OpenAI GPT-6 Cyber finds 81 Firefox flaws, limited to vetted researchers

OpenAI released a new cybersecurity AI model on Thursday, 5 November 2026, which reports call GPT-6 Cyber and which TechCrunch described as ChatGPT Cyber. It is available only to approved customers in Daybreak Red, the highest tier of OpenAI's Daybreak security programme, meant for professional security researchers who test systems for weaknesses. OpenAI says the model found 81 previously unknown flaws in the Firefox web browser that Mozilla rated high severity, and that in testing on the Linux kernel it reproduced 1,724 known vulnerabilities and built working exploits for 948 of them. These are OpenAI's own figures and have not been independently verified.

Software flaws are found by people and tools that probe programs for weaknesses. AI models that can do this at scale could help defenders find and fix bugs faster, before criminals exploit them. The Firefox and Linux results, if confirmed, suggest such models are now able to find serious flaws in widely used software that humans had missed.

The same ability can be misused. A model that can build working attacks could help criminals if it reached the wrong hands, which is why OpenAI limits it to vetted researchers. Coverage has questioned whether such access controls are enough, and one source told TechCrunch that OpenAI had recently weakened the earlier Daybreak Blue tier, reducing its usefulness for finding bugs. Earlier in 2026, some researchers also complained that their access to OpenAI's cyber programme had been revoked by mistake.

For Indian organisations, the development matters in two ways. Banks, government departments and companies in India use Linux servers and Firefox like organisations everywhere, so faster discovery and patching of flaws helps them. At the same time, India's cybersecurity agency CERT-In has been warning about AI-driven attacks, and tools of this power raise the stakes on keeping systems updated.

What users should do: keep browsers such as Firefox and operating systems updated, since many of the flaws found have already been fixed in new versions. Organisations should apply security patches promptly and follow advisories from CERT-In.

Peepals calculation: The model built working exploits for about 55% of the Linux vulnerabilities it reproduced (948 / 1,724 ≈ 0.55), about 5.7 times the 166 achieved by the earlier model (948 / 166 ≈ 5.71). At about $1.2 million in computing credits, that is roughly $1,270 per exploit (1,200,000 / 948 ≈ 1,266). Our calculation from the reported figures.

Short-term: Mozilla and Linux maintainers continue to patch the reported flaws; vetted security teams gain access to the model.

Long-term: AI-assisted bug hunting could speed up how quickly software is secured, but it also increases pressure on companies and governments to control who can use such tools.

Who is affected: security researchers, software maintainers, organisations running Linux and Firefox, cybersecurity agencies such as CERT-In, and users who rely on timely updates.

Questions and Answers