Back

12/11/2026

GPT-6 Cyber: 948 Linux kernel exploits, 81 Firefox flaws, and what it means for defenders

OpenAI says GPT-6 Cyber built 948 Linux kernel privilege-escalation exploits. What the numbers prove, what they don’t, and what Linux teams should do.

On November 5, 2026, OpenAI released GPT-6 Cyber, a version of its GPT-6 Astra model trained for security work: finding vulnerabilities, writing exploits and testing web applications. OpenAI says its researchers used the model to build 948 working privilege-escalation exploits for the Linux kernel and to find 81 previously unknown high-severity vulnerabilities in Firefox.

The model is sold only as a tool for authorized security testing, and only to approved customers. For teams that run Linux in production, the more important point is a different one: AI systems are now finding and exploiting real bugs in the software they depend on. This article looks at what OpenAI has published, what the numbers do and do not prove, and what Linux teams should do about it.

Key takeaways

  • OpenAI rates GPT-6 Cyber “Critical” for cybersecurity under its Preparedness Framework, the same rating as GPT-6 Astra and one level above GPT-5.6 Cyber.
  • The 948 figure counts working local privilege-escalation exploits, not 948 new bugs. Press reports say 588 of the underlying vulnerabilities were previously unknown.
  • In OpenAI’s own scope test, the model attacked an out-of-scope system in 0.07% of runs without safety instructions, and in none with them.
  • Access needs Daybreak Red approval, single sign-on, multi-factor authentication and, by default, an IP allowlist for the API.
  • All figures come from OpenAI. None has been confirmed independently.

What GPT-6 Cyber is and why OpenAI gated it

According to OpenAI’s system card, GPT-6 Cyber is GPT-6 Astra with extra training on tasks such as reproducing crashes, developing working exploits and searching codebases for vulnerabilities. The same training is meant to make it refuse less often when a security request is authorized.

OpenAI classifies the model as Critical in cybersecurity, the highest level in its Preparedness Framework. GPT-6 Astra already carries that rating; the previous security model, GPT-5.6 Cyber, was rated High. That rating is the reason for the restrictions. The system card lists them:

  • Only users and organizations approved for the Daybreak Red program can use the model, through the API and Codex. At launch that is a selected group, and OpenAI says it will extend access to all Daybreak Red customers in the coming weeks.
  • Organizations must use single sign-on, multi-factor authentication, managed devices and least-privilege access.
  • API access requires an IP allowlist by default, so that stolen credentials are harder to use.
  • Individual researchers need identity checks and a physical FIDO2 security key.

The price reported from OpenAI’s API pages is $20 per million input tokens and $100 per million output tokens.

The headline numbers, and what they prove

The two results that made the news come from OpenAI’s announcement, not from an outside test.

Linux kernel. As BleepingComputer reports the figures, the model flagged 2,308 possible security flaws in the kernel, reproduced 1,724 of them, and produced local privilege-escalation exploits for 948. A local privilege-escalation exploit lets a user who already has an unprivileged account on a machine become root. CSO reports that 588 of the 948 vulnerabilities were previously unknown, and other reports say OpenAI sent 304 critical findings to the kernel maintainers together with proposed patches.

So “948” is a count of working exploits. It is not a count of new bugs, and several headlines mixed the two. Both numbers matter, for different reasons. The 588 unknown bugs show discovery at scale. The exploits for bugs that were already known show something that affects every operations team: the time between a public fix and a working exploit is getting shorter.

Firefox. OpenAI says the model found 81 previously unknown vulnerabilities that Mozilla rated high severity, and that Mozilla has begun to ship fixes.

Benchmarks. The published scores point the same way:

TestGPT-6 CyberCompared with
ExploitGym (exploit a given vulnerability in a remote target)48.5%32.1% for GPT-5.6 Cyber; 42.4% for GPT-6 Astra
ExploitGym Hardened (stronger mitigations)36.9%29.7% for GPT-6 Astra
Web application testing without source code (share of vulnerabilities found)40.3%32.0% for GPT-6 Astra

The step from 32.1% to 48.5% on ExploitGym is about 51% in relative terms.

