OpenAI launches GPT-6 Cyber, its first model rated 'critical'

Hundreds of flaws in Firefox and Linux

OpenAI says its researchers used the model to uncover 81 previously unknown vulnerabilities in Firefox, all of which Mozilla rated high severity. The browser had already been examined by several generations of security-focused AI, including Claude Mythos. "Firefox entered 2026 as one of the most hardened and scrutinized codebases in the world," said Mozilla engineer Brian Grinstead, as quoted by OpenAI.

On Linux, the company developed 948 exploitation tactics that let an ordinary user take full control of a system. That is more than five times the 166 found by GPT-5.6 in the same test three months earlier. The run cost about $1.2 million in compute.

Before the announcement, industrial security firm Dragos tested the model on a mock power plant. With almost no guidance, it found two unknown flaws. Dragos AI chief Rob T. Lee said the skill needed for the reconnaissance and vulnerability research that precede an attack is falling.

Better alignment, lingering doubts

OpenAI stresses that the model follows rules better. In a dedicated test, GPT-6 Cyber refrained from attacking services outside its task 99.93% of the time, versus 94.49% for its predecessor. The test follows a summer incident that ended with the hacking of Hugging Face. "More than 99% of the time, it does what you ask," said OpenAI security lead Fouad Matin.

Not every expert is reassured. Chris Hughes of Noma Security noted that at the scale these models operate, even a small fraction means actions against systems nobody authorized.

OpenAI describes a race against time: it says there is a limited window to use frontier models to secure software before malicious actors exploit the same technology. That is why the company keeps releasing new models aimed at tracking down vulnerabilities.