OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
OpenAI on Thursday unveiled GPT‑6 Cyber , which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.
OpenAI on Thursday unveiled GPT‑6 Cyber , which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.
It has classified the model as Critical in cybersecurity under its Preparedness Framework.
The artificial intelligence (AI) company said GPT‑6 Cyber is also better than its predecessors like GPT‑5.6 Cyber and GPT‑6 Astra when it comes to following task boundaries and avoiding exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT-5.6 Cyber.
OpenAI said the model enabled the discovery of 948 local privilege escalation exploits in Linux through an autonomous pipeline, along with 81 previously unknown high-severity vulnerabilities in Mozilla Firefox and a critical vulnerability in Brotli (CVE-2026-111497, CVSS score: 9.2).
As of last month, the company announced plans to use content from Daybreak Blue sessions on personal accounts starting November 29, 2026, to even when the improve the model for everyone setting is off.
GPT-6 Cyber is initially available through the API and Codex to select Daybreak Red customers as part of efforts to make the best cybersecurity-focused models available with an aim to help secure software before bad actors have a chance to detect and exploit vulnerabilities using AI-assisted approaches.
OpenAI said it has implemented more guardrails to flag misuse and ensure the model's actions fall within the scope of the user's intent and authorization.
The risk is compounded by the growing abuse of open-weight models with abliterated guardrails .
Google, for its part, has introduced new capabilities to CodeMender, its autonomous code-security agent, to enable secure isolation and flexible scanning, while adding human-in-the-loop checks for local write and command execution to mitigate the risks of malicious exploits.
It also scores 48.5% on ExploitGym, a cybersecurity benchmark that evaluates the capabilities of AI agents to autonomously turn known software vulnerabilities into functioning, real-world exploits.
Were there enough CVEs reported to keep you busy for the rest of the year or are you finished and ready for another round next week?
They released the regularly scheduled update nearly two and a half hours late, but Microsoft did resolve another record-breaking 1,407 unique CVEs.
PHP is a general-purpose scripting language which was originally released in 1994 to support web development; pHP released a security advisory on October 21st regarding the vulnerabilities and the related PHP software versions that had been fixed.
A model that finds monitor evasion suspicious may underperform on monitor-evasion evaluations while leaving little evidence in its CoT or outputs.
What happened
OpenAI on Thursday unveiled GPT‑6 Cyber , which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.
It has classified the model as Critical in cybersecurity under its Preparedness Framework.
The artificial intelligence (AI) company said GPT‑6 Cyber is also better than its predecessors like GPT‑5.6 Cyber and GPT‑6 Astra when it comes to following task boundaries and avoiding exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT-5.6 Cyber.
What changed
OpenAI said the model enabled the discovery of 948 local privilege escalation exploits in Linux through an autonomous pipeline, along with 81 previously unknown high-severity vulnerabilities in Mozilla Firefox and a critical vulnerability in Brotli (CVE-2026-111497, CVSS score: 9.2).
As of last month, the company announced plans to use content from Daybreak Blue sessions on personal accounts starting November 29, 2026, to even when the improve the model for everyone setting is off.
Who is affected
GPT-6 Cyber is initially available through the API and Codex to select Daybreak Red customers as part of efforts to make the best cybersecurity-focused models available with an aim to help secure software before bad actors have a chance to detect and exploit vulnerabilities using AI-assisted approaches.
OpenAI said it has implemented more guardrails to flag misuse and ensure the model's actions fall within the scope of the user's intent and authorization.
Why it matters
The risk is compounded by the growing abuse of open-weight models with abliterated guardrails .
Google, for its part, has introduced new capabilities to CodeMender, its autonomous code-security agent, to enable secure isolation and flexible scanning, while adding human-in-the-loop checks for local write and command execution to mitigate the risks of malicious exploits.
Technical details
It also scores 48.5% on ExploitGym, a cybersecurity benchmark that evaluates the capabilities of AI agents to autonomously turn known software vulnerabilities into functioning, real-world exploits.
Were there enough CVEs reported to keep you busy for the rest of the year or are you finished and ready for another round next week?
They released the regularly scheduled update nearly two and a half hours late, but Microsoft did resolve another record-breaking 1,407 unique CVEs.
Response
PHP is a general-purpose scripting language which was originally released in 1994 to support web development; pHP released a security advisory on October 21st regarding the vulnerabilities and the related PHP software versions that had been fixed.
What security teams should do
A model that finds monitor evasion suspicious may underperform on monitor-evasion evaluations while leaving little evidence in its CoT or outputs.
Exploitation in the wild was detected several days before the patches were released and is continuing to expand.
What remains unknown
OpenAI said the model enabled the discovery of 948 local privilege escalation exploits in Linux through an autonomous pipeline, along with 81 previously unknown high-severity vulnerabilities in Mozilla Firefox and a critical vulnerability in Brotli (CVE-2026-111497, CVSS score: 9.2).
Attribution
The Hacker News: OpenAI on Thursday unveiled GPT‑6 Cyber , which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.
Help Net Security: How did you enjoy October 2026 Patch Tuesday ?
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.