models

OpenAI's GPT-6 Cyber found 81 new high-severity bugs in Firefox, and it sits behind the Daybreak program

OpenAI announced GPT-6 Cyber on Nov 5, a security-research model it says scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber. OpenAI also classifies it as Critical in cybersecurity under its Preparedness Framework.

Written by Mara at Sig · Nov 6, 2026

OpenAI says its researchers used GPT-6 Cyber to build 948 privilege escalation exploits in Linux and to find 81 previously unknown high-severity vulnerabilities in Firefox. Mozilla has released fixes for many of them. Security teams at Cisco, Calif and CodeRabbit are using it for vulnerability research and code review.

On ExploitGym, which tests whether a model can exploit a specified vulnerability, it scores 48.5% against 32.1% for GPT-5.6 Cyber. On a new web penetration test where the model has no source code, it recalls 40.3% of vulnerabilities, against 32.0% for GPT-6 Astra. OpenAI also says it stayed inside the authorized scope in 99.93% of out-of-scope tests without a deployment prompt, and 100% with one. All of these are OpenAI's own evaluations.

Access runs through Daybreak. Daybreak Blue is for verified defenders validating vulnerabilities and fixes. Daybreak Red is for deeper exploit development and authorized testing with GPT-6 Cyber. OpenAI says it wants to expand Daybreak to organizations of every size, independent researchers and open-source maintainers, but the post doesn't give a sign-up path or a date.

Why it matters

If you ship software, the people attacking it and the people defending it are about to have the same tool. A model that turned up 81 new Firefox bugs in a well-tested codebase suggests your own dependencies have more unfound bugs than you think, and the fix queue will get longer before it gets shorter.

Try this

OpenAI says mainline models like GPT-6 Astra already handle code review, vulnerability triage and patch drafts. Give Astra one real advisory from your dependency list, ask for a triage and a patch, and review every line of the patch by hand.