OpenAI announces GPT-6 Cyber after finding over 1,000 security issues in Linux and Firefox
OpenAI has announced GPT-6 Cyber, a new cybersecurity model designed to identify, exploit, and fix software vulnerabilities. The company revealed that the model has already helped discover and patch 948 local privilege escalation exploits in Linux, identify 81 previously unknown high-severity Firefox vulnerabilities, and uncover a critical Brotli flaw (CVE-2026-111497) with a CVSS score of 9.2. OpenAI has classified it as Critical under its Preparedness Framework due to its capabilities and associated risks.
GPT-6 Cyber scored 48.5% on ExploitGym, a benchmark measuring the ability to turn known vulnerabilities into working exploits, compared with 32.1% for GPT-5.6 Cyber. It also avoided unauthorized exploitation in 99.93% of cases without safety prompts, up from 94.49% for its predecessor, and reached 100% with those prompts enabled. Additional safeguards aim to prevent misuse, particularly involving safety-critical systems.
Due to its advanced capabilities and potential risks, OpenAI has classified GPT-6 Cyber as Critical under its Preparedness Framework and restricted access to selected verified researchers through its Daybreak Red program, using the API and Codex. The company plans to gradually expand availability to more approved organizations and independent researchers, with additional safeguards to prevent misuse.
Comments
Anthropic did the same thing last summer: announcing about 70 vulnerabilities when only a dozen were real (with some already fixed). LLMs are quite efficient at building and running virtual machine with inconceivable setups that may never worked on real devices. But an exploit is not a vulnerability nor a bug, especially if it relies on weird configurations and nonsensical actions. And OpenAI has spent $1.2M (from its marketing budget, I guess) to find theses exploits just to make the headlines. Also, the Brotli vulnerability (known as Node2Shell) came from unrelated Google library that Firefox, like many other tools, uses (not very much).
Gatekeeping is, simply put, a great way to ensure that the illusion of security will simply ouroboros itself while open source models trained with relevant datasets gradually catch up and pass the walled garden.