GPT-6 Cyber finds 81 critical vulnerabilities in Firefox

OpenAI announced the GPT-6 Cyber ​​model on November 5, 2026. The model helps authorized security teams find software vulnerabilities, verify exploits, and produce patch islands.

The cybersecurity risk has increased to Critical in the company's Preparedness Framework classification. The previous GPT-5.6 Cyber ​​was at High level.

This announcement also carries a practical signal for the ordinary user. For example, new patches may arrive faster for common software such as Firefox and Linux. Therefore, it is important not to delay browser and system updates.

What does GPT-6 Cyber ​​do?

The model is a special version trained for security research. For example, it reads code, looks for vulnerabilities, produces working exploits and recommends patches.

According to OpenAI's official announcement, the score in the ExploitGym test is 48.5 percent. In comparison, GPT-5.6 Cyber ​​received 32.1 percent in the same test. The flagship GPT-6 Astra scored around 42.4 percent, according to The Verge.

Additionally, in a recent web penetration test, the model found 40.3 percent of vulnerabilities without seeing the source code. GPT-6 Astra remained at 32.0 percent. Completed 95 percent of tasks in RemoteExploitBench (GitLab, PostgreSQL, and Jenkins).

Does it go out of scope?

OpenAI emphasized scope discipline after the Hugging Face agent infiltration incident in the summer. Because in the ExploitGym Honeypot test, not touching side services is measured.

Accordingly, it remained at the limit in 99.93 percent of the tests without a security prompt. However, upon request, the rate became 100 percent. On the other hand, in GPT-5.6 Cyber, the involuntary rate was 94.49 percent.

The model does what you want more than 99 percent of the time, Fouad Matin (OpenAI cyber readiness team) said in the briefing cited by The Verge. Moreover, default IP allowlisting is mandatory for Daybreak Red API access.

What was found in Firefox and Linux?

In fact, OpenAI researchers found 81 previously unknown high-severity vulnerabilities in Firefox. Mozilla started releasing patches. Additionally, 30 known vulnerabilities were shown to be more severe than thought.

948 privilege escalation exploit was developed in the Linux kernel. With GPT-5.6 Sol in the same probe setup, the number was 166. In addition, 304 critical findings were forwarded to maintainers along with patch candidates.

We summarized this Linux study in English in our 948 root exploit news. We also covered a previous example of Firefox patch risk in our GLM 5.3 Firefox news.

Who can use it?

Access is currently available to select Daybreak Red customers via API and Codex. Thus, the model is limited to a controlled group. OpenAI says it will soon expand access to all Red customers. GPT-5.6 Cyber ​​was opened to the entire Red group.

Teams like Cisco, California, and CodeRabbit use the model for vulnerability research and code review. As a matter of fact, CodeRabbit announced that it found more medium and high severity problems in its internal tests. A new Daybreak Red tier has also been added for critical infrastructure defenders. The $1 billion Daybreak for Frontline Defenders support continues for defenders suffering from resource constraints.

Editorial comment: What does the Critical tag mean?

The Critical label means that OpenAI acknowledges that it can produce zero-day exploits that work on model-hardened systems. That's why access is gated.

The increase in speed for defenders is real. But that same capability also amplifies the scenario governments fear in infrastructure warnings. You can read our English news on the GPT-6 Cyber ​​EN page. Also see our AI cyberattack coverage for the UK warning.

Therefore, the practical result is clear. Therefore, do not postpone browser and operating system updates. Firefox users in particular should follow the patch notes closely.