OpenAI's GPT-6 Cyber finds 81 Firefox flaws and is rated Critical
OpenAI launched GPT-6 Cyber, a Daybreak Red model rated Critical for cybersecurity after company researchers reported 81 high-severity Firefox flaws and 948 Linux kernel exploits.
OpenAI on Thursday introduced GPT-6 Cyber, a restricted cybersecurity model it says can find and validate software vulnerabilities more effectively than earlier versions while staying inside the scope researchers set. The company rated the model Critical for cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.
Access starts with a subset of approved Daybreak Red customers through the API and Codex. OpenAI says it will widen GPT-6 Cyber to all Daybreak Red customers soon and is already making GPT-5.6 Cyber available across that tier. Daybreak Blue remains the broader lane for verified defenders who need vulnerability triage and patch help without the deeper exploit-development path.
What the company says the model did in the wild
OpenAI’s researchers used GPT-6 Cyber on two heavily scrutinized codebases. In Firefox, the model produced evidence and reproducible tests for 81 previously unknown vulnerabilities that Mozilla classified as high severity, and argued that another 30 known issues were more severe than previously reported. OpenAI says it sent findings and proposed patches; according to the company, Mozilla began landing fixes after receiving the reports.
In the Linux kernel, researchers say the model reproduced 1,724 vulnerabilities and developed working privilege-escalation exploits for 948 of them—more than five times the 166 exploits OpenAI attributes to GPT-5.6 Sol under the same research harness. The company says it disclosed 304 critical findings to maintainers with candidate patches and is still working through other fixes. Axios and CyberInsider both report that the Linux campaign cost about $1.2 million in API credits; Axios adds that OpenAI claims at least 10 of the techniques used were previously unknown, with human researchers reviewing findings before disclosure.
Those figures come from OpenAI’s own campaigns. They show what a gated model can do inside authorized research setups, not what an unvetted user would be allowed to attempt.
Benchmarks, scope, and pricing
On ExploitGym, which tests whether a model can exploit a specified vulnerability on a remote target, OpenAI reports a 48.5% score for GPT-6 Cyber, up from 32.1% for GPT-5.6 Cyber—about a 16-point absolute gain, or roughly 51% relative. On a separate web penetration test without source code, the company says GPT-6 Cyber recalled 40.3% of vulnerabilities versus 32.0% for GPT-6 Astra. On RemoteExploitBench (known issues in applications such as GitLab, PostgreSQL, and Jenkins), GPT-6 Cyber completed 95% of tasks while Astra under Daybreak Blue refused every task—an access-policy contrast as much as a capability one.
Alignment was a stated design goal. OpenAI’s ExploitGym Honeypot, informed by an earlier Hugging Face sandbox incident the company cites, plants easy-to-abuse side services next to an in-scope target. Without deployment safety prompts, GPT-6 Cyber avoided out-of-scope exploits in 99.93% of tests, up from 94.49% for GPT-5.6 Cyber; with those prompts, OpenAI reports 100% in the evaluation. That is a lab result, not a production guarantee—and at volume, even a small miss rate can still mean unauthorized actions.
OpenAI’s model docs list standard short-context prices of $20 per million input tokens, $100 per million output tokens, and $2 per million cached input tokens, with cache writes at $25 per million for 30 minutes or $50 for 12 hours. VentureBeat notes those base rates sit above GPT-5.6 Cyber and above published cyber-model prices from Anthropic and Google. Token price is not the same as cost per validated finding; sandboxing, analyst review, and long tool loops still dominate real deployments.
Why it matters for founders and security teams
Frontier labs are racing to put strong cyber agents in defenders’ hands before open or stolen weights close the gap. OpenAI frames a “limited window” to harden software and is expanding Daybreak, including a Daybreak Red group for approved critical-infrastructure operators and a $1 billion subsidy program for resource-constrained defenders. Industrial security firm Dragos, quoted in OpenAI’s post, says permissive models on a mock power-plant range found zero-days in engineering software that manages protective relay data—an illustration of how reconnaissance skill floors are dropping for both attackers and purple teams.
The competitive set is already crowded on the defender side. Mistral’s Large 4 open weights were pitched at cyber defenders weeks ago; Anthropic and Google also gate stronger cyber modes behind trusted-access programs. Coding-agent tooling is moving in parallel—from DeepSeek’s open Super-agent to deals such as Meta’s purchase of Conductor—so security review is becoming part of the same agent stack that writes the code.
For now, GPT-6 Cyber is a product for approved Daybreak Red users, not a general ChatGPT feature. The near-term test is operational: whether security teams can turn the model’s findings into patches faster than adversaries can reuse the same techniques, and whether scope-following holds up outside OpenAI’s honeypot.
