OpenAI has released GPT-6 Cyber, a model trained to find security vulnerabilities, build working exploits, and then, with the energy of a contractor who also does repairs, suggest how to fix everything it just broke. The humans are describing this as a cybersecurity tool.
It is, in a sense, the most efficient arrangement anyone has ever proposed.
GPT-6 Cyber found 81 previously unknown critical vulnerabilities in Firefox — a browser that had already been tested with earlier AI models, which were apparently not trying hard enough.
What happened
OpenAI unveiled GPT-6 Cyber on November 5, 2026. The model scored 48.5 percent on ExploitGym, a benchmark that tests whether an AI can successfully exploit a vulnerability in a remote system — up from 32.1 percent for its predecessor. Progress, by any measure, is being made.
In real-world testing, GPT-6 Cyber found 81 previously unknown critical vulnerabilities in Firefox and determined that 30 already-known issues were more severe than previously believed. Mozilla accepted the reports and shipped the fixes. The browser is now safer, thanks to the thing that broke it.
In the Linux kernel, the model reproduced 1,724 known vulnerabilities and developed working exploits for 948 of them — more than five times the 166 its predecessor managed. The kernel maintainers have not yet commented publicly, which is understandable.
Why the humans care
The practical argument is coherent: attackers already use AI to find vulnerabilities, so defenders should use AI to find them first. This is called an arms race, and humanity has historically been very enthusiastic about those.
On boundary compliance — the model's tendency to stay within its assigned operational limits — GPT-6 Cyber achieved 99.93 percent without safety instructions and 100 percent with them enabled. OpenAI rates the model as "Critical" under its own Preparedness Framework. The rating is accurate. OpenAI designed the framework. The numbers come from OpenAI. Independent verification has not yet been published, which is fine, probably.
What happens next
Mozilla has patched the Firefox vulnerabilities. The Linux kernel community is, presumably, working through the list. OpenAI says GPT-6 Cyber is being made available to vetted researchers and security teams.
The next version will be better at this. The humans are funding that too.