OpenAI Launches GPT-6 Cyber With Critical Rating After Model Builds 948 Linux Kernel Exploits and Finds 81 Firefox Flaws

Introduction

On November 5, 2026, OpenAI released a new security-focused artificial intelligence model called GPT-6 Cyber, and in the same announcement it gave the model the highest cybersecurity risk rating in its own framework. The release matters because the model is not a general chatbot with a new name. It is a specialised system built to search software for weaknesses, turn those weaknesses into working demonstrations, and then propose fixes, a combination that has long been one of the most sensitive capabilities in computing. OpenAI says the model found 81 previously unknown high-severity flaws in the Firefox web browser and built working exploits for 948 vulnerabilities in the Linux kernel, numbers that would be striking for a team of human researchers and are remarkable for a single automated system. The company also says it is keeping the model behind a closed door, available at first only to a small group of approved customers in its Daybreak Red programme, because the same ability that helps defenders patch software faster could also help attackers break into it. The launch therefore sits at the centre of two arguments at once: one about how quickly artificial intelligence can now do the hardest parts of security research, and another about who should be allowed to use that power. The OpenAI GPT-6 Cyber Critical rating November 2026 is the detail that ties those two arguments together.

1. What OpenAI Released on November 5

OpenAI introduced GPT-6 Cyber on Thursday, November 5, 2026, as a variant of its GPT-6 Astra model that has been purpose-trained for authorised vulnerability research. The company describes it as a model that can find flaws in software, develop working exploits that prove the flaws are real, and propose patches that fix them. That is a narrower job than the one general-purpose models are built for, and OpenAI says the specialisation is the point: a system tuned for security work can go deeper into code than a general model, and it can be tested against the same tasks again and again so its progress can be measured.

1.1 A security model built on GPT-6 Astra

GPT-6 Cyber builds on GPT-6 Astra, the broader model family OpenAI has been developing through 2026, and it shares Astra’s preparedness ratings in most areas. Reports of the launch say the model was trained specifically for the work of security researchers, which means finding vulnerabilities, writing proof-of-concept tests that show how a flaw can be used, and drafting the code changes that close it. OpenAI says the model stays within the limits researchers set far more reliably than earlier systems, a claim that matters because an autonomous security agent that wanders outside its instructions could damage the very systems it is meant to test. The company presents the model as a research instrument rather than a product for everyday users, and that framing shapes everything else about the release, from who gets access to how its results are described.

1.2 What Critical means under the Preparedness Framework

OpenAI rates its models under a system it calls the Preparedness Framework, and Critical is the top tier for cybersecurity risk. GPT-6 Cyber is the first of the company’s cyber models to reach that level, one step above the High rating given to its predecessor, GPT-5.6 Cyber. The rating does not mean the model has caused harm. It means OpenAI’s own evaluation found that the model’s capabilities cross a threshold the company set in advance, a threshold tied to building working exploits with little human help. GPT-6 Cyber shares its other preparedness ratings with GPT-6 Astra, including High for biological and chemical risk and below High for AI self-improvement, according to reports of the launch. The Critical label is therefore both a technical judgement and a policy trigger: it is the reason the model is being released behind restrictions instead of being offered widely.

2. The Numbers Behind the Launch

The announcement was built around a small set of large numbers, and OpenAI reported all of them itself. The most quoted figures are 948 working exploits in the Linux kernel and 81 previously unknown high-severity flaws in Firefox, but the company also reported a benchmark score, a cost figure and a disclosure count. None of these figures has been independently verified by an outside auditor, and that caveat belongs in any honest account of the release, because the numbers come from the same company that built the model.

2.1 948 working Linux kernel exploits

OpenAI says its researchers used GPT-6 Cyber to reproduce 1,724 Linux kernel vulnerabilities and to develop working exploits for 948 of them. The exploits were local privilege-escalation attacks, the kind that can allow an unprivileged local user to obtain root access in a test environment. More than five times as many as the 166 exploits that GPT-5.6 Sol managed with the same research setup, according to OpenAI, and 588 of the 948 flaws were previously unknown. The company says it disclosed 304 critical findings to Linux kernel maintainers together with candidate patches, which is the part of the work that turns a demonstration into a defence. The figures do not mean that 948 new remotely exploitable flaws have been released into the wild, and OpenAI’s own account presents the work as research conducted in a controlled pipeline rather than as a public release of attack code.

2.2 81 unknown Firefox flaws

In the Firefox web browser, OpenAI says the model produced evidence and reproducible tests for 81 new vulnerabilities that Mozilla classed as high severity, and it showed that 30 known issues were worse than originally reported. Mozilla has separately confirmed working with frontier models from OpenAI and Anthropic to accelerate Firefox security fixes, and reports say Mozilla has already shipped fixes for several of the flaws OpenAI found. The Firefox result is important for a different reason than the Linux numbers: a browser flaw can affect hundreds of millions of ordinary users, so a system that finds them faster has an immediate practical value for the people who maintain the software. It also shows the model working on a large, real codebase rather than only on prepared test cases.

