OpenAI’s GPT-6 Cyber Finds Hundreds of Security Flaws in Linux and Firefox

Summary

OpenAI introduced GPT-6 Cyber, a security-focused model. In controlled research environments, the model reproduced 1,724 Linux kernel vulnerabilities and developed functional exploits for 948 of them. Additionally, it uncovered 81 previously unknown Firefox bugs through supervised testing rather than live attacks.

Why it matters

Vulnerabilities that previously took experts weeks to discover can now be identified within hours. This fundamentally shifts the attacker-defender balance in open-source infrastructure. OpenAI’s $1 billion subsidized access program and Daybreak Red restrictions acknowledge dual-use risks. However, a core asymmetry persists: while vulnerability discovery is accelerating, patch development, verification, and deployment remain bottlenecked by human processes. This gap is widening.

Highlights

• 948 functional exploits in the Linux kernel; 81 new Firefox vulnerabilities rated as critical by Mozilla
• 48.5% success rate on ExploitGym, compared to 32.1% for GPT-5.6 Cyber, marking a significant generational leap
• Access is restricted to authorized researchers via Daybreak Red, with 99.93% compliance in security assessments

Critical take

The article blurs the line between reproducing known CVEs and discovering new vulnerabilities. Reproducing 1,724 vulnerabilities does not equate to 1,724 new findings. The headline framing exaggerates the claim of novelty. Furthermore, even a 99.93% compliance rate for a tool capable of generating functional exploits leaves a significant margin for error. The text fails to explain what constitutes that 0.07% or how misuse is detected after deployment.