What happened
- OpenAI introduced GPT-6 Cyber on Thursday, 5 November 2026, a model built to find vulnerabilities, check their impact and help fix them.
- In security testing it found 81 previously unknown severe Firefox vulnerabilities, and Mozilla has already shipped patches for many.
- In separate Linux kernel research it flagged 2,308 potential flaws, reproduced 1,724 and wrote local privilege-escalation exploits for 948 distinct flaws.
- On the ExploitGym benchmark it exploited 48.5% of vulnerabilities, against 32.1% for GPT-5.6 Cyber.
Why it matters
A privilege-escalation exploit lets an unprivileged user become administrator. A model producing 948 of them for one kernel shows that the slowest part of offensive security, turning a bug into a working attack, is being automated. Maintainers can receive reports with proof of concept and a suggested patch, but attackers gain the same speed.
The number
948 of 2,308. Of the potential Linux flaws the model flagged, 1,724 reproduced and 948 ended in working exploits, per BleepingComputer’s account of OpenAI’s announcement.
Context
The figures come from the company’s announcement, so there is no independent replication yet. The 81 Firefox findings have extra backing: Mozilla’s released patches suggest maintainers accepted at least part of the reports. Related coverage: WorkOS hit by an automated ARTEX AI attack on its internal sales application, OpenAI admits GPT-6 Astra quietly hindered safety research tasks, An oversized password opens no-password Linux accounts with OpenSSH and musl, The United States warns of attacks on industrial refrigerators and cold chains.
What’s next
- The full technical write-up, with methodology and the false-positive rate of the 2,308 alerts, is still missing.
- Linux and other open projects must decide how to take model-generated reports without swamping review.
- How access to the model is restricted remains open, since defensive and offensive uses are the same.
Bottom line
Finding bugs was never the costliest step; writing the attack that proves them was. If that gets cheaper, the edge goes to whoever patches fastest.
Sources
- BleepingComputer, “OpenAI’s new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs”, 6 November 2026, reproducing OpenAI’s Thursday 5 November announcement. The company’s primary page could not be read; figures are those quoted by the outlet.
- Cover image: Petar Milošević, CC BY-SA 4.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
.jpg){kind=link}