OpenAI says GPT-6 Cyber uncovered 81 Firefox flaws

OpenAI has introduced GPT-6 Cyber, a model designed for security research, claiming it finds and fixes vulnerabilities more effectively and stays within researcher-set boundaries far more reliably than prior versions. OpenAI reports that GPT-6 Cyber achieved a 51% relative improvement on ExploitGym and a notable step function in staying within scope compared with GPT-5.6 Cyber.

In real-world testing, the model reportedly helped secure software by reproducing and validating exploits in Linux and Firefox, and it produced evidence and reproducible tests for 81 new Firefox high-severity flaws while identifying 30 known issues that were worse than previously reported.

OpenAI states the model also demonstrated a capability to develop exploits for a critical Brotli flaw affecting downstream applications, with security teams at Cisco, Calif and CodeRabbit using the technology for vulnerability research and code review. The company emphasizes improvements in alignment and scope control, noting GPT-6 Cyber remained within authorized tasks in 99.93% of tests without deployment prompts and 100% with prompts guiding task boundaries.

The article cites Linux kernel work where GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 of them—more than five times the 166 exploited by GPT-5.6 Sol using the same setup—and that 304 critical findings were disclosed to maintainers with candidate patches. Mozilla reports that, in Firefox, GPT-6 Cyber contributed to fixes after uncovering 81 high-severity flaws, with 40.3% of vulnerabilities found versus 32% for Astra.

OpenAI also describes safeguards such as Private Safety Processing and Daybreak programmes to manage access for critical infrastructure defenders, including Daybreak Red for Critical Infrastructure and Daybreak for Frontline Defenders. The API access remains limited to approved Daybreak Red users, with broader access planned for the near term. 6 November 2026.