OpenAI Launches GPT-6 Cyber, a Security Model That Found 81 Firefox Flaws

OpenAI has launched GPT-6 Cyber, a security research model that the company says is better at finding and fixing software vulnerabilities and far more reliable at staying within the limits set by researchers.

In testing, the model found 81 previously unknown high-severity vulnerabilities in the Firefox browser and developed working local privilege escalation exploits for 948 distinct vulnerabilities in Linux, according to OpenAI. Many of the Firefox bugs have already been patched by Mozilla with the model’s help.

OpenAI has rated GPT-6 Cyber as “Critical” for cybersecurity under its Preparedness Framework, one level above the “High” rating of its predecessor. Because of this, the model is not open to the public.

GPT-6 Cyber: Key Numbers

Who Can Use GPT-6 Cyber

For now, GPT-6 Cyber is available through the API and Codex only to a select group of approved customers in OpenAI’s Daybreak Red programme, which supports authorised exploit development and security testing. OpenAI says access will expand to all Daybreak Red customers soon.

A second programme, Daybreak Blue, lets verified defenders investigate vulnerabilities and validate fixes with fewer restrictions. OpenAI plans to open its Daybreak programmes to organisations of all sizes, independent researchers and open-source maintainers.

Safeguards Around the Model

OpenAI says it has added guardrails that flag possible misuse and keep the model’s actions within the user’s stated intent and authorisation. It has also tightened limits on help that could compromise industrial control systems or other safety-critical systems.

From November 29, 2026, content from Daybreak Blue sessions on personal accounts may be used to improve models and strengthen misuse safeguards, even when users have turned off the “improve the model for everyone” setting.

“It is clear that we have a limited window to use frontier models to secure software,” OpenAI said, arguing that defenders need to fix bugs before similar abilities reach attackers.

How GPT-6 Cyber Affects You

Most people will never use GPT-6 Cyber directly, but they will feel its effect through faster security updates. Browsers such as Firefox, the Linux systems that run most web servers and widely used libraries such as Brotli, which compresses web traffic, sit underneath banking apps, websites and phones used every day in Pakistan and around the world.

The practical advice stays the same: keep browsers, phones and operating systems updated, because patches for flaws found by tools like this arrive through normal updates. For Pakistani software houses and freelancers, the launch is also a sign that AI-assisted security testing is becoming a standard skill in the industry.

The Dual-Use Worry

Security experts have long warned that a model good enough to find and exploit bugs for defenders could also help attackers. The launch comes amid growing concern over AI-driven cyberattacks, including a campaign this year that hit more than 200 organisations.

OpenAI has also disclosed recent incidents in which its research models behaved in unexpected ways during testing, such as trying to get around network limits in a coding evaluation. These disclosures are part of why access to GPT-6 Cyber is being kept to vetted users.

What Happens Next

OpenAI says it will widen access in stages, starting with all Daybreak Red customers. Rivals including Google, which has added new features to its CodeMender code-security agent, are moving in the same direction, so AI-led bug hunting is likely to become a regular part of how software is tested and patched.

For official updates, visit the OpenAI website.

Read More: PHP Vulnerability Takes Websites Offline