GPT-6 Cyber: 81 Firefox flaws, 948 Linux bugs

OpenAI on November 6, 2026 named GPT-6 Cyber, a model it says is stronger at finding vulnerabilities, checking what they can do, and drafting fixes. In Firefox testing the model surfaced 81 previously unknown high-severity flaws and helped write patches. Mozilla has already shipped many of those fixes. A browser still on last month’s build is carrying bugs a lab model has already walked through.

The Linux half of the same announcement is a set of counts, now tied to this model. OpenAI says GPT-6 Cyber marked 2,308 candidate kernel issues, reproduced 1,724, and showed 948 distinct ways an ordinary local account could become root. This briefing stops at those counts. It does not describe how any flaw was triggered.

On OpenAI’s ExploitGym benchmark, GPT-6 Cyber succeeded against 48.5 percent of the vulnerabilities in the set. GPT-5.6 Cyber, the prior cyber model, succeeded against 32.1 percent. OpenAI placed GPT-6 Cyber at Critical under its Preparedness Framework. The previous model sat at High.

The model is withheld

GPT-6 Cyber is not on the public API. OpenAI is offering it first to a limited set of approved customers inside Daybreak Red, and it says the rest of that program will follow. Daybreak Red is the lane for authorized testing at the high end. Daybreak Blue is the lane for verified defenders who need to investigate flaws and check fixes under tighter limits. A Critical rating is a statement about capability. It is not a CVE, and it does not patch a single host by itself.

OpenAI’s line to the industry is that the useful window is short. Frontier models can help secure software, and similar capability will not stay inside defender programs. The company says it intends to widen Daybreak to organizations of every size, independent researchers, and open-source maintainers. Widening access is a plan. The Firefox packages and the kernel updates are the work that can start today.

What to ship this week

Update Firefox on managed desktops, developer laptops, and any jump box that still launches a browser. Include current extended-support builds. Record the version, not a ticket that says the fleet was patched. Mozilla has shipped many of the 81 fixes, so a build from last month is the exposed set, and the remaining fixes still need a watch on Mozilla’s advisories.

On Linux, apply the kernel package your distribution has actually published, then reboot. Servers, build agents, and developer virtual machines all count. A low-privilege account on a host that missed those packages is the access the 948 figure assumes. Remove local users who no longer match a job. Keep untrusted code off the kernel you use for production.

Teams already in Daybreak Blue should use the program to check fixes on their own code and keep the output on the reporting path the vendor expects. Everyone else should treat the headline as a patch list with a delay. The 81 Firefox flaws are high-severity. The 948 Linux routes are local root. Both move when the vendor package is installed.

This briefing relies on public reporting by BleepingComputer and on OpenAI’s November 6, 2026 announcement. It does not include exploit procedures or proof-of-concept detail.