OpenAI launches GPT-6 Cyber: it uncovers 81 vulnerabilities in Firefox and nearly a thousand Linux exploits

Artificial intelligence has taken another leap forward in its ability to identify cyber vulnerabilities. On 5 November, OpenAI unveiled GPT-6 Cyber, a specialised model that identified 81 serious and previously unknown vulnerabilities in the Firefox browser and generated 948 working exploits against the Linux kernel. This breakthrough promises to accelerate the defence of IT systems, but it also increases the risk of faster and more sophisticated attacks.

The new model is designed to carry out, autonomously, various tasks that have hitherto been entrusted to experts: analysing code, searching for vulnerabilities, checking whether they can be exploited, and proposing fixes. OpenAI has classified it as ‘critical’ for its cybersecurity capabilities, the highest rating in its assessment system. This is a measure of the model’s technical potential, including its offensive capabilities.

The results are significant (though these are based on the company’s own figures, not on independent analysis as yet). In the ExploitGym benchmark, which measures the ability to exploit vulnerabilities in controlled environments, GPT-6 Cyber achieves a success rate of 48.5 per cent, compared with 32.1 per cent for the previous version, GPT-5.6 Cyber. This represents an improvement of over 50 per cent in relative terms, according to tests published by OpenAI.

The same applies to tests on real-world software. In Firefox, the model uncovered 81 previously unknown vulnerabilities classified as high severity by Mozilla, which has already released fixes for many of them. On the Linux kernel, an automated campaign examined 2,308 potential issues, reproduced 1,724 of them and developed 948 exploits capable of gaining administrator privileges starting from limited access to the system.

This latest experiment, described by OpenAI in the study *A thousand fewer paths to root*, cost around 1.2 million dollars in API credits, equivalent to 1,279 dollars per exploit. These tests were carried out on virtual machines in a laboratory setting. The results show how vulnerability research can be transformed into an industrialised process, with agents working in parallel and human researchers tasked with verifying the results and approving the fixes. Some companies – particularly the large ones, including those in Italia – are already doing this; they now use AI to support human technicians in finding and patching the cyber vulnerabilities through which their systems can be breached. However, criminals are following a parallel process: they, too, use AI to find vulnerabilities at superhuman speed and then – and this is where they differ from companies – immediately develop ways to exploit them.