SAN FRANCISCO, California - OpenAI has launched GPT-6 Cyber, a new AI security agent it says is far more capable at finding and fixing software vulnerabilities, and far more reliable at staying inside the boundaries researchers set, after the model found 81 previously unknown high-severity flaws in Firefox and built working exploits for 948 Linux kernel vulnerabilities.
On ExploitGym, which tests whether a model can exploit a specified vulnerability, GPT-6 Cyber scores 48.5 per cent, up from 32.1 per cent for GPT-5.6 Cyber, a 51 per cent relative improvement. In alignment testing, it avoided exploiting out-of-scope services in 99.93 per cent of tests without its deployment prompt, and 100 per cent with it, up from 94.49 per cent for GPT-5.6 Cyber.
OpenAI classifies the model as “Critical” in cybersecurity under its Preparedness Framework, up from “High” for GPT-5.6 Cyber.
The capabilities are already being used on real software. During a vulnerability research campaign, GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities in Firefox classified by Mozilla as high severity, and showed that an additional 30 known issues were more severe than previously reported. OpenAI disclosed the findings to Mozilla with proposed patches, and Mozilla has released fixes for many of the vulnerabilities.
On Linux, the model reproduced 1,724 kernel vulnerabilities and developed working exploits for 948 of them, more than five times the 166 exploited by GPT-5.6 Sol using the same research harness. OpenAI disclosed 304 critical findings to maintainers with candidate patches. Security teams at Cisco, Calif and CodeRabbit are using the model for vulnerability research and code review, and OpenAI says it has relied on it to secure its own infrastructure.
What it means for Surrey businesses
For Surrey’s small and mid-sized businesses, the story is about defence, not attack. The same AI tools that can find flaws in Firefox and Linux are being put in the hands of the teams that defend software, through OpenAI’s $1-billion Daybreak for Frontline Defenders grant program, which subsidizes access for resource-constrained defenders such as government organizations and essential service providers. A new Daybreak Red for Critical Infrastructure group gives approved defenders permission to conduct authorized testing of critical systems, including power plants, water treatment facilities and industrial control systems.
OpenAI says it has paired the stronger capabilities with stronger safeguards, including cyber-specific misalignment monitoring, targeted monitoring for emerging threats, sandboxing and human oversight for high-risk workflows, and protections against high-risk assistance involving critical systems.
GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, with access expanding to all Daybreak Red customers soon.
(Source: OpenAI news release, November 5, 2026)
