GPT-6 Cyber: OpenAI shipped an offensive AI that found 81 Firefox flaws

For two years the industry argued about whether an AI could reliably find and weaponize unknown vulnerabilities. That argument is over, and not because of a research paper. On November 6, 2026 OpenAI introduced GPT-6 Cyber, a version of its GPT-6 Astra model trained to find software bugs, test how an attacker would exploit them, and propose fixes — and it is being sold, through the API and Codex, to approved customers. The proof point is not a benchmark: it is already in your update queue. Dozens of the high-severity bugs fixed in Firefox 159 on October 27 are credited, by name, to OpenAI.

Developing story — first published 11:35 CET (10:35 UTC), November 6, 2026. Updated as OpenAI, Mozilla and the affected vendors publish more.

What OpenAI actually shipped

GPT-6 Cyber is described as a cyber-specialized build of GPT-6 Astra, "designed for authorized security testing of websites and applications." OpenAI says it used the model internally to help secure its own systems, including the infrastructure it trains models on, and classifies it as Critical in cybersecurity under its Preparedness Framework — the first time it has shipped a model at that tier with cyber capability turned toward offense.

Access is gated: initially to selected, approved customers in OpenAI's Daybreak Red program, via the API and Codex, with a stated plan to widen it to everyone in that program. On OpenAI's own ExploitGym benchmark — which measures whether a model can actually exploit a specified bug in a remote target, not just describe it — GPT-6 Cyber scored 48.5%, against 32.1% for the previous GPT-5.6 Cyber. On a honeypot test for staying inside scope it avoided exploiting an out-of-scope service in 99.93% of runs without safety instructions and 100% with them. Those numbers come from OpenAI's announcement, which is the part you should hold loosely until third parties reproduce it.

The Firefox 159 fixes are already in your update queue

The part you do not have to take on faith is Firefox. OpenAI says its researchers used the model to identify 81 previously unknown Firefox vulnerabilities that Mozilla rated high severity, with the model contributing proposed patches. Unlike most vendor-AI claims, this one is checkable against a primary source.

Mozilla's advisory MFSA 2026-118, published October 27, 2026 for Firefox 159, carries a long list of high-impact CVEs — and dozens of them are credited to "OpenAI Codex Security (kylebot)" and "Amy Burnett of OpenAI." Two examples you can read in the advisory today: CVE-2026-117921 (OpenAI Codex Security) and CVE-2026-117876 (Amy Burnett of OpenAI). Mozilla also notes a process change that this wave forced: it "no longer roll[s] all internally identified memory safety vulnerabilities into a single CVE" and now issues an advisory for every individual bug — because a single model surfaced enough of them to make the old bundling meaningless.

"We used to measure a fuzzing campaign in bugs per month. A credited model that returns dozens of high-severity browser bugs in a sweep is a different category of adversary — and the same capability is now behind an API."

It does not stop at finding — it exploits

A scanner finds. GPT-6 Cyber, per OpenAI, writes and validates the exploit. Three claims from the launch make that concrete:

• Sandbox escape. Agents built on GPT-6 Cyber and other OpenAI models "combined vulnerabilities to escape isolated virtual environments and run code on the host computers" in controlled tests — chaining, not single-shot bug reports.
• Brotli RCE. The model helped develop and validate exploits showing that CVE-2026-111497, the "Node2Shell"/"Brotli2Shell" out-of-bounds write in Google's Brotli decoder, could reach remote code execution. That bug is now in CISA's KEV catalog and fixed in Node.js 26.12.1, 24.22.1 and 22.23.4.
• OT zero-days. Dragos Chief AI Officer Rob T. Lee is quoted saying a frontier model "separated the OT assets from the IT noise, then found two zero-days" in engineering software — the same category of work that used to need a specialist human team and weeks.

This is the same program that, days earlier, produced 948 distinct Linux kernel root exploits in a single run. GPT-6 Cyber is the productized version of that capability — and it follows GPT-6 Astra's exploit-generation work into general, paid availability.

Why this is the turning point, not the warning

The warnings were the last two years. This is the product. Offensive vulnerability discovery and exploit development — recon, triage, reproduction, weaponization — is now a line item a customer can buy, meter, and point at a target. Your adversaries get the same API you do. A once-a-year human penetration test, scoped months in advance, does not model a counterparty that can sweep a browser codebase for 81 high-severity bugs between releases. The cadence mismatch is the whole problem: continuous, automated testing is no longer a maturity upgrade, it is the floor.

Remediation

There is no single CVE to patch here, but there are concrete actions and one strategic one.

1. Patch the browsers the model already broke. Update Firefox to 159 or later (159.0.1 is the current desktop release per MFSA 2026-123); update the ESR 153.x and 115.x branches to their October releases. Enterprise fleets on managed updates should confirm the rollout actually completed, not just that it was pushed.
2. Close the exploited side quests. The Brotli/Node2Shell chain is KEV-listed and exploited in the wild — move Node.js to 26.12.1 / 24.22.1 / 22.23.4, and check the other Brotli-bundling stacks (.NET, Bun, Envoy, Istio, Python HTTP clients, FFmpeg, ClickHouse) your services pull in transitively.
3. Assume capability parity. Plan on the premise that a motivated attacker now has an exploit-writing model on tap. That changes prioritization: a medium-severity bug that is reachable and exploitable by an automated agent outranks a high-severity one that is not.
4. Move validation from annual to continuous. The defensive answer to a machine-speed offense is a machine-speed, governed offense of your own, run against your own estate first and often.

What is not known yet

• The "81" is OpenAI's figure. Mozilla's MFSA 2026-118 publicly credits dozens of high-severity Firefox CVEs to OpenAI's team, which makes the claim unusually checkable — but OpenAI has not published the full CVE list, and the 81 may span more than one Firefox release. Treat the exact count as unconfirmed until the advisories are enumerated.
• The benchmark numbers (ExploitGym 48.5%, honeypot 99.93%/100%) are self-reported and not yet independently reproduced. OpenAI's announcement page was not publicly reachable at publication time.
• Abuse controls are unproven in the field. OpenAI lists monitoring for out-of-authorization actions, credential-theft protections, and high-risk-request blocking. Whether those survive a determined customer, or a stolen key, is exactly what the next few weeks will test.

The honest conclusion is not panic — it is that the asymmetry just changed hands. A defender who only tests on a human calendar is now negotiating with a counterparty that does not have one.

This is the problem Zero Hunt was built for. It runs an autonomous AI red team on-premise, on its own private models, with a human in the loop for every action that matters: a 10-agent swarm that writes a fresh exploit chain per target, backtested in the AI Gym before it ever touches production, every finding signed at write time for the audit trail. Because the models are local, running it against your own estate as often as the threat warrants is a flat capacity decision, not a per-token bill that grows with every agent — and no third party can throttle, change, or switch the capability off. When it proves something exploitable, the AI Remediation Advisor ranks the fixes by real exploitability — KEV first, then what it exploited in your environment, then CVSS and EPSS — gives the exact fix with rollout and rollback notes, and re-verifies with the same proof that found the hole. Offensive AI is now something your adversaries can buy. The question is whether you are testing yourself with the same tempo. Talk to us.