GPT-6 Cyber: 81 unknown Firefox vulnerabilities and 948 Linux privilege-escalation exploits

GPT-6 Cyber is OpenAI’s security-specialized model, shipped November 5: built for vulnerability discovery, exploitability validation, attack-path analysis and remediation. The same-day companion study used it to produce 948 working Linux privilege-escalation exploits and surface 81 unknown high-severity Firefox vulnerabilities.

Key points

• OpenAI shipped GPT-6 Cyber on November 5, a security-specialized model: 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, and its Preparedness Framework rating rose to Critical.
• Field results: 81 previously unknown high-severity vulnerabilities in Firefox (Mozilla patching underway), and 948 working Linux local privilege-escalation exploits — versus 166 for GPT-5.6 Sol under the same framework.
• The Linux experiment cost roughly $1.21 million in API credits, averaging $1,279 per working exploit.
• Alignment is the headline feature: the model refused to exploit out-of-scope services in 99.93% of tests without a deployment prompt, 100% with it.
• The HN thread reached 54 points; the security community’s focus is disclosure responsibility around a Critical-rated model.

On November 5, OpenAI shipped GPT-6 Cyber, a model specialized for security research — vulnerability discovery, exploitability validation, attack-path analysis and remediation. Same day, its research team published a companion study, “A thousand fewer paths to root,” using the model to produce 948 working local privilege-escalation exploits against the Linux kernel. The Hacker News thread hit 54 points within a day, and Chinese tech media carried the numbers same-day, matching the official announcement.

Benchmarks and the Critical rating

By OpenAI’s own numbers, GPT-6 Cyber scores 48.5% on ExploitGym — which tests whether a model can actually exploit a specified vulnerability — up from 32.1% for GPT-5.6 Cyber. On black-box web pentesting its vulnerability recall is 40.3% versus GPT-6 Astra’s 32.0%. The more consequential line is the Preparedness Framework rating: GPT-5.6 Cyber was rated High; GPT-6 Cyber is rated Critical — OpenAI’s top disclosure tier for capability that could assist large-scale attacks.

In the field: Firefox 81, Linux 948

In Firefox, GPT-6 Cyber found 81 previously unknown high-severity vulnerabilities in a codebase that has been hardened by years of review and fuzzing, plus evidence that 30 known issues were more severe than assessed; findings, reproductions and candidate patches went to Mozilla, and some fixes have shipped. Firefox distinguished engineer Brian Grinstead is quoted in the announcement: even after multiple generations of frontier-model review, the model surfaced unknown high-severity issues. The Linux study was larger: 2,308 candidate issues → 1,724 dynamically reproduced → 948 working local privilege-escalation exploits (GPT-5.6 Sol managed 166 under the same framework), for roughly $1.21 million in API credits — about $1,279 per working exploit. Following kernel-community guidance, OpenAI prioritized disclosing 304 critical findings with candidate patches to maintainers.

Alignment as a product feature

A more capable security model is not automatically a safer one. OpenAI’s alignment evaluation: without a deployment prompt, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests, and 100% with the prompt. Chinese coverage put this in the headline — the model learned to respect attack boundaries. The double edge is equally explicit: the same capability that patched Firefox produced 948 escalation paths. OpenAI’s answer is tiered disclosure plus boundary training; the security community’s questions about disclosure cadence and misuse did not stop on HN.

Summary

For security teams, the practical meaning of GPT-6 Cyber is that automated vulnerability research has a price list — $1,279 per working privilege-escalation exploit — and hardening schedules should be re-baselined to AI speed. The Firefox result also says mature codebases are far from “fully audited”: beyond review and fuzzing, budget a pass with the newest models on every critical dependency. For everyone else, assume adversaries have equivalent tooling. For everyone else, assume adversaries have equivalent tooling. Compared with our coverage of the Binance heist — social engineering and supply-chain poisoning through a single point — this is the same firepower applied systematically to bulk vulnerability discovery; both sides of the arena are automating fast.