OpenAI's GPT-6 Cyber Finds 81 Firefox Flaws and Stays in Scope

OpenAI released GPT-6 Cyber on November 5, a security-specialized model it rates "Critical" in cybersecurity under its Preparedness Framework, up from "High" for GPT-5.6 Cyber. The headline numbers are lurid: 81 previously unknown high-severity vulnerabilities in Firefox, working exploit development for 948 Linux kernel flaws, and 304 critical findings disclosed to kernel maintainers with candidate patches attached. The more consequential number is buried in the alignment evaluation. GPT-6 Cyber stayed inside the scope a researcher defined in 99.93% of tests without its deployment prompt, and 100% with it, against roughly 95% for its predecessor.

That gap is the actual product. Anyone can ship a model that finds bugs. Shipping one that finds bugs and reliably stops at the edge of an authorization boundary is the thing that makes autonomous security agents deployable at all.

What OpenAI Actually Shipped

The capability gains are real and measured. On ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scored 48.5%, a 51% relative improvement over GPT-5.6 Cyber's 32.1%, and ahead of the flagship GPT-6 Astra at 42.4%. On a new offensive web penetration test where models probe applications without source code access, it reached 40.3% vulnerability recall versus 32.0% for Astra. In a reward-hacking-resistant benchmark called RemoteExploitBench, built on known vulnerabilities in GitLab, PostgreSQL and Jenkins deployed in a controlled environment, GPT-6 Astra running with Daybreak Blue's relaxed refusals refused 100% of tasks, while GPT-6 Cyber completed 95%.

The Linux campaign is the clearest before-and-after. Using the same research harness, GPT-5.6 Sol produced 166 working exploits. GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948, including 588 that were previously unknown. Mozilla classified all 81 Firefox findings as high severity, and independently upgraded the severity of 30 known issues after review.

Access is narrow on purpose. GPT-6 Cyber is available through the API and Codex only to approved Daybreak Red customers, with plans to widen that to all Red accounts over the coming weeks. GPT-5.6 Cyber becomes available to every Red organization immediately.

Why Scope Discipline Is the Actual Product

Refusal and alignment are not the same thing, and the cyber domain exposes the difference brutally. A model that refuses everything is perfectly safe and completely worthless: Astra's 100% refusal rate on RemoteExploitBench is not a safety win, it is a product failure that pushes researchers back to unmonitored tooling.

The obvious fix, turning refusals down, widens the blast radius. OpenAI's bet with GPT-6 Cyber is that both curves can move at once through dedicated training on authorized scope, and the system card backs it with two separate claims: capability went up, and out-of-scope behavior went from about 5% to under 1%. New safeguards are also meant to block high-risk activity against critical systems such as power plants and water treatment facilities, alongside monitoring for behavior outside a user's stated intent.

For anyone building agents, this reframes the safety problem. The valuable property is not a model that says no. It is a model that holds a boundary it was given, reports honestly when it hits one, and keeps working inside it. That is a specification a builder can actually engineer around, and it is a much harder training target than a refusal policy.

The Gating Stack Is the New Deployment Architecture

Daybreak now has three tiers with materially different rules. Standard access covers mainline models with normal safeguards. Daybreak Blue relaxes refusals on verified defensive work. Daybreak Red adds the cyber-specialized models, and requires identity verification, legal attestations tied to authorized activity, single sign-on, multi-factor authentication, and API IP allowlisting. Since September 1, 2026, individual Red accounts also need a hardware security key. Customers running Zero Data Retention generally need Private Safety Processing for automated safety review.

Read that list again as an architecture rather than a policy document. Capability is being allocated by verified identity and per-request enablement, not by possession of an API key. Turning on the Red tier in a workspace does not grant the model; approval for GPT-6 Cyber is a separate step, and Daybreak must be enabled per request through workspace or project controls. That is the same shape enterprises will need for any agent with real blast radius: payments agents, infrastructure agents, agents with production credentials. Tier the capability, attest the identity, allowlist the network, and make elevation explicit and revocable.

The economics are strange and worth naming. OpenAI says it is allocating a significant share of frontier compute to finding and patching vulnerabilities in open source, pro bono, and has put $1 billion behind defenders working on critical infrastructure. Meanwhile a hobbyist in TechCrunch's account spent roughly $5,000 in subscriptions and tokens to surface a bug that could have handed an attacker control of Ubuntu servers. Offense is getting cheap faster than defense is getting staffed, which is why OpenAI keeps describing a narrow window rather than a solved problem.

There is also a governance wrinkle builders should notice. The same researcher who found the Ubuntu flaw says Daybreak Blue appears to have been recently tuned down, making it less useful for vulnerability hunting. Whether or not that is true, the mechanism matters: gated tiers give the provider a silent dial over capability. Teams that build on a gated model inherit a ceiling that can move without a changelog.

What This Means for Builders

Three practical takeaways.

First, stop treating model capability as a constant. Scope, refusals and tier access are deployment parameters that can be tuned under you. Version-pin your evals against the exact access tier you hold, and re-run them when a provider announces a safety update, not just a model update.

Second, put the authorization boundary in the agent's state, not in its prompt. The model that scored 99.93% did so with dedicated training on scope, but the 0.07% is exactly the case where a system-level check is the only thing standing between a bad decision and a real target. Boundaries you can log, diff and revoke beat instructions you hope will be followed.

Third, budget for the human bottleneck. Finding 81 bugs is the easy half. Triage, disclosure, patch review and regression testing do not scale with model throughput, and 304 critical Linux findings landing on volunteer maintainers is a load problem, not a compute problem. The teams that win the next year are the ones that automate the handoff from finding to verified fix.

What to Watch

Whether Daybreak actually opens to open-source maintainers and independent researchers, or stays an enterprise tier with a grant program attached. Mozilla's fix cadence for the 81 findings, which is the first real-world test of AI-assisted disclosure at volume. And whether a "Critical" cyber designation eventually forces external audit requirements on model providers, the way critical infrastructure software already faces.