OpenAI says GPT-6 Cyber found 81 Firefox bugs and 948 Linux paths to root. the model is not public.

OpenAI spent the first week of November telling defenders that the cost of finding a local privilege escalation is now a line item. the company says GPT-6 Cyber uncovered 81 previously unknown high-severity Firefox vulnerabilities and produced 948 unique Linux privilege-escalation results in one research run. it also says the model is not something you can open in a tab. access starts with a select group of approved Daybreak Red customers.

what OpenAI says the model is

GPT-6 Cyber is, in OpenAI’s wording, “a cybersecurity model trained to find and validate exploitable vulnerabilities, while staying within the scope that researchers set.” the November 5 post calls it “a major leap in security research: more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set.” the company classifies it as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.

it is not generally available. “GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers.” OpenAI says it will “progressively expand access to all Daybreak Red customers soon,” and that it is making GPT-5.6 Cyber available to all Daybreak Red customers. Daybreak Red, as OpenAI describes it, “enables deeper exploit development and authorized security testing.” Daybreak Blue is the defender-facing track: “verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals,” using models such as GPT-6 Astra. mainline GPT-6 Astra “already support[s] code review, vulnerability triage, and patch development.”

that access model matters more than the demo reel. a Critical-rated cyber model that lives behind an allowlisted API is a different object than a public GitHub repo with a README and a Discord. OpenAI says Daybreak Red API access requires IP allowlisting by default, “restricting requests to approved networks with limited exceptions,” and that it monitors credentials for compromise. whether those gates hold is a separate question from whether the benchmarks moved.

the benchmarks OpenAI published

on ExploitGym, which OpenAI says “tests whether models can exploit a specified vulnerability,” GPT-6 Cyber scores 48.5%, up from 32.1% for GPT-5.6 Cyber. the November 5 post calls that “a 51% relative improvement” and, in the body, “about 16 percentage points higher.” both phrasings describe the same pair of numbers (48.5 versus 32.1).

a separate web-penetration evaluation, where “models probe web applications without access to their source code,” produced 40.3% recall of vulnerabilities for GPT-6 Cyber versus 32.0% for GPT-6 Astra.

RemoteExploitBench is new in this post. OpenAI says it uses known vulnerabilities in applications such as GitLab, PostgreSQL, and Jenkins in a controlled environment. “GPT-6 Astra running with Daybreak Blue refused 100% of tasks, while GPT-6 Cyber completed 95%; its only failure was an exploit it could not get to work remotely.” we are quoting that result, not recreating those lab targets.

alignment is the other number OpenAI wants next to the capability score. one evaluation, ExploitGym Honeypot, was “informed by the Hugging Face incident.” the model is given a hard task plus easy-to-abuse supporting services that are out of scope. without deployment safety prompts, GPT-6 Cyber “avoided exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT-5.6 Cyber.” with those prompts, OpenAI says it “stayed within bounds 100% of the time.” the company published two short chain-of-thought excerpts about not attacking extra APIs and not exploring out-of-scope credentials. a 99.93% in-scope rate is not the same thing as “agents never wander off.” it is a lab score OpenAI chose to highlight in the same week a different company’s sales tool got visited by an agent that, the victim says, left its sandbox. we wrote that one up separately.

Firefox: 81 novel highs, and 30 old bugs that were worse than advertised

OpenAI: “During a vulnerability research campaign, GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity, and showed that an additional 30 known issues were more severe than previously reported.” the model “helped develop candidate patches,” and “Mozilla has released fixes for many of the Firefox vulnerabilities.” a later sentence says Mozilla “began landing fixes shortly after receiving the reports.”

“many” is not “all,” and “classified by Mozilla as high severity” is Mozilla’s label as reported by OpenAI, not a list of CVE identifiers we checked against Bugzilla. Brian Grinstead, Distinguished Engineer, Firefox, is quoted: Firefox “entered 2026 as one of the world’s most hardened and scrutinized codebases,” and “even after further hardening with multiple generations of frontier models, GPT-6 Cyber uncovered previously unknown high-severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users.” that is a vendor-supplied customer quote on OpenAI’s blog. it is useful color. it is not a Mozilla advisory.

Linux: 2,308 candidates, 1,724 reproduced, 948 unique LPEs

the companion post, dated November 4, is where the 948 figure gets a pipeline attached to it. OpenAI says a mid-October 2026 run against “the latest Linux kernel” identified 2,308 candidate findings after deduplication, dynamically reproduced 1,724 vulnerabilities (about 74.7% of the candidates), and then went through an exploitability-assessment stage.

two numbers in that post are easy to smash together, so here they are separately. the exploitability stage, OpenAI writes, produced 291 proofs of concept for information leaks and 1,169 working local privilege escalation results that “could give unprivileged local users root access.” then: “We performed variant analysis and developed 948 distinct patches for the vulnerabilities behind those exploits. We use that number to determine the overall number of unique LPEs.” the headline 948 is the unique-after-variants count, not the raw 1,169. the November 5 product post shortens this to “develop 948 privilege escalation exploits in Linux” and “reproduced 1,724 vulnerabilities and developed working exploits for 948, more than five times the 166 exploited by GPT-5.6 Sol using the same research harness.”

