OpenAI has a new model that doesn't write poems or code your website. It hunts security flaws — and in its first public tests, it found hundreds of them. GPT-6 Cyber, announced on November 5, 2026, is a security-focused AI built to find, verify, and help fix vulnerabilities in real software. And the numbers OpenAI shared are hard to ignore.

So what exactly did it find, and why is OpenAI keeping it behind a locked door? Here's the full picture.

948 Linux Flaws and 81 Firefox Bugs

The headline result comes from the Linux kernel. Using GPT-6 Cyber, OpenAI's team validated and patched 948 local privilege escalation vulnerabilities in Linux — flaws that could let an attacker gain higher access on a system than they should have. The whole exercise cost about $1.2 million in API usage, which sounds like a lot until you compare it with the cost of a human security team doing the same work over months.

Mozilla got a similar treatment. Security teams using the model found 81 high-severity flaws in Firefox. Mozilla, Palo Alto Networks, Cisco, and OpenAI's own security team are already putting GPT-6 Cyber to work, according to OpenAI's announcement.

What GPT-6 Cyber Actually Does

GPT-6 Cyber is a specialized version of GPT-6 Astra, OpenAI's flagship model, trained for security research. It reads source code, spots likely vulnerabilities, checks whether they can really be exploited, and helps developers fix them. It works inside researcher-defined limits — in other words, it only tests systems it's been given permission to test.

On the ExploitGym benchmark, which measures how well a model handles security tasks, GPT-6 Cyber completed 48.5% of tasks, up from 32.1% for the previous GPT-5.6 Cyber. That's a big jump for one generation. OpenAI also gave the model a "Critical" rating under its own Preparedness Framework — the first time any of its models has received that top cyber rating. The rating means the model can independently find and exploit unknown flaws in well-protected systems.

Why You Can't Just Try It

Here's the catch: GPT-6 Cyber is not available to everyone. Right now, only a limited set of vetted users can access it, through OpenAI's Daybreak Red program, via the API and Codex. Daybreak is OpenAI's program for giving verified security researchers access to stronger AI capabilities, split into Blue (for defenders validating fixes) and Red (for offensive security testing with deeper exploit work).

OpenAI says it plans to expand access over time. The reason for the slow rollout is obvious — a model this good at finding flaws could help attackers just as much as defenders. The company's bet is that giving defenders first access creates a window where the good guys patch faster than the bad guys can exploit. OpenAI calls this the "defender's window," and it's the whole idea behind Daybreak.

What This Means for Everyday Users

You won't use GPT-6 Cyber directly, but you'll feel the results. When AI finds and patches hundreds of Linux kernel flaws, every server, phone, and cloud service running Linux gets safer. When Firefox bugs get fixed before attackers find them, your browser gets safer too. The model turns security research from a slow, manual job into something that runs at machine speed.

The flip side is real as well. Attackers will eventually get models like this, whether from OpenAI or someone else. That puts pressure on every software maker to patch faster — and on users to install updates when they arrive. If your system prompts you to update, don't put it off for weeks. The race between patching and exploiting just got faster.

OpenAI's move comes in a week when the company is also in the news for its funding round — our report on OpenAI's data centre plans covers the other side of the story, where the company is rethinking how it pays for all this compute.

The Bottom Line

GPT-6 Cyber is the clearest sign yet that AI security research has moved from demos to real results: 948 Linux flaws, 81 Firefox bugs, and a benchmark score that jumped by half. The model is locked to vetted defenders for now, and that's the right call. But the clock is ticking — the same capability will reach everyone eventually, and the only defense is patching faster than attackers can move.

Sources: OpenAI — Introducing GPT-6 Cyber · The Verge — OpenAI launches GPT-6 Cyber

Keeping your own files safe matters too — if you ever lose data to a crash or a bad update, our guide to the best data recovery software for PC and Android covers the tools that can bring it back.

Originally published on Rohan Tech Official.