. It is not proof that the model will respect every boundary in every real deployment, and OpenAI itself still recommends sandboxing, action review and human oversight for work of this kind.
Other controls are plain and practical. Daybreak Red API access requires a list of approved network addresses by default, which limits where requests can come from. OpenAI says it monitors for activity that does not match a user authorization, watches for attempts to misuse the model during live disclosures, and runs a grant programme to give access to teams that defend essential services but lack resources.
What’s Next
The confirmed steps are about access and fixes. OpenAI says access will expand to all Daybreak Red customers soon, and GPT-5.6 Cyber is now available to all customers in that group. Daybreak Blue access for GPT-6 Astra, aimed at verified defenders who validate flaws and fixes, is also expanding. On the Firefox side, Mozilla has released fixes for many of the 81 flaws, and users should make sure the browser is current rather than waiting on a restart prompt.
- October 27, 2026Mozilla announced security fixes in Firefox 159, including high impact entries reported by OpenAI staff and OpenAI Codex Security
- November 4, 2026OpenAI published its Linux kernel research, reporting 948 working exploits built with the model it had not yet named in public
- November 5, 2026OpenAI launched GPT-6 Cyber for a select group of approved Daybreak Red customers through the API and Codex
The open questions are larger than the launch. Nobody outside OpenAI and Mozilla has yet confirmed the full Firefox count from the underlying reports, and the Linux candidate patches still face maintainer review. There is also a balance problem nobody has solved. Each new finder of this strength gives defenders more flaws to fix, and gives maintainers more reports to judge, at a pace their teams did not choose.
For Firefox users, the action is boring and it works. Update the browser. For everyone watching model releases, the rating change is the signal to keep: OpenAI looked at what its own model can do, called it Critical, and kept the door locked to all but approved teams. That restraint will be tested the moment a rival ships a similar tool with a wider door.
Facts in this report were checked on November 6, 2026 against the OpenAI launch post, the Mozilla Firefox 159 advisory, and independent coverage of both.
Sources
- OpenAI, GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents, November 5, 2026. Primary source for the launch, the 81 Firefox flaws, the 30 more severe issues, the Linux counts, the benchmark scores, the scope test, and the Daybreak Red access limits.
- Mozilla, Security Vulnerabilities fixed in Firefox 159, announced October 27, 2026. Primary source for the Firefox 159 fixes and the high impact ratings.
- OpenAI, A thousand fewer paths to root, November 4, 2026. Primary source for the Linux pipeline that GPT-6 Cyber powered.
- Security Affairs, OpenAI Rates GPT-6 Cyber Critical After Major Vulnerability Discoveries, November 6, 2026. Independent coverage used to cross check the launch claims and the Critical rating.
- Digital Trends, GPT-6 Cyber is finding security flaws before hackers can exploit them, November 2026. Independent coverage used to cross check the Firefox fixes and the note from Firefox engineer Brian Grinstead.
- Hero and body images: Dirty Static, generated in house style
END OF TRANSMISSION
Stay curious. Question everything.
