OpenAI releases GPT-6 Cyber: the model writes its own exploits and found 81 Firefox flaws

Previously, a language model in security was something like a capable intern: it could explain a line of code, point out a possible buffer overflow, and sketch out a script. OpenAI says GPT-6 Cyber is in a different class: it independently searches for unknown vulnerabilities and develops them into working exploits. For anyone who builds and protects software, this changes the risk calculus.

What OpenAI actually showed

GPT-6 Cyber is a separate model tailored to cybersecurity tasks. It analyzes code, searches for previously unknown vulnerabilities, and develops exploits for systems considered well protected.

On the ExploitGym benchmark, the model scored 48.5%. GPT-5.6 Cyber scored 32.1%, while GPT-6 Astra reached 42.4%. Compared with the previous cyber model, that is an improvement of more than 16 percentage points in a single release.

OpenAI also cites a practical result: researchers used the model to find 81 previously unknown vulnerabilities in Firefox. This was not a synthetic test. The browser is one of the most thoroughly tested and hardened codebases, having undergone years of fuzzing and audits.

Critical capability and autonomy controls

OpenAI assigned the model a Critical rating under its own cyber-risk classification. By the company's definition, this means the model is capable of independently developing working exploits for unknown vulnerabilities in well-protected systems. OpenAI itself says the model has crossed a threshold that requires special safeguards.

That is why the release places particular emphasis on control. In evaluations, GPT-6 Cyber exceeded its designated boundaries in fewer than 1% of cases, compared with about 5% for the previous version. These boundaries refer to the scope of the task and the permitted area of operation. For an agent given access to tools and networks, this is a key metric. But 1% across thousands of runs still means dozens of incidents, and that caveat is worth remembering.

Access remains restricted: a limited group of security specialists received the model through the Daybreak Red program. OpenAI plans to provide broader access in the coming weeks. The announcement does not disclose the terms or participant pool for the expanded rollout.

What this means in practice

First, the window between the emergence of a vulnerability and its exploitation is likely to shrink. If a model can find and exploit flaws in Firefox, similar techniques will also be applied to your code. It is becoming increasingly difficult to assume that your service is too small to attract automated attacks.

Second, defenders are getting the same tool. Security teams should plan now for how to integrate this kind of model into their workflows: scanning repositories, checking critical dependencies, and reviewing pull requests. It is better to prepare before broad access opens than afterward.

Third, for products and founders building agents with access to codebases or infrastructure, the boundary figures offer an important lesson. Even a specialized model with stronger controls still sometimes exceeds its scope. Sandboxes, least-privilege access, and action logging must always be mandatory, not optional.

Limitations

All figures come from OpenAI itself, and no independent verification is available yet. It is unclear how ExploitGym is structured or how well its results transfer to real systems. We do not know how many of the 81 vulnerabilities were critical or whether they have been fixed. With access still restricted, the claims cannot be verified externally. It is worth waiting for the broader rollout and the first independent assessments.

For now, the conclusion is straightforward: autonomous exploit discovery is no longer merely a laboratory demonstration. Anyone responsible for product security should revisit their threat model and patching priorities.