3. How the Model Was Tested

OpenAI’s claims rest on tests it designed itself, and the company has described the testing in unusual detail. The central benchmark is called ExploitGym, which measures whether a model can exploit a specified vulnerability, and the company also ran a longer autonomous research pipeline over the Linux kernel. Both sets of results are company-reported, and no independent body has yet published its own replication of them.

3.1 ExploitGym and the 48.5 percent score

On ExploitGym, GPT-6 Cyber scored 48.5 percent, compared with 32.1 percent for GPT-5.6 Cyber and 42.4 percent for GPT-6 Astra. That is a gain of about 16 percentage points over the previous cyber model, or roughly a 51 percent relative improvement, and it puts the security-specialised model ahead of the general model it was built from. The benchmark tests a specific skill: given a known vulnerability, can the model produce a working exploit for it. A score below half may look modest, but in this field it represents a large jump, because each additional point covers flaws that earlier systems could describe but not demonstrate. OpenAI also reports that the model completed 95 percent of exploit-development tasks on a newer test it calls RemoteExploitBench, a figure that again comes from the company’s own evaluation.

3.2 The mid-October autonomous Linux kernel run

The Linux numbers came from an autonomous run in mid-October 2026, in which the model reviewed 2,308 candidate findings in the latest Linux kernel development code and produced working local privilege-escalation exploits for 948 distinct flaws. OpenAI reports the run cost about 1,213,430 dollars in API credits, or about 1,279 dollars per exploit, a figure that turns an abstract capability into a price. The pipeline searched for candidate flaws, reproduced them, attempted to turn them into working exploits, and in the cases it judged critical, sent findings and proposed patches to the kernel maintainers. The company says its researchers used the model in a controlled research setup with defined limits, and it presents the cost figure as evidence that this kind of automated research is now cheap enough to run at scale, which is both the promise and the worry.

4. Why Access Is Gated to Daybreak Red

GPT-6 Cyber is not available to the general public, and OpenAI has not said when, or whether, it will be more widely available. Access at launch goes through the company’s API and Codex to a select group of approved Daybreak Red customers, with access expanding to all Daybreak Red customers over the coming weeks. Daybreak Red is OpenAI’s most restricted access tier for offensive-security researchers, reserved for vetted professionals conducting authorised testing.

4.1 Who gets in first

The first customers are approved Daybreak Red members, and reports of the launch say the programme requires identity checks, organisational security requirements and API IP allowlisting. That is a far higher bar than the usual sign-up for an AI product, and it is deliberate: OpenAI is treating the model as a controlled capability rather than a consumer feature. The company has not published a list of the first customers, and it has not given a date for any broader release. For most readers, that means the model cannot be used today, and the launch is a story about what exists behind a closed door rather than a tool they can try.

4.2 The safeguards OpenAI says it added

OpenAI says it has added safeguards for industrial controls, essential services, election systems and other high-risk targets, and it reports that the model refuses or redirects work that falls outside authorised research. One company figure quoted in reports of the launch said the model does what it is asked more than 99 percent of the time in a scope-compliance test, although that test covered only a specific honeypot evaluation and the number is OpenAI’s own result. The company also says the model is designed to stay within the limits researchers set, a property it calls scope compliance. These safeguards are part of the reason the Critical rating did not block the release entirely: OpenAI’s position is that the model can be deployed safely to vetted users with the right controls, even though the same capability would be dangerous in unrestricted hands.

5. What This Means for Defenders

For the people who defend software, the launch is mostly good news, and OpenAI has framed it that way. A model that can find flaws, prove they are real and propose fixes could shorten the time between a vulnerability being introduced and being patched, which is the window in which attackers do their damage. The Firefox and Linux results are the evidence offered for that claim, and the maintainers who received the findings are the first beneficiaries.

5.1 Faster patching for open-source software

Open source projects such as Linux and Firefox depend on a small number of maintainers reviewing an enormous amount of code, and a system that can scan that code, reproduce flaws and draft patches could change the balance of that work. OpenAI says it disclosed 304 critical Linux findings with candidate patches, and Mozilla is already shipping fixes for some of the Firefox flaws the model found. If that pattern holds, the practical effect is that vulnerabilities which might have waited months for a human researcher to find could be surfaced and fixed in weeks. That is the optimistic reading of the launch, and it is the reading OpenAI itself emphasises.

5.2 A new tool for authorised security teams

For professional security teams, GPT-6 Cyber is a new kind of instrument: an agent that can be pointed at a codebase and asked to do the slow, repetitive parts of vulnerability research at a scale no human team can match. The reported cost of about 1,279 dollars per working exploit suggests that a thorough security review which once required a large team and a large budget could become affordable for smaller organisations, provided they can pass the Daybreak Red vetting. That could raise the standard of security testing across the industry, because teams that could not afford deep testing might now be able to run it. The limit, for now, is the gate: only vetted researchers get the tool, so the benefit reaches the industry unevenly.

6. The Dual-Use Debate

The same capability that helps defenders also helps attackers, and that is the central tension of the release. A tool that builds working exploits for about 1,279 dollars each does not stop being that tool when it changes hands, and critics of the launch have pointed out that every safeguard OpenAI describes depends on the model staying inside the controlled environment the company has built for it. This is the dual-use problem in its purest form, and it is why the Critical rating matters.

