OpenAI released GPT-6 Cyber on November 5 — a security-specialized AI that, before its public announcement, had already run an automated pipeline through the Linux kernel and surfaced 948 working local privilege escalation exploits. It also found 81 previously unknown high-severity Firefox vulnerabilities. Mozilla is already patching them. This is not a proof of concept — the pipeline ran, found things, and OpenAI is now rolling out gated access to approved security teams.
948 Exploits. $66 Million in Bounty Value. #
The numbers from a single mid-October pipeline run are hard to contextualize until you price them out. The pipeline started with 2,308 candidate Linux kernel findings, reproduced 1,724 of them in an isolated environment, and produced 948 working local privilege escalation exploits — the kind that let an unprivileged user gain root. At historical bug bounty prices, those 948 exploits are worth between $18.9 million and $66.3 million. The pipeline cost $1.2 million to run.
Beyond the kernel work, GPT-6 Cyber found 81 previously unknown high-severity vulnerabilities in Firefox, plus 30 known vulnerabilities that turned out to be more severe than originally reported. OpenAI says its researchers discovered at least 10 novel exploitation techniques in a sample of just 166 exploits — meaning the model is not simply reproducing known patterns; it is finding new paths.
How the Pipeline Works #
GPT-6 Cyber is built on the same GPT-6 Astra foundation as OpenAI’s general-purpose models, but fine-tuned specifically for offensive security workflows. The five-stage pipeline runs as follows:
- Scan security-relevant code for candidate vulnerabilities
- Dynamically reproduce candidates in an isolated environment
- Assess exploitability and generate proof-of-concept exploits
- Generate candidate patches
- Human researcher review and validation
The key word in step five is “human.” OpenAI is not deploying this autonomously. The pipeline surfaces and validates; people decide what to disclose and when.
The Benchmark: 48.5% on ExploitGym #
On ExploitGym — the standard benchmark for measuring whether a model can successfully exploit a specified vulnerability in a live remote target — GPT-6 Cyber scored 48.5%, up from 32.1% for GPT-5.6 Cyber. That is a 51% relative improvement in one generation. The non-specialized GPT-6 Astra base scores 42.4%, which means the security fine-tuning is adding real capability on top of an already-capable model.
| Model | ExploitGym Score | Scope Compliance |
|---|---|---|
| GPT-5.6 Cyber | 32.1% | 94.49% |
| GPT-6 Astra | 42.4% | — |
| GPT-6 Cyber | 48.5% | 99.93% |
The scope compliance numbers are the safety story OpenAI wants you to focus on: GPT-6 Cyber stayed in bounds 99.93% of the time without deployment safety instructions, and 100% with them. Its predecessor managed 94.49%. A model that goes out of scope in 5.5% of tests is a liability. One that does so in 0.07% is closer to auditable.
Who Can Actually Use It #
Access to GPT-6 Cyber is locked behind OpenAI’s Daybreak Red program — and even Daybreak Red membership is not sufficient. GPT-6 Cyber requires an additional model approval layer on top. Requirements include single sign-on, multi-factor authentication with FIDO2 hardware keys, managed devices, and IP-allowlisted API access. Early users include Mozilla, Cisco, Palo Alto Networks, and CodeRabbit.
The Daybreak program launched in May 2026 and was split into Blue (defensive security work) and Red (authorized penetration testing, red teaming, vulnerability research) in August. If your team wants access, Daybreak Blue is the entry point. OpenAI is expanding GPT-6 Cyber to all approved Red members over the coming weeks, while GPT-5.6 Cyber opens to the full Red tier simultaneously.
What This Means for Defenders #
The gating works right now, but it is not permanent. The gap between frontier AI capability and broader availability has historically been 12–18 months. Adversaries with resources are not sitting in OpenAI’s approval queue.
The practical implication: the window between a vulnerability existing and an attacker having a working exploit is compressing. A single AI pipeline run found 948 LPE exploits in the Linux kernel. If your patch cycle assumes weeks or months of safety after a CVE drops, that assumption is weakening. Apply for Daybreak access if your team qualifies. Treat Mozilla’s experience — getting patched ahead of attacker discovery — as the target model, not the exception.