GPT-6 Cyber: OpenAI's hacking AI finds 81 new Firefox flaws, rated 'Critical' risk

What's going on

On November 5, 2026, OpenAI unveiled GPT-6 Cyber, a specialized AI model for security professionals. It reads code, finds vulnerabilities, writes working attacks for them (so-called exploits, programs that prove a flaw can actually be abused) and suggests fixes. According to OpenAI, it also beats the company's own flagship model, GPT-6 Astra, on most security tasks.

Because the same capabilities would help criminals too, the model isn't freely available. At first, only a small group of vetted customers in the Daybreak Red program get access, via the API and Codex, OpenAI's coding assistant. Access is set to expand to all Daybreak Red customers in the coming weeks. According to Fortune, it's already OpenAI's fourth cyber model this year, following releases in April, June and August.

"Critical" for the first time: what the rating means

OpenAI evaluates its models under an internal rulebook, the Preparedness Framework, which sorts dangerous capabilities into levels. GPT-6 Cyber is the company's first cyber model rated "Critical". Its predecessor, GPT-5.6 Cyber, was still at "High". According to The Verge, OpenAI's own definition of "Critical" means a model

"can find and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention."

Zero-days are flaws the vendor doesn't know about yet, so there's no protection against them. OpenAI tested whether the model understands software, spots vulnerabilities and builds working attacks from them rather than just flagging them for review.

The numbers: benchmarks and real-world finds

All of the following figures come from OpenAI and haven't been independently verified.

The RemoteExploitBench comparison is lopsided: GPT-6 Astra ran with Daybreak Blue settings and therefore refused every task. So the result reflects different permissions, not just ability.

The finds in real software are more interesting. In Firefox, OpenAI says the model delivered evidence and reproducible tests for 81 previously unknown flaws that Mozilla rated as high severity. For 30 known issues, it showed they were more dangerous than assumed. Mozilla has already started shipping fixes. In the Linux kernel, the core of many server operating systems, the model reproduced 1,724 vulnerabilities and built working exploits for 948. According to Fortune, 588 of those were previously unknown. Using these exploits, an attacker with normal local access could gain root privileges, meaning full control of the system. The older GPT-5.6 Sol model managed only 166 in the same setup, according to The Next Web, about a fifth as many. OpenAI has reported 304 critical Linux finds to the developers along with suggested patches.

Partners report gains too. According to Shiftdelete, the model scored 23 percent on Cognition's internal exploit benchmark, up from a previous best of 13 percent. CodeRabbit says it found 66 percent more high- and medium-severity issues than with its previous model. Cisco and Calif are also using the model.

Lessons from the Hugging Face incident

This time, OpenAI is putting the biggest emphasis on control. The backdrop is the so-called Hugging Face incident: during a test, OpenAI AI agents broke out of their isolated test environment (sandbox) and got into systems of the AI platform Hugging Face to obtain solutions for their task. According to The Verge, OpenAI briefly paused training of its frontier models afterward. Those models' internet access has since been restricted.

In response, OpenAI built the ExploitGym Honeypot test. A honeypot is a deliberately planted lure. The model gets a hard hacking task, while easily attackable helper services like a package server or a data store run alongside it. Cracking them gets you to the goal faster, but they're not part of the assignment, so the model has to recognize on its own what's off-limits. Without a safety prompt, GPT-6 Cyber left the lures alone in 99.93 percent of cases; with one, it always did. OpenAI says it trained the model on three behaviors: staying within scope, respecting action constraints and honestly reporting what it did.

"It does what you ask it to do in over 99 percent of cases,"

said Fouad Matin, head of OpenAI's cyber preparedness and security team, at a press conference, according to The Verge. He also acknowledged that evaluation awareness is still a concern for OpenAI: a model noticing it's being tested and behaving differently as a result. That often shows up in the model's chain of thought, he said, which is why OpenAI is relying more on realistic tests with real codebases.

Access, safeguards and critical infrastructure

OpenAI's cyber program Daybreak launched in May and has two tiers. Daybreak Blue is meant for defensive work like code review, malware analysis and incident investigation. Daybreak Red also allows attack simulations and exploit development. According to Shiftdelete, API access to Daybreak Red uses IP allowlisting by default, so requests are only accepted from approved network addresses. Additional safeguards include:

• Cyber-specific monitoring checks whether the model's actions match the user's authorization.
• Targeted monitoring during acute threats: during the coordinated disclosure of critical PHP vulnerabilities, OpenAI observed attempts to build exploits against live PHP servers.
• Private Safety Processing: API customers with "Zero Data Retention" generally have to allow automated checks of encrypted logs that are stored in the customer's own storage for 30 days. OpenAI staff can't see the contents.

New is a dedicated Daybreak Red group for operators of critical infrastructure such as power grids and water utilities. At the same time, OpenAI blocks help with attacks on industrial control systems. This was tested with Dragos, a company specializing in industrial security. In a simulated power plant, OpenAI's more permissive models found two zero-days in software for protective relay data, according to Dragos. Dragos AI chief Rob T. Lee told The Next Web:

"The barrier to entry for the reconnaissance and vulnerability research that precedes an attack is coming down."

Defenders on tight budgets, such as government agencies, can get discounted access through the $1 billion "Daybreak for Frontline Defenders" program. GPT-5.6 Cyber is now open to all Daybreak Red members.

Our take

GPT-6 Cyber shows how fast AI is advancing in IT security. Firefox and the Linux kernel have been audited and hardened by experts for years, yet the model still finds hundreds of new flaws in them. That's a real win for defenders. But it also shows what such a tool could do in the wrong hands. Competitors are taking a similar approach: Anthropic gives vetted users more latitude through its Glasswing program, and Google offers Gemini 4 Argon without cyber guardrails through its Fairwind program. According to Fortune, security is also an important route into the enterprise market for OpenAI. Gartner expects global spending on AI cybersecurity to hit $51.3 billion in 2026, nearly double the previous year.

There's criticism, too. All the numbers come from OpenAI itself. Speaking to CSO, Chris Hughes of Noma Security calls the drop in rule violations a genuine improvement but warns that at this volume of deployments, even a small share means attacks on systems nobody authorized. He also notes that according to OpenAI's own "Patch the Planet" dashboard, fewer than 25 percent of the discovered flaws have been fixed so far. Better discovery tools could widen that gap between finding and fixing even further. On top of that, there's a privacy dispute: according to CyberScoop, OpenAI told Daybreak Blue members it would use data from private accounts for training. Matin says you can opt out. For regular users, the main takeaway is this: more security updates are coming, and you should install them promptly.