OpenAI announced on November 5 that the GPT-6 Cyber model, developed specifically for network security research, has identified 81 previously unknown high-risk vulnerabilities in the Firefox browser and successfully verified 948 operational privilege escalation attacks against the Linux kernel. This model is based on GPT-6 Astra and is specially trained to help security personnel find program weaknesses, verify whether vulnerabilities can be exploited, and generate patching recommendations. Due to its highly automated vulnerability research capabilities, OpenAI is currently only open to audited security customers and is not open to the general public.
Firefox is the most notable case of this research; OpenAI researchers used GPT-6 Cyber to examine the browser code and found 81 new vulnerabilities rated as high severity by Mozilla, and also found 30 known issues with actual risks higher than previously assessed. These findings have been submitted to Mozilla with test evidence and patching recommendations, and some vulnerabilities have also been corrected. Firefox senior engineer Brian Grinstead said that even though the browser has been checked by multiple generations of advanced AI models, the new model still finds security issues that went undetected in the past.
Research on the Linux core is larger. OpenAI established an automated vulnerability analysis process and successfully reproduced 1,724 vulnerabilities from 2,308 suspected issues, and developed local privilege escalation attack programs that could operate in the test environment for 948 of them. This type of vulnerability may allow a program that originally only had general user rights to obtain root management rights, but only if the attacker has the corresponding local execution conditions. Not all Linux devices can be invaded directly through the network. The entire Linux test cost approximately US$1.21 million in API credits, and the model also found at least 10 previously unseen vulnerability exploitation techniques during the research process. OpenAI has handed over 304 major findings and candidate patches to core maintainers in accordance with the Linux community's reporting process, and other issues are being addressed one after another. These results have been reviewed by researchers and do not mean that all 948 vulnerabilities have been patched.
GPT-6 Cyber also performs significantly better on standardized security tests than previous models. ExploitGym mainly tests whether the model can successfully exploit specified vulnerabilities. The new model achieved 48.5%, which is higher than GPT-5.6 Cyber's 32.1%, a relative improvement of about 51%. Another web page penetration test that did not provide source code had a vulnerability recall rate of 40.3%, and the general-purpose GPT-6 Astra was 32%. In the RemoteExploitBench test designed using known vulnerabilities in software such as GitLab, PostgreSQL, and Jenkins, GPT-6 Cyber completed 95% of the tasks in a controlled environment. In the same test using the Daybreak Blue security setting, GPT-6 Astra refused to perform all tasks due to security restrictions, so the results of the two cannot be directly regarded as a comparison of the model's technical capabilities under the same conditions.
OpenAI rated GPT-6 Cyber's security capabilities as Critical based on the "Preparedness Framework", which is one level higher than the previous generation GPT-5.6 Cyber's High. This hierarchical representative model has the ability to independently find high-risk vulnerabilities and develop exploit methods in a variety of real systems with relatively complete protection. In order to prevent the model from accidentally touching other systems when performing authorization tests, OpenAI also strengthened the training to restrict agent behavior.
The relevant tests refer to previous cases where AI agents accidentally attacked services outside their authorized scope. In the ExploitGym Honeypot evaluation, researchers deliberately set up services that were easily exploitable but were not targeted by the designated test. Without additional security prompts deployed, the proportion of cross-border attacks in GPT-6 Cyber was 0.07%, which was about 5.5% lower than the previous generation. After adding security prompts, no cross-border behaviors were observed in the test. These results show that the model can better comply with the study scope, but it does not mean that misjudgments can be completely eliminated in all practical environments.
Currently, GPT-6 Cyber can only be applied for through the Daybreak Red program, and the first wave will provide API and Codex access to some organizations that have passed the review. Even if you are qualified for Daybreak Red, you need to obtain additional model use approval for GPT-6 Cyber. Applicants must undergo identity and purpose checks, and meet security requirements such as single sign-on (SSO), multi-factor authentication (MFA), and API IP whitelisting. The standard API price of the model is $20 per million input tokens, $100 for output, and $2 for cached inputs, which is significantly higher than the general-purpose model. OpenAI stated that it will gradually open GPT-6 Cyber to more Daybreak Red users in the future, and the previous generation GPT-5.6 Cyber has been provided to all qualified Red customers. General developers currently cannot directly obtain this security-specific model.
In addition to OpenAI's own vulnerability research, security companies such as Cisco, Palo Alto Networks, CrowdStrike, SentinelOne and CodeRabbit have also participated in related testing or use, mainly for large-scale program code library inspection, vulnerability research and security patching. OpenAI also establishes stricter usage restrictions for critical infrastructure such as power plants and water treatment facilities to prevent models from being used to assist unauthorized attacks. The research results of GPT-6 Cyber have been handed over to software developers for processing. Mozilla has begun releasing relevant security patches for Firefox; the Linux core maintenance team continues to review vulnerability evidence and candidate patches submitted by OpenAI. For enterprises using related software, the actual patching progress must still be confirmed based on the security bulletins of each product and Linux distribution.