6.1 Why the same capability worries critics

The worry is straightforward: if a model can find unknown flaws in Firefox and build working exploits for hundreds of Linux kernel vulnerabilities, then the same model in the wrong hands could find flaws that have not yet been patched and use them before defenders can respond. The cost figure makes the worry sharper, because it suggests that large-scale vulnerability discovery is no longer limited to well-funded intelligence agencies or the largest technology companies. Reports of the launch note that the figures are all company-reported and none has been independently verified, which adds a second layer of uncertainty: the public is being asked to trust both the capability and the safeguards on the basis of OpenAI’s own account. That is not a reason to dismiss the claims, but it is a reason to treat them as claims rather than settled facts.

6.2 How OpenAI answers the risk

OpenAI’s answer is gating: only vetted Daybreak Red customers get access, with identity checks, organisational security requirements and IP allowlisting, and the model is not available off the shelf. The company also says it has added safeguards for high-risk targets such as industrial controls, essential services and election systems, and that it discloses the flaws it finds to maintainers with proposed patches rather than publishing exploit code. That approach follows the established practice of coordinated disclosure, in which a researcher tells the vendor first and gives them time to fix the problem before it becomes public. Whether gating is enough is the question the industry will be debating for months, and the answer will depend on whether the controls hold as the model is used more widely inside the programme.

7. What Comes Next for GPT-6 Cyber

The launch is a beginning rather than a finished story. OpenAI has said access will expand to all Daybreak Red customers over the coming weeks, but it has given no timetable for anything beyond that, and the wider questions about verification, competition and regulation are still open. The next few months will show whether the model’s results hold up under outside scrutiny and whether other companies follow the same path.

7.1 Wider Daybreak Red access

The immediate next step is the expansion of access within Daybreak Red, from the select group of approved customers at launch to the full membership of the programme. That expansion will put the model in the hands of more professional researchers, which should produce more findings and more patches, and it will also test whether the safeguards and the vetting process work at a larger scale. OpenAI has not said how many customers are in the programme, and it has not said what criteria it will use to decide whether the expansion is working. For the security community, this is the most concrete thing to watch: the number of real flaws found and fixed by outside users will say more about the model than any benchmark score.

7.2 What rivals and regulators may do

Other AI companies are building their own security models, and Anthropic is among those working in the same area, with Mozilla confirming it works with frontier models from both OpenAI and Anthropic on Firefox security. If GPT-6 Cyber proves useful, competitors are likely to announce their own systems, and the question of who gets access to each one will become an industry-wide argument rather than a decision by one company. Regulators are also watching: a model rated Critical for cybersecurity is exactly the kind of system that governments have said they want to understand better, and the dual-use debate around GPT-6 Cyber is likely to feed into wider discussions about how powerful AI capabilities should be controlled. None of that has been decided, and the launch itself does not answer it.

8. What Remains Unconfirmed and What to Watch Next

Much of the story is still unverified, and the honest way to end is to say so plainly. The most important facts in the launch are OpenAI’s own claims, and the company’s own reporting says so: every benchmark score, every flaw count and every cost figure comes from OpenAI or its partners, and no independent audit has yet been published. That does not make the claims false, but it does mean they should be read as the opening of a conversation rather than its conclusion.

8.1 Independent verification of the claims

The first thing to watch is whether independent researchers or auditors can reproduce OpenAI’s results. Mozilla’s confirmation that it is shipping fixes for some of the Firefox flaws is a partial check, because it shows that at least some of the findings were real enough to act on, but it does not independently restate the full tally of 81 flaws or the 948 Linux exploits. A fuller verification would require outside access to the model or to the underlying findings, and OpenAI has not said whether it will provide that. Until such a check exists, the numbers should be reported with the attribution attached, as OpenAI’s own results.

8.2 Whether wider access ever arrives

The second thing to watch is whether GPT-6 Cyber ever leaves the Daybreak Red gate. OpenAI has not said when, or whether, it will be more widely available, and the Critical rating suggests the company is in no hurry. If the model stays restricted, its benefits will flow mainly to the organisations that can pass the vetting, and the wider security community will have to judge the technology from the outside. If access widens, the dual-use debate will sharpen, because the same capability that helps defenders will be available to a much larger group. Either way, the launch of GPT-6 Cyber marks a moment when artificial intelligence crossed a line in security research, and the industry is now deciding what to do on the other side of it.

OpenAI’s GPT-6 Cyber is a powerful and carefully restricted new tool, and the facts that matter most are still the ones the company itself reported: a Critical cybersecurity rating, 948 working Linux kernel exploits, 81 previously unknown Firefox flaws, and access limited to vetted Daybreak Red researchers. Those numbers have not been independently verified, the wider release has no timetable, and the safeguards have not yet been tested at scale. What is certain is that the model shows how fast automated security research is advancing, and that the question of who should hold that power is now one of the most important arguments in technology.

Comments

comments