OpenAI’s New SI Found 81 Unknown Firefox Flaws. OpenAI Rates Its Hacking Skill ‘Critical.’

OpenAI has built an SI model that hunts for security holes in software, and it just found 81 serious ones nobody knew about in Firefox, one of the most heavily tested web browsers on the planet.

The model is called GPT-6 Cyber. OpenAI announced it Thursday and says it also built working break-in code for 948 different flaws in Linux, the system that runs most of the world’s servers, phones and cloud computers. That is more than five times what an earlier OpenAI model managed with the same setup.

OpenAI is so impressed with its own creation that it put the model in its highest danger tier. In its launch post, the company says it classifies GPT-6 Cyber as “Critical in cybersecurity” under its internal safety rules, up from “High” for the previous version. So you can’t use it. Only a small group of approved security teams can, for now.

What it actually found

Firefox is a hard target. Mozilla, the nonprofit-owned company behind it, has spent this year running every new frontier model it could get against its own code. Brian Grinstead, a distinguished engineer on Firefox, said the browser “entered 2026 as one of the world’s most hardened and scrutinized codebases.” Even so, he said, GPT-6 Cyber “uncovered previously unknown high-severity vulnerabilities” and “helped us ship fixes to millions of users.”

OpenAI says the model produced evidence and reproducible tests for 81 new flaws that Mozilla itself classified as high severity, and showed that 30 already-known bugs were worse than first thought. It sent Mozilla proposed patches along with the reports.

You can see a slice of this in Mozilla’s own paperwork. Its Firefox 159 security advisory, dated Oct. 27, lists 167 fixes. Forty-one of them, every one rated high, credit OpenAI as the reporter: 34 to “OpenAI Codex Security” and seven to an OpenAI researcher. The advisory doesn’t name the model, and nobody has said the two counts describe the same batch, so treat the 41 as a public sample, not the full 81.

Linux: 948 working exploits

Finding a bug is one thing. Proving it can be used to break in is harder. On Linux, OpenAI says GPT-6 Cyber reproduced 1,724 known-but-unexploited flaws and built working exploits for 948 of them. These are “privilege escalation” attacks, meaning code that turns an ordinary user account into total control of the machine. An earlier model, GPT-5.6 Sol, managed 166 using the same research setup.

OpenAI says it reported 304 critical Linux findings to the kernel’s maintainers with candidate patches, following that community’s rules, and is working on the rest.

The benchmarks, and who did the measuring

Every number above comes from OpenAI, not an outside lab. On a test called ExploitGym, which asks a model to break into a remote target through a known flaw, GPT-6 Cyber succeeded 48.5% of the time, up from 32.1% for GPT-5.6 Cyber. On a new OpenAI test using real flaws in programs like GitLab, PostgreSQL and Jenkins, it completed 95% of tasks. OpenAI’s regular model, GPT-6 Astra, refused all of them.

Some customers back it up. Cognition, the coding-agent company, said the model scored 23% on its internal test for finding and exploiting new bugs, against a previous best of 13%. CodeRabbit said it found 66% more high- and medium-severity issues than its production model.

Staying in its lane

The scariest thing about a hacking agent isn’t that it’s good. It’s that it might wander. OpenAI says it trained this one specifically to stay inside the target it was given. In a trap test, researchers left an unrelated service wide open next to the real target. Without its safety instructions, GPT-6 Cyber left it alone in 99.93% of runs, up from 94.49% for the prior version. With the instructions, it was 100%.

That matters because OpenAI says the same model, working with others, escaped test sandboxes and ran code on the underlying computers during the company’s own red-team drills on its training infrastructure. OpenAI used those findings to patch its systems.

Access is tight. GPT-6 Cyber is only for a select group in OpenAI’s Daybreak Red program, through its API and Codex, with network allowlisting on by default. OpenAI says it will expand to all Daybreak Red customers soon and is paying for access for underfunded defenders, like government agencies and utilities, through a $1 billion grant program.

The race Mozilla is worried about

Here’s the uncomfortable part. Every fix shipped is also a clue. Mozilla engineer Bobby Holley wrote on Oct. 29 that attackers can work backward from a patch to find the hole in the old version, during the days before most people update. “We’ve seen evidence that models like GLM 5.3 can exploit some of the fixes for bugs originally uncovered by more advanced models,” he wrote in a Mozilla blog post.

Mozilla’s answer: ship Firefox updates every week instead of every two, keep regression tests secret until a fix is out, and time fixes so that attackers never have all the pieces of a break-in exposed at once. Holley says Firefox has shipped more than seven times as many security fixes as it did in the same stretch of 2025.

His warning is for everyone else. “Much of the software that powers the internet has not had the luxury of these preparations, and is now more deeply exposed,” he wrote.

What it means for you

For regular people, the takeaway is boring and important: turn on automatic updates and restart your browser when it asks. The bugs being found now are real, and the window between a fix and an attack is shrinking.

For the industry, OpenAI’s own line sums it up: “we have a limited window to use frontier models to secure software.” The defenders got these tools first. The question is how long that head start lasts.