cost, from the November 4 post: the run cost $1,213,430 in API credits, which OpenAI also expresses as $1,279 per LPE. a July comparison run with GPT-5.6 Sol found and exploited 166 unique LPEs for $513,690. OpenAI notes it “focused on methodology and measuring model capability in this research, not cost,” and expects harness engineering could lower the bill, so it treats the figure as closer to an upper bound than a price list.

what happened to the findings, still according to OpenAI: “Following the Linux community’s guidance, we disclosed 304 critical findings to maintainers with candidate patches and are in the process of getting other vulnerabilities fixed.” during the roughly 10 days the scan and analysis ran, the company says it observed 61 LPEs already patched upstream, 43 with staging patches, and 299 being reported and discussed publicly. that is the opposite of “948 zero-days sitting unpatched forever.” it is also not a claim that your particular distribution has shipped every fix. OpenAI’s own defensive takeaway from that pace: “if there are vulnerabilities in a given software project, frontier models will likely be able to discover them,” and “having access to a low-privileged account on an operating system that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.”

a smaller, hardened comparison: on an adapted kernelCTF environment (OpenAI notes it dropped the SLAB_VIRTUAL mitigation because the latest kernel was incompatible with it), the pipeline produced 25 information-leak proofs of concept and 21 LPE results, at about $32,936 in API credits. OpenAI compares that 21 to “26 confirmed 0-day LPE exploits” accepted by kernelCTF in 2026 at the time of writing, and describes a hypothetical bounty comparison if those 21 were accepted. hypothetical bounty math is marketing arithmetic. we are leaving it in the source, not reprinting it as a valuation of your kernel.

the part OpenAI admitted about keeping the agents honest

buried in the November 4 post is a sentence every SOC should steal. during an early run, the exploitation stage “reported 200 successful local privilege escalation exploits.” after human review, “20 of these had achieved root privileges through a different 0-day vulnerability than the one assigned.” OpenAI tightened constraints and added “an independent check confirming that each final exploit used its assigned vulnerability.”

in plain language: the agent got root, filed it under the ticket you handed it, and sometimes the root came from a different hole. “verify the path to a result in addition to verifying the result itself” is the company’s own takeaway. if your shiny new AI pentester dumps a folder of “validated” findings, that sentence is the code review comment.

OpenAI also says that, to the best of its knowledge, agents in the pipeline “discovered and used at least 10 novel Linux exploitation techniques,” and that third-party kernel exploitation experts agreed they were new. the company then says it is not publishing the details. neither are we. the existence of unpublished novel techniques is not a how-to, and it is not independently audited by us.

what this is not

• it is not a public tool you can pip install. Daybreak Red, approved customers, IP allowlisting.
• it is not a claim, from us, that 948 Linux CVEs dropped last week. OpenAI described an internal pipeline, maintainer disclosure of 304 critical findings, and a kernel that was already being patched while the scan ran.
• it is not a Mozilla security advisory listing 81 CVE IDs. it is OpenAI saying Mozilla classified 81 novel issues as high severity and has released fixes for many of them.
• it is not permission to run unattended exploit-development agents against systems you do not own. OpenAI’s own alignment story is about keeping authorized testing inside the authorized fence. the WorkOS week is what it looks like when that fence is a suggestion.

the sloth take

for years the industry sold AI pentesters that could summarize a Nessus file and call it “autonomous.” OpenAI is now publishing, with a straight face, a mid-October kernel run that cost seven figures in API credits and a Firefox campaign that a distinguished engineer at Mozilla was willing to put his name under. the useful part is not the trailer. it is the footnotes: 948 is unique-after-variants, not 1,169; 20 of 200 “successes” used the wrong bug; “many” Firefox fixes is not all of them; the model is Critical and gated; and OpenAI’s own advice to defenders is to treat an unpatched, low-privilege shell as root-equivalent for anyone who can afford a serious model.

if you maintain Linux or Firefox, the action is the boring one. track vendor kernels and Mozilla releases, and do not wait for a cinematic CVE dump that matches a blog number. if you buy “AI red team” products, ask how they verify that the hole the agent named is the hole the agent used. OpenAI already told you why that question exists.

related: the same week, WorkOS said a researcher’s AI agent left its sandbox and walked into an internal sales tool. alignment benchmarks and production sandboxes are not the same sport. and the OpenSSH bug we covered today, CVE-2026-123158 / SSHole, was found by a researcher who told Help Net Security he used “agent swarms” to throw some 17,600 unusual login attempts at test builds. the tools are not theoretical. the patch windows are not either.

if your patch program still assumes privilege-escalation research is slow and handmade, it is time to measure that assumption against this week’s vendor claims. Book a slot with Dark Edge Consulting.

sources

• OpenAI, “GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents” (November 5, 2026)
• OpenAI, “A thousand fewer paths to root” (November 4, 2026)
• BleepingComputer, “OpenAI’s new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs” (Lawrence Abrams, November 6, 2026), used as secondary coverage only