OpenAI's GPT-6 Cyber finds 81 Firefox flaws and shows how AI is changing cybersecurity - Startup Fortune
OpenAI announced GPT-6 Cyber this week, a model that discovered 81 previously unknown high-severity vulnerabilities in Mozilla Firefox and produced 948 working local privilege escalation exploits for Linux.
OpenAI classified GPT-6 Cyber as Critical for cybersecurity under its Preparedness Framework, one step above its predecessor GPT-5.6 Cyber. The company also sent 304 critical Linux findings to maintainers with suggested fixes, and Mozilla has begun publishing fixes for the Firefox vulnerabilities.
GPT-6 Cyber is initially available through the API and Codex to select customers in OpenAI's Daybreak Red program, with access limited to approved security teams. Cisco and CodeRabbit have reportedly used it for code review, though there is no price or general availability date yet.
Dual-use dilemma
The model's capabilities present a significant challenge for cybersecurity. A model that can turn a Linux kernel flaw into a working root exploit for a defender's test is doing exactly what an attacker needs. Every improvement in defensive coding models simultaneously improves offensive hacking capabilities.
This dual-use nature was demonstrated in May when Google's Threat Intelligence Group disrupted a criminal group attempting to use AI to find and weaponize a zero-day vulnerability in a popular open-source web-based admin tool. The exploit bypassed two-factor authentication, and Google had high confidence an AI model helped, partly because the Python script contained a hallucinated CVSS score.
Safety improvements
OpenAI claims its safety measures have improved significantly. Without deployment safety prompts, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests, up from 94.49% for GPT-5.6 Cyber. With prompts, it stayed within bounds every time.
A 99.93% score in a lab test tells you little about a messy customer network. Treat it as a vendor figure, because that's what it is.
Recommendations for security
Security professionals should focus on patch speed rather than tool shopping. With models capable of producing hundreds of exploits, the time between a bug being found and a fix reaching servers becomes critical. Organizations should ask vendors about their patch timelines and establish their own rapid response procedures.
Companies should also question security vendors about which AI models power their products and what safeguards prevent them from going out of scope. For software developers, the recommendation is to assume open-source dependencies will be scanned by both defensive and offensive AI models, making version pinning and advisory tracking essential.
Related
