OpenAI's GPT-6 Cyber finds 81 Firefox flaws and shows how AI is changing cybersecurity
By Google News AI ·
OpenAI built a model to find holes in software, then rated it at the top of its own cyber risk scale. If you buy security tools or ship code, the same skill is now working for both sides.
OpenAI announced GPT-6 Cyber this week, and the numbers are blunt. According to The Hacker News, the model helped find 81 previously unknown high-severity vulnerabilities in Mozilla Firefox, and an autonomous pipeline built on it produced 948 working local privilege escalation exploits for Linux.
OpenAI also sent 304 critical Linux findings to maintainers with suggested fixes, and Mozilla has begun publishing fixes for the Firefox flaws.
You can't buy it. GPT-6 Cyber is initially available through the API and Codex to select customers in OpenAI's Daybreak Red program, and Tech Times says access is limited to approved security teams. Digg's coverage notes there is no price and no general availability date yet. Cisco and CodeRabbit have reportedly used it for code review.
OpenAI classed GPT-6 Cyber as Critical for cybersecurity under its Preparedness Framework, one step above GPT-5.6 Cyber, its predecessor. Read that again. The company selling the defensive tool is telling you, in its own safety paperwork, that the tool is dangerous.
That's the problem with this whole category. A model that can turn a Linux kernel flaw into a working root exploit for a defender's test is doing exactly what an attacker needs. Frankly, there's no version of a better coding model that isn't also a better hacking model, and every lab racing to improve one is improving the other.
OpenAI's cyber research pipeline reproduced 1,724 real Linux kernel bugs from 2,308 candidates and turned 948 into validated root exploits with patches, for roughly $1.2 million in a single run. - openai ai pipeline linux kernel root exploits - how openai found 948 linux kernel exploits
We already have a real case of the attacker's side. In May, Google's Threat Intelligence Group disrupted a criminal group that tried to use AI to find and weaponize a zero-day in a popular open-source, web-based admin tool, according to TechRepublic. The exploit bypassed two-factor authentication.
Google said it had high confidence an AI model helped, partly because the Python script carried a hallucinated CVSS score. The target company patched before any mass attack began.
The defenders aren't standing still. OpenAI launched Daybreak on May 11 with partners including Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, Oracle and Akamai, and it competes directly with Anthropic's Project Glasswing, as Decrypt and Engadget reported at the time.
OpenAI says it's getting better at this. Without deployment safety prompts, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests, up from 94.49% for GPT-5.6 Cyber. With the prompts, it stayed in bounds every time. Put the old number the other way round and it means the previous model wandered outside its brief in roughly one test in eighteen.
A 99.93% score in a lab test tells you little about a messy customer network. Treat it as a vendor figure, because that's what it is.
Start with patch speed, not tool shopping. If a model can produce 948 Linux exploits, the gap between a bug being found and a fix reaching your servers is the number that decides whether you get hurt. Ask your vendors how long that takes, in days, and ask your own team the same.
Second, ask every security vendor which model sits under its product and what stops it going out of…
Originally published by Google News AI
