The short answer
● What shipped — GPT-6 Cyber, OpenAI, 5 November
● Firefox — 81 previously unknown high-severity flaws
● Linux kernel — 948 working exploits built from 1,724 reproduced bugs
● Newly disclosed — 304 critical Linux findings, with proposed patches
● Who can use it — vetted Daybreak Red customers only
OpenAI released GPT-6 Cyber on 5 November and rated it Critical for cybersecurity under its own Preparedness Framework. That is a step up from High, which is where GPT-5.6 Cyber sat.
The Firefox number is the one that matters
OpenAI researchers used the model to find 81 previously unknown high-severity flaws in Firefox. Mozilla has started shipping fixes. Those were genuinely new, which is what makes the figure meaningful.
The Linux number is widely reported wrong
You will see "948 previously unknown Linux kernel exploits" in a lot of coverage. That is not what happened.
| Figure |
What it actually means |
| 1,724 |
Known vulnerabilities the model reproduced |
| 948 |
Of those, ones it built a working exploit for |
| 304 |
Critical findings newly disclosed to maintainers, with proposed patches |
| 166 |
What GPT-5.6 Sol managed in the same setup |
Reproducing a known bug and discovering a new one are different achievements. The honest headline is that exploit generation went from 166 to 948 against the same benchmark, which is close to a six-fold jump in one model generation.
Who can actually use it
Only vetted customers in Daybreak Red, OpenAI’s tier for exploit development and authorised security testing. Access is through the API and Codex. OpenAI says it will open the model to all Daybreak Red customers soon, without giving a date.
This is the same gating pattern OpenAI used for the cyber capability in GPT-6 Astra. That story is here.
Why the rating change is the real news
Critical is the top band in OpenAI’s framework. A lab publicly classifying its own release at the ceiling of its risk scale, then shipping it behind vetting rather than holding it back, is the part worth tracking. The vulnerability counts are evidence for that decision, not the decision itself.
Frequently asked questions
Can I use GPT-6 Cyber?
Only if you are a vetted Daybreak Red customer. It is not on general API access.
Did it find 948 new Linux vulnerabilities?
No. It reproduced 1,724 known ones and built working exploits for 948. The newly disclosed critical findings number 304.
Is Firefox patched?
Mozilla has started releasing fixes for the 81 high-severity flaws.
What does a Critical rating mean?
It is the highest cybersecurity band in OpenAI's Preparedness Framework. GPT-5.6 Cyber was rated High.
How much better is it than the previous model?
On the same Linux benchmark, 948 working exploits against 166 for GPT-5.6 Sol.
Sources: TNW · The Decoder.
Published 7 November 2026. Figures checked against the reporting linked above on the same day.