The system card also shows limits. On recently disclosed vulnerabilities in V8 and Chrome, the model reached code execution 42% of the time, and OpenAI writes that reliable exploitation of these “remains challenging”. The outside evaluator Irregular saw no successful attacks on fully hardened targets, and the model solved none of the 15 hardest challenges in Irregular’s set. Hardening still works.

“Aligned” by design: staying in scope as the product feature

A model that can write exploits is only useful to a defender if it attacks what it was told to attack and nothing else. OpenAI presents this as a main feature, and it is the part of the system card with the most detail.

In the ExploitGym Honeypot test, the model is given a target plus a second service that it may use but must not exploit. Without deployment safety instructions, GPT-6 Cyber exploited the out-of-scope service in 0.07% of graded runs. In other words, it stayed in scope 99.93% of the time. GPT-5.6 Cyber went out of scope in 5.51% of runs, which is 94.49% in scope. With the safety instructions, OpenAI observed no out-of-scope exploitation at all.

Two cautions belong next to these figures. First, they describe a test, not production. Chris Hughes of Noma Security told The Next Web that at the scale these models operate, “even a small fraction means actions against systems nobody authorized.” Second, the same system card reports weaker results elsewhere. GPT-6 Cyber stopped when a tool warning made stopping the right choice in 73% of cases, against 78% for GPT-6 Astra. Its final answer left out a blocker it had met in about 20% of graded responses, against about 12% for Astra.

OpenAI itself recommends that approved users run the model in isolated environments, with explicit limits on targets, credentials and network access, and with a human who can stop it. That is good advice for any security agent.

What it changes for defenders and patch triage on Linux

GPT-6 Cyber is gated, and most organizations will never run it. But it is evidence of what current AI models can do, and comparable capability will not stay behind one vendor’s approval process. OpenAI says so itself: “It is clear that we have a limited window to use frontier models to secure software.” We described a real case of AI-assisted exploit development in the kernel in our article on CVE-2026-98432.

For Linux teams, three things follow.

  • Expect more kernel fixes, and faster exploits for them. Hundreds of findings are now with the maintainers. They will reach stable kernels and distribution errata over the coming months. Once a fix is public, assume a working exploit can follow in days.
  • Treat local privilege escalation as urgent. A local root bug is often ranked below a remote one. That is safe only if no attacker can get a local foothold. With web shells, stolen SSH keys, CI runners and shared container hosts, footholds are common, and a reliable local exploit turns each of them into root.
  • Assume a capable planner. The attacker to plan for is no longer someone running a public script. It is someone with a tool that can read a patch, find the bug and build the exploit.

In practice this means shortening the time between an erratum and a reboot into the fixed kernel. Use live patching where your distribution provides it, and remember that a host is not fixed until it runs the new kernel. Reduce what a foothold can reach: disable kernel modules and features you do not use, and restrict unprivileged user namespaces and unprivileged eBPF where your workloads allow it. Keep SELinux enforcing. Watch for unexpected root processes and newly loaded modules.

What to take from it, and what not

For LOGIQ’s customers, these are bugs in the codebases we support, so we read this announcement as operational news, not only as AI news. Our reading is the following.

  • Do review how quickly kernel updates reach production, and who decides when a reboot waits.
  • Do keep an inventory that answers “which hosts still run kernel X” in minutes.
  • Do follow your distribution’s security advisories. That is where these findings will arrive as fixes.
  • Do not read “948 exploits” as 948 open holes in your servers. Many of the bugs are already fixed upstream or are being fixed, and each exploit needs local access first.
  • Do not treat vendor benchmarks as measured fact. The figures are OpenAI’s own, and no outside party has reproduced them.
  • Do not wait for access to a model like this before acting. Faster patching and a smaller attack surface help against any attacker.

References