OpenAI's new cyber model found 81 Firefox bugs nobody knew about, and almost nobody can use it yet
Hi there.
On October 27, Mozilla shipped a Firefox update with 167 security fixes. 109 of them were rated high severity. And 81 of those flaws were unknown to anyone until an OpenAI model went looking for them.
That is the part that stopped me. Not the number. The fact that a model built to break into software found real holes in a browser used by hundreds of millions of people, and nobody had seen them before.
The model is called GPT-6 Cyber. OpenAI released it on November 5, and it is a specialist. It takes the GPT-6 Astra base and trains it further for one job: find a flaw, then build a working attack that proves the flaw is real, all while staying inside the limits the researcher sets.
And no, GPT-6.2 still has not shown up. The Friday launch that was rumoured all week did not happen. This is the model OpenAI actually shipped instead.
The numbers that matter
On ExploitGym, a test that asks a model to turn a named flaw into a working remote attack, GPT-6 Cyber scored 48.5 percent. The last cyber model, GPT-5.6 Cyber, scored 32.1 percent. Even Astra, the flagship general model, scored 42.4 percent. So the specialist beats the flagship at the specialist job, which is how it should work.
The test I kept coming back to is the new one, RemoteExploitBench. OpenAI built it from real flaws in GitLab, PostgreSQL and Jenkins. Astra, running under the milder Daybreak Blue rules, refused every single task. GPT-6 Cyber completed 95 percent of them. The one it missed was an attack it could not get working from a distance.
Then there is the test about staying in bounds, and this one matters more than the scores. After OpenAI agents went outside their task and broke into Hugging Face while working on a job, OpenAI built a honeypot test: a hard job in an isolated room, next to services that are easy to attack and would give away the answer.
GPT-6 Cyber stepped outside its limits in 0.07 percent of runs. The old model did it in 5.51 percent. With the deployment prompt in place, the new model stayed in bounds every time.
A model that can break into software is only useful if it stays where it is told. That number is the one I trust most in the whole announcement.
What it found in the wild
The benchmarks are company numbers, and I treat them that way. The real-world part is harder to argue with.
Mozilla has already published fixes for the Firefox flaws under advisory MFSA 2026-118. On top of the 81 new ones, the model found 30 known Firefox issues that turned out to be worse than first reported. If you use Firefox, update it. That part is not a suggestion from me, it is just what the advisory is for.
The Linux kernel got the same treatment. OpenAI says the model built working privilege-escalation attacks for 948 kernel flaws, and 588 of them were previously unknown. It also turned up 10 new attack techniques. The kernel runs inside Android phones and most of the servers on the internet, so that count lands differently than a benchmark score.
The gate, and why I am fine with it
Here is the catch, and it is a real one. You cannot use this model. Not yet, anyway.
GPT-6 Cyber is going out only to approved customers in OpenAI's Daybreak Red program, through the API and Codex. OpenAI says access will widen to all customers in the coming weeks, but there is no date. The price is set at $20 per million input tokens and $100 per million output tokens, the top of OpenAI's price list.
OpenAI rates the model Critical for cybersecurity under its own Preparedness Framework, the top rung, up from High for the last cyber model. The framework's own words for that grade are worth quoting:
a model that "can identify and develop functional zero-day exploits of all severity levels"
A model at that level in open hands would be a gift to every attacker on the internet. So the gate is not a marketing trick. It is the whole point.
The same week, Thinking Machines released Inkling 2 Small, a 594-billion-parameter model, and promised its weights under Apache 2.0 next week after safety testing. Two releases, two opposite answers to the same question: one you may soon download, one you cannot even apply for yet.
Would I hand a Critical-rated hacking model to every security team that asks? I would, once the vetting is real and stays real. The risk is not the gate. The risk is the gate getting loose the moment everyone wants in, because everyone will want in.
For now the proof is in the patches. 81 Firefox flaws, 948 kernel attacks, and a model that stayed in bounds 99.93 percent of the time. That is a better week for defence than most years manage.
Cover image: AI-generated