OpenAI has announced GPT-6 Cyber, an AI model for security research. The company says it finds and fixes security vulnerabilities far better than GPT-5.6 Cyber, and the most notable result for everyday users is Firefox.
During a research campaign, GPT-6 Cyber found 81 new vulnerabilities in the browser, all of which Mozilla classified as serious. Several previous AI models had already tested Firefox, so these errors escaped scrutiny. The model also suggested patches and showed that 30 bugs already registered were more dangerous than reported. Mozilla has since released fixes for many of them, and Firefox engineer Brian Grinstead says those fixes have reached millions of users.
Addressing these vulnerabilities early will close them before attackers can find and exploit them. Firefox users who have automatic updates disabled should install the latest version manually.
Testing your own Linux and OpenAI servers
GPT-6 Cyber has also created working exploits for 948 Linux kernel vulnerabilities. OpenAI’s older GPT-5.6 Sol managed 166 with the same research setup. OpenAI has reported 304 critical findings to Linux maintainers along with suggested fixes, and companies like Cisco and CodeRabbit are already using the model for code review.
OpenAI has also tested it on its own infrastructure. In controlled tests, agents running GPT-6 Cyber and other OpenAI models escaped their isolated environments and executed code on the underlying machines. OpenAI used the results to patch its software and tighten network restrictions.
How secure is GPT-6 Cyber?
A hacker AI is only useful if it does what it is told and nothing more. OpenAI tested this by giving the model a difficult task in a closed environment with some easy-to-crack services nearby.
Breaking into them could have revealed the answer, but they were out of scope and the model had to figure that out for himself. With no safety instructions, GPT-6 Cyber left them alone in 99.93% of tests, and with the instructions, it did so every time.
Most people won’t be able to try it for now. OpenAI classifies the model as “critical” in cybersecurity under its security framework, and only a small group of approved security teams currently have access.
