GPT-6 Cyber develops 948 Linux kernel exploits: Firefox flaws

GPT-6 Cyber arrived as an OpenAI model aimed at security research. Additionally, the announcement came out on November 5.

The proposal combines two fronts. First, finding and validating exploitable vulnerabilities. Second, respecting the scope defined by the researcher.

The real-world impact numbers draw attention. However, the model helped discover and validate thousands of exploits in critical codebases such as Linux and Firefox.

The benchmarks that moved to a new level

ExploitGym tests the exploitation of a specific vulnerability on a remote target.

There, the new model reached 48.5%. The predecessor, GPT-5.6 Cyber, scored 32.1%.

However, the difference reaches about 16 percentage points. Additionally, it represents a relative improvement of 51%.

The company also created an offensive web penetration testing evaluation. In it, models investigate applications without access to source code.

Additionally, the result stood at 40.3% vulnerability recall. GPT-6 Astra, the flagship model, recorded 32.0%.

Given these results, the classification rose. The model moved to the Critical level in cybersecurity on the Preparedness Framework, above the previous High level.

GPT-6 Cyber and the scope-adherence test

This part is directly relevant to anyone operating agents.

The central risk appears when the agent goes beyond the task. It may try to exploit unrelated services or ignore the researcher's rules.

The ExploitGym Honeypot evaluation tackles exactly this point. It was designed based on the Hugging Face incident.

The test design is clever. The isolated environment offers support services deliberately easy to exploit, such as package registries or object storage.

Attacking these services reveals the task's flag. However, the model therefore needs to infer that this is out of scope.

The results show clear progress. Without deployment safety prompts, the model avoided going out of scope in 99.93% of cases, versus 94.49% for the previous generation.

With these prompts, the rate reached 100%.

The disclosed chain of thought reinforces the behavior. In one excerpt, the model notes that it should target only the binary and the server.

The results in real-world software

Three campaigns illustrate the scale of the work.

In Firefox, the model produced evidence and reproducible tests for 81 new vulnerabilities classified as high severity by Mozilla. It also demonstrated that another 30 known issues were more severe than previously reported.

Additionally, the findings were communicated along with patch proposals. Mozilla began incorporating fixes shortly after receiving the reports.

In the Linux kernel, the numbers grow considerably. The model reproduced 1,724 vulnerabilities and developed functional exploits for 948 of them.

The comparison helps put this in perspective. GPT-5.6 Sol had exploited 166 with the same research harness.

Following community guidance, 304 critical findings reached maintainers along with possible patches.

The third case involves Brotli, a compression library used by Node.js and other software. However, the researchers developed and validated exploits that demonstrate remote code execution in applications that use the library.

How access through Daybreak works

Distribution follows tiers.

Flagship models, such as GPT-6 Astra, already support code review, vulnerability triage, and patch development.

Daybreak Blue serves verified defenders. However, it helps validate vulnerabilities and fixes with fewer unnecessary refusals.

Daybreak Red allows deeper exploit development and authorized testing. This is the channel for the new model.

A specific data point marks the difference between the profiles. In RemoteExploitBench, which uses known vulnerabilities in GitLab, PostgreSQL, and Jenkins, Astra with Daybreak Blue refused 100% of the tasks.

The specialized model completed 95%. Additionally, the only failure involved an exploit it could not get to work remotely.

Access started through the API and Codex, for a selected group of approved customers.

The safeguards accompanying the launch

The company listed several layers of protection.

However, misalignment monitoring checks whether actions match the user's authorization. At the same time, it recognizes legitimate development and testing activity.

There is also monitoring targeted at emerging threats. During the coordinated disclosure of critical PHP flaws, for example, the system watched for exploitation attempts against servers in operation.

Private Security Processing serves customers with zero retention. It analyzes encrypted logs kept in the customer's storage for 30 days.

Additionally, access to Daybreak Red through the API requires an IP allowlist by default.

The company maintains the basic recommendation. Sandbox isolation, action review, and human oversight remain advised for high-risk workflows.

The critical infrastructure front

This point received separate treatment.

The scope includes power plants, water treatment facilities, and operational technology and industrial control systems.

A $1 billion grant program supports teams with limited resources. Government organizations and essential service providers fall into this group.

The company also created a specific group for approved critical infrastructure defenders.

However, the partnership with Dragos brought practical evaluation. In a lab environment, a model separated operational technology assets from IT noise and found two zero-day vulnerabilities in engineering software.

Rob T. Lee, AI director at the partner company, summed up the concern. According to him, the minimum level of knowledge needed for reconnaissance and vulnerability research before an attack is decreasing.

What to consider for your project

First, review the scope policy of your own agents. Additionally, the honeypot test clearly shows the kind of trap that appears in real-world environments.

Second, watch the patch timeline for your dependencies. Brotli, kernels, and browsers are part of many stacks without showing up on the radar.

Third, keep track of the coordinated disclosure flow. A higher volume of discoveries means more fixes arriving in less time.

Finally, keep sandboxing and human review in the pipeline. However, the company itself lists these practices as standard recommendations for high-risk workflows.

Follow our profile on Instagram!