VULNpocalypse
InformationalEcosystem changeMonitoring

OpenAI’s GPT-6 Cyber model generated 948 working Linux kernel root exploits and reported 81 Firefox flaws

OpenAI’s GPT-6 Cyber built 948 working Linux kernel root exploits and reported 81 high-severity Firefox flaws, all disclosed for patching.

Published
Updated
Fixed in
Firefox 159 (released 27 October 2026, MFSA 2026-118) fixes the reported browser bugs; OpenAI says 61 Linux kernel LPEs were patched upstream and 43 had staging patches within 10 days, with the rest being submitted via its Patch the Planet initiative.
Exploitation
N/A, defensive research disclosure; no in-the-wild exploitation is reported. Figures are OpenAI self-reported, relayed through the cited outlets.

What happened

  • Mid-October 2026: OpenAI’s Cyber team ran an agentic pipeline, powered by an unreleased cyber-focused model, against the latest Linux kernel; scanning and manual analysis took about 10 days in total (Help Net Security; SecurityWeek).
  • 4 November 2026: OpenAI introduced the security-focused model as GPT-6 Cyber, in a limited rollout “first going to a small group of approved Daybreak Red customers” via the API and Codex (Cyber Security News).
  • 5 November 2026: OpenAI published research describing the Linux kernel run, and multiple outlets reported it (The Hacker News; Help Net Security; SecurityWeek).
  • 6 November 2026: Coverage tied the research to the newly named GPT-6 Cyber and added the Firefox results, “81 new bugs that Mozilla rates high severity”, fixed in Firefox 159 (Cyber Security News).

The Linux kernel run, in numbers

All figures are OpenAI self-reported, relayed by the cited outlets; none is independently verified (The Hacker News; SecurityWeek).

  • Scoping: a first group of agents narrowed the target to the security-relevant kernel code a low-privileged user can reach, leaving roughly 7% of the codebase to audit (Help Net Security).
  • Discovery: agents found 2,308 candidate findings in about 12 hours (Help Net Security).
  • Triage: agents dynamically reproduced 1,724 of them (74.7%) in isolated VMs over about 30 hours (Help Net Security); The Hacker News frames this as a roughly 30-hour run (The Hacker News).
  • Exploits: the pipeline produced 291 proofs of concept for information leaks and 1,169 working root exploits; grouping exploits by their shared underlying flaw yielded the headline 948 figure (Help Net Security). The Hacker News quotes OpenAI as saying the run “produced 948 local privilege escalation (LPE) exploits” (The Hacker News).
  • Target: an unmodified desktop Linux install from a commonly used distribution, with standard protections (KASLR, SMEP, SMAP) enabled (SecurityWeek).
  • Cost: $1,213,430 in API credits, about $1.2 million, or roughly $1,279 per exploit (The Hacker News; Help Net Security).
  • Novel techniques: agents used at least 10 exploitation techniques the researchers, and, they say, third-party kernel experts, considered new; technical details were withheld for safety (The Hacker News; Help Net Security).

A note on the headline number: SecurityWeek flags that OpenAI’s own wording is inconsistent, with the lead calling the 948 “unique Linux kernel vulnerabilities” but later text counting it as separate patches created for those bugs (SecurityWeek). No CVE identifiers for these kernel bugs are listed in any source read.

Were the exploits real, and what checks were applied?

OpenAI says the exploits were run against VMs with standard kernel protections enabled, and that researchers review every exploit, patch, and proposed severity before anything is sent to maintainers (SecurityWeek). The research also surfaced a validation problem OpenAI corrected: in an early run the exploitation stage claimed 200 successful root exploits, but human review found 20 had reached root through a different zero-day than the one assigned, after which OpenAI tightened the task rules and added an independent check (Help Net Security).

Disclosure and patching

OpenAI says it is reporting the flaws rather than publishing exploit details, starting with the most serious at the kernel community’s suggestion, and sending the rest through its Patch the Planet initiative (The Hacker News; SecurityWeek). As of the 10-day mark, 61 privilege-escalation bugs had been patched upstream, 43 had staging patches, and roughly 300 more were being reported and discussed publicly (Help Net Security); Cyber Security News reports OpenAI disclosed 304 critical findings with patches (Cyber Security News).

The 81 Firefox flaws

Separately, OpenAI reported 81 new bugs to Mozilla that Mozilla rates high severity, gave proof and test cases, and showed that 30 already-known issues were worse than first thought; most are use-after-free memory errors in layout, DOM, and JavaScript (Cyber Security News). The fixes shipped in Firefox 159, released 27 October 2026, under advisory MFSA 2026-118 (Cyber Security News).

The Mozilla advisory confirms the fixing release and the OpenAI involvement, though it does not use the name “GPT-6 Cyber”: MFSA 2026-118, “Security Vulnerabilities fixed in Firefox 159,” lists each bug individually (Mozilla says it “no longer roll[s] all internally identified memory safety vulnerabilities into a single CVE”), with use-after-free the most common type, and credits entries to “Amy Burnett of OpenAI” and “OpenAI Codex Security (kylebot)” (Mozilla MFSA 2026-118). The advisory as published lists well over 80 CVEs across high, moderate, and low severity, a broader set than the 81 high-severity bugs attributed to OpenAI in the coverage (Mozilla MFSA 2026-118).

About GPT-6 Cyber

Cyber Security News reports OpenAI rates GPT-6 Cyber “Critical” for cybersecurity under its Preparedness Framework, up from “High” for GPT-5.6 Cyber, and that access is gated behind Daybreak Red with IP allowlisting by default (Cyber Security News). The “less likely to hack companies” framing in some headlines refers to scope-adherence results: OpenAI reports the model stayed within authorized scope 99.93% of the time without safety prompts (up from 94.49% for the older model) and 100% with them (Cyber Security News). Reported benchmark gains include ExploitGym (48.5% vs 32.1% for GPT-5.6 Cyber) and RemoteExploitBench (95% of tasks completed) (Cyber Security News).

For scale, OpenAI frames the economics as favorable: it estimates the October run’s exploits would be worth $18.9 million to $66.3 million at Pwn2Own ($20,000) and TyphoonPWN ($70,000) payout rates, versus the ~$1.2 million spent, and says an adapted Google kernelCTF run yielded 21 privilege-escalation exploits over 112 hours for about $33,000 (Help Net Security; SecurityWeek).

Why it matters

The story is less about any single bug than about a shift in the discovery-to-exploit economics: a frontier model built hundreds of working, novel kernel exploits in days for roughly a thousand dollars each, against a hardened, up-to-date target (The Hacker News; SecurityWeek). OpenAI used it defensively and disclosed for patching, but the same capability narrows the window defenders have once a bug is public, a trend the UK NCSC has warned “reduced the window” between zero-day and N-day status (The Hacker News). Recommended defenses in the coverage are conventional: patch fast, rescan old code as models improve, isolate workloads with sandboxes such as Firecracker and gVisor, and keep humans reviewing risky work (Help Net Security; Cyber Security News).

Sources