OpenAI Rates GPT-6 Cyber Critical After 81 Firefox Flaws Found

OpenAI has given its new security model the highest risk rating on its own scale. GPT-6 Cyber, released on November 5 to a small group of vetted security teams, is rated Critical for cybersecurity under the company's Preparedness Framework, one step above the High rating given to its predecessor, GPT-5.6 Cyber.

The rating rests on numbers OpenAI reported from its own testing. The model found 81 previously unknown vulnerabilities in Firefox that Mozilla classed as high severity. On the Linux kernel, it reproduced 1,724 known vulnerabilities and built working exploits for 948 of them, including 588 flaws nobody had reported before. Every figure in this story comes from OpenAI or from reporting of OpenAI's announcement, and none of the totals has been independently verified.

What the model did

On ExploitGym, a benchmark that tests whether a model can exploit a given vulnerability, GPT-6 Cyber scored 48.5 percent, against 32.1 percent for GPT-5.6 Cyber and 42.4 percent for GPT-6 Astra, the general model it is built from.

The Linux work came from an automated run in mid-October. OpenAI says the model reviewed 2,308 candidate findings, produced working local privilege escalation exploits for 948 distinct flaws, and did it for about $1.2 million in API credits, roughly $1,279 per exploit. The earlier GPT-5.6 Sol, using the same research setup, managed 166 exploits. OpenAI says it sent 304 critical findings to Linux kernel maintainers, each with a candidate patch.

In Firefox, the model produced evidence and reproducible tests for 81 new high-severity flaws, and showed that 30 already known issues were worse than first reported. Mozilla has started fixing the Firefox flaws.

Access is locked down

GPT-6 Cyber is not a public product. OpenAI is offering it through the API and Codex to a select group of approved customers in its Daybreak Red program, with access expanding to all Daybreak Red customers over the coming weeks. The company has not said when, or whether, the model will be more widely available.

That restriction is the company's main answer to the obvious problem. A tool that can build a working exploit for about $1,279 does not stop being able to do that when it changes hands. OpenAI's position is that the capability should sit with vetted defenders first, so flaws get found and patched before they are used.

Why it matters

Security teams have used AI tools to scan code for years. What is new here is the step from finding a possible flaw to proving it with a working exploit, at a scale of hundreds of kernel flaws in a single research run. Defenders who get that ability first can close holes faster. The same numbers are also the reason the model carries the Critical label: OpenAI is saying, in its own framework, that this level of offensive capability needs the tightest controls it has.