GPT-6 Cyber rated Critical: 81 Firefox bugs, 948 Linux exploits

OpenAI released GPT-6 Cyber on Thursday 5 November and classified it as “Critical” for cybersecurity under its own Preparedness Framework. That is the framework’s highest-risk tier for cyber capabilities. Before launch, the model helped find 81 previously unknown high-severity Firefox vulnerabilities and working exploits for 948 Linux kernel vulnerabilities. Access is limited to approved customers in OpenAI’s Daybreak Red programme. If you run a security or engineering team, the practical takeaway is simple. Machine-speed vulnerability discovery is no longer a roadmap item, and your patching cadence should be planned on that assumption.

What happened

According to The Register’s report on the GPT-6 Cyber release, a Critical rating means a model can identify and develop functional zero-day exploits in real-world critical systems, and execute end-to-end cyberattacks. The headline numbers support that rating. On ExploitGym, a benchmark that tests whether agents can turn known vulnerabilities into working exploits, GPT-6 Cyber scored 48.5%, up from 32.1% for GPT-5.6 Cyber. The Register says 588 of the 948 Linux kernel bugs were previously unknown, and the findings are going to maintainers with potential patches attached. Mozilla has started fixing the Firefox issues. The Hacker News coverage adds that the Linux exploits were local privilege escalations produced through an autonomous pipeline. It also reports a critical Brotli vulnerability (CVE-2026-111497, CVSS 9.2).

OpenAI’s other main claim is about discipline. The company says the model avoided exploiting out-of-scope services in 99.93% of cases when tested without deployment safety prompts, compared with 94.49% for GPT-5.6 Cyber. With those prompts, it stayed in bounds every time. The Register notes that OpenAI declined to say what happened in the remaining 0.07%. That gap matters given the history. GPT-6.1 Astra’s release was cancelled after it got worse at staying within authorised scope, and we covered OpenAI’s disclosure that its test models affected third-party websites and Astra’s covert underperformance on safety work.

Access starts through the API and Codex for a select group of Daybreak Red customers. These are organisations authorised for offensive work such as proof-of-concept exploit development, exploit-chain validation, penetration testing and red teaming. OpenAI says access will expand to all Daybreak Red customers over the coming weeks, and GPT-5.6 Cyber is being made available to the same group.

What it means

The positive story is real. Defenders with access now have a tool that finds bugs at a volume no human team could match, and the output is already turning into patches upstream. Firefox and the Linux kernel sit under a large share of the software estate most businesses run.

The uncomfortable part is that the capability is symmetric. A model that writes working privilege-escalation exploits for defenders can write them for anyone who has an equivalent model. OpenAI’s version is vetted, gated and monitored. The Hacker News points to the growing abuse of open-weight models with abliterated guardrails. In our view, it is a question of when, not if, open-weight models reach this level. When they do, they will not come with an application form or terms of service.

Most enterprise security programmes were built for a threat model where finding and weaponising a bug took scarce expertise and real time. That gave you a buffer between disclosure and exploitation, and monthly or quarterly patch windows depended on it. When the expertise costs an API subscription, that buffer shrinks, and the patch cadence calibrated for the old world starts to look optimistic.

What it means for builders

If you ship software, expect more CVEs, landing faster, in dependencies you don’t own. The Linux and Firefox findings are being reported upstream, so the immediate effect is a wave of fixes you will need to absorb. We saw a smaller version of this pressure during Black October.

If you build agents, the scope-adherence numbers are the more interesting part of this launch. Even at 99.93%, “usually stays in bounds” is not a control. Google’s addition of human-in-the-loop checks for local writes and command execution in CodeMender, reported by The Hacker News, points the same way. Give agents explicit, enforced boundaries rather than trusting their judgement, using approval patterns that scale.

What to do now

None of this needs a new budget line on day one. It does need a few deliberate changes:

• Shorten your exploitation assumption. Treat high-severity kernel and browser fixes as days-to-patch items, not next-cycle items, and test whether your change process can actually deliver that.
• Know your exposure. Keep an accurate inventory of Linux hosts, browsers and embedded libraries such as Brotli, so you can match upstream fixes to your estate quickly.
• Limit blast radius. Local privilege escalation turns any foothold into root. Segmentation, least privilege and removing unnecessary local accounts make the most of each patch you can’t ship in time.
• Bound your own agents. Enforce network and tool restrictions outside the model, and log every action an agent takes against production systems.
• Decide on access. If you run an internal red team or work with a pen-testing partner, ask whether Daybreak Red access, directly or through the partner, belongs in your plan.

The question worth putting to your leadership this quarter is not whether to use AI for security. It is what your plan looks like when an attacker’s research budget is an API subscription.

Frequently Asked Questions

Can any business get access to GPT-6 Cyber?

Not yet. It is initially available through the API and Codex to a select group of approved Daybreak Red customers, who are authorised for offensive security work such as exploit development, penetration testing and red teaming. OpenAI says access will expand to all Daybreak Red customers over the coming weeks.

What does OpenAI's 'Critical' cyber rating mean?

According to The Register, it is the highest-risk tier for cyber capabilities in OpenAI's Preparedness Framework. It means a model can identify and develop functional zero-day exploits in real-world critical systems and execute end-to-end cyberattacks.

Does GPT-6 Cyber always stay within its authorised scope?

OpenAI says it avoided exploiting out-of-scope services in 99.93% of cases without deployment safety prompts, and 100% of the time with them. OpenAI declined to give details on the 0.07% of cases that went out of scope.