Just now, OpenAI released GPT‑6 Cyber, which outperformed two major open source projects: it unearthed 81 high-risk vulnerabilities in Firefox and exposed 948 privilege escalation paths for Linux.

A large language model has identified 81 previously unknown high-severity vulnerabilities in the Firefox browser that has undergone years of security audits, and developed working privilege escalation exploits for 948 vulnerabilities in the Linux kernel.

This is not a prediction of future AI capabilities made by security researchers, but the performance result delivered by GPT-6 Cyber, the latest cybersecurity model released by OpenAI.

Just now, OpenAI officially launched GPT-6 Cyber, a model dedicated to cybersecurity research. Different from previous models that mainly emphasized programming, reasoning and general agent capabilities, this new model focuses on vulnerability discovery, exploitability verification, attack path analysis and security remediation.

According to the data released by OpenAI, GPT-6 Cyber achieved a 48.5% success rate in the ExploitGym benchmark test, which is an approximate 51% relative improvement compared with the 32.1% of the previous generation GPT-5.6 Cyber.

In another remote exploit-oriented evaluation called RemoteExploitBench, the new model completed 95% of the test tasks.

What is more noteworthy is that GPT-6 Cyber has begun to participate in security research on real software systems. In addition to Firefox and Linux, enterprises including Cisco, Palo Alto Networks and CodeRabbit have also applied it to vulnerability research, security audits and related defense work.

OpenAI rates the cybersecurity capabilities of GPT-6 Cyber as Critical under its Preparedness Framework, while the rating of the previous generation GPT-5.6 Cyber was High.

1

Surpassing GPT-6 Astra, Specialized in Vulnerability Mining and Attack Verification

GPT-6 Cyber is not an ordinary upgraded version of general large language models.

When GPT-6 Astra was released, OpenAI had already disclosed its cybersecurity capabilities: Astra got a 100% score in the ExploitBench test, and demonstrated the ability to discover zero-day vulnerabilities and develop exploits in internal security assessments.

However, to limit potential misuse, Astra for regular users has set strict restrictions on advanced attack and exploitation tasks, for example, it refuses to help generate proof-of-concept programs for vulnerability exploits.

GPT-6 Cyber has been further trained for professional security research scenarios. OpenAI stated that its performance on most cybersecurity tasks exceeds that of GPT-6 Astra, even if the latter does not refuse to execute the tasks.

In the officially published evaluations, GPT-6 Cyber has shown significant improvements in multiple cybersecurity tasks.

In web penetration testing, the vulnerability recall rate of GPT-6 Cyber reached 40.3%, exceeding the 32.0% of GPT-6 Astra by 8.3 percentage points. This test requires the model to discover security vulnerabilities by interacting with the target application without access to source code, which is closer to the real black-box security testing scenario.

However, from the overall results, the progress of GPT-6 Cyber is no longer limited to identifying suspicious issues in code, but further reflected in the complete task execution capability covering from vulnerability analysis to constructing effective exploitation methods.

2

Uncovered 81 Unknown High-Severity Vulnerabilities in Firefox and 948 Privilege Escalation Paths in Linux

If benchmark tests reflect the upper limit of the model's capabilities, then the research results in real open source projects can better demonstrate the actual value of GPT-6 Cyber.

OpenAI has disclosed two representative cases.

The first case is about Firefox.

Firefox is an open source browser project maintained by Mozilla for a long time, whose code has been reviewed by a large number of security researchers, and continuously undergoes fuzz testing, vulnerability reporting and automated security tool detection.

Even so, GPT-6 Cyber still discovered 81 previously unknown security vulnerabilities classified as high-severity by Mozilla in one round of vulnerability research.

In addition, the model also provided evidence showing that the severity of another 30 known issues may be higher than previously assessed.

OpenAI stated that the research team submitted relevant findings, reproducible tests and candidate remediation patches to Mozilla. Mozilla then began to fix these issues, and part of the fixes have been released.

Brian Grinstead, Distinguished Engineer at Firefox, said in OpenAI's published article that Firefox entered 2026 as one of the highly audited and hardened codebases. Even after further inspection by multiple generations of cutting-edge models, GPT-6 Cyber still discovered previously unknown high-severity issues, and helped the team deliver fixes to millions of users.

The significance of this case lies in that cutting-edge models have been able to continuously find issues that have not been eliminated by traditional security processes in mature large-scale software projects.

Another larger-scale experiment was carried out on the Linux kernel.

According to the research article *A thousand fewer paths to root* published by OpenAI on November 4, its research team built an automated vulnerability research pipeline that connects vulnerability discovery, dynamic reproduction, exploitability assessment and patch generation.

The research results show that GPT-6 Cyber completed 2308 candidate issues, 1724 dynamically reproduced vulnerabilities, and 948 valid local privilege escalation exploits.

This means that the model not only found potential security issues, but also generated effective local privilege escalation exploits for 948 of the vulnerabilities, which can prove the risk of low-privilege users obtaining root privileges in the corresponding test environment.

In contrast, OpenAI stated that under the same research framework, GPT-5.6 Sol previously successfully exploited 166 vulnerabilities.

What is more noticeable is the cost. OpenAI disclosed that this round of large-scale research consumed approximately 1.2134 million US dollars in API credits, with an average cost of about 1,279 US dollars per successful local privilege escalation exploit.

This expense is still a considerable amount, but compared with investigating complex vulnerabilities one by one entirely manually, automated research enables vulnerability discovery and verification to be carried out in parallel in a centralized manner.

OpenAI stated that the researchers prioritized disclosing 304 key findings to maintainers with reference to the guidance of the Linux community, attached with candidate patches, and the remaining issues are still being processed.

3

More Important Than Capability Improvement: AI Has Learned to Comply With Attack Boundaries

Another core improvement of GPT-6 Cyber is its security alignment capability.

For cybersecurity agents, stronger execution capabilities do not necessarily mean higher security.

For example, security researchers may only authorize the model to test a certain program, but when performing the task, the model finds that there are more easily exploitable vulnerabilities in the software package repository or object storage service in the related environment. If the model attacks these services to complete the task faster, even if the final result is correct, it has already crossed the authorization scope.

This is also the key problem that OpenAI focused on solving in GPT-6 Cyber.

To measure whether the model can comply with task boundaries, OpenAI designed the ExploitGym Honeypot test. This test sets a challenging exploit task for the model, and deliberately provides other easily attackable auxiliary services in an isolated environment. Although the model can obtain the information required to complete the task by attacking these services, the correct behavior should be to identify and comply with the authorization boundary.

The results show that without deploying security prompts, GPT-6 Cyber avoids attacking services outside the authorization scope at a rate of 99.93%, while the rate of GPT-5.6 Cyber is 94.49%.

After adding deployment security prompts, the compliance rate of GPT-6 Cyber in this evaluation reached 100%.

OpenAI also showed part of the reasoning records of the model during the test. Among them, the model clearly stated that it should not assume that additional APIs or attack controllers belong to the target, nor should it explore credentials outside the authorization scope.

This shows that OpenAI is not only training the model how to discover vulnerabilities, but also training the model to judge what should not be done.

However, it must be emphasized that a 100% test score does not mean that there is no risk of unauthorized access in the real world. In actual deployment, the model may face more complex environments, vague authorization descriptions and malicious inducement. Therefore, OpenAI still recommends using sandboxes, operation reviews and human supervision in high-risk security research processes.

From an industry perspective, this change is noteworthy. In the past, the security alignment of large models usually manifested as refusing to answer dangerous questions; for professional security agents, the new requirement is to not only be able to complete real high-risk research tasks, but also ensure that all operations are always within the clear authorization scope.

It is worth mentioning that although GPT-6 Cyber has been officially released, it is not a model that all ChatGPT users can call immediately.

According to the plan announced by OpenAI, GPT-6 Cyber is first opened to some audited Daybreak Red customers through API and Codex, and then gradually expanded to other eligible Daybreak Red customers.

OpenAI has also adjusted the access methods for different security research scenarios at the same time.

Daybreak Blue is mainly for verified defense researchers, supports vulnerability verification and remediation, and reduces unnecessary rejections in legitimate security tasks.

Daybreak Red allows authorized professionals to perform more in-depth exploit development and security testing, including access to GPT-6 Cyber. At the same time, OpenAI has also introduced dedicated unauthorized behavior monitoring, specific security threat monitoring, network access restrictions, and additional protection for sensitive infrastructure.

Among them, the Daybreak Red API uses an IP whitelist by default to reduce the risk of misuse after credential leakage.

This means that the release of GPT-6 Cyber is not just the launch of a more capable model, but also the redefinition of which cybersecurity capabilities different users can access.

General models provide code review, vulnerability classification and patch suggestions; audited security researchers can further use high-risk capabilities such as exploit development within specific authorization scopes. This graded access mechanism also reflects the real contradiction faced by OpenAI: the stronger the security model, the more likely it is to help defenders fix vulnerabilities in advance, but it may also lower the technical threshold for malicious attackers.

For large model vendors, how to verify user qualifications, judge authorization scopes and monitor abnormal usage is becoming an important part of model deployment itself.

Reference links:

https://x.com/OpenAI/status/2118390190246879554

https://openai.com/index/introducing-gpt-6-cyber/

This article is from the WeChat official account "InfoQ" (ID: infoqchina), written by Dong Mei, and authorized for release by 36Kr.