OpenAI Flags GPT‑6 Cyber as ‘Critical’ After Uncovering 81 High‑Severity Firefox Flaws and Hundreds of Linux Bugs
What Happened — OpenAI announced that its newly released GPT‑6 Cyber model, purpose‑built for security research, has identified a large volume of previously unknown software weaknesses. In internal testing the model reproduced 1,724 Linux‑kernel vulnerabilities and generated working exploits for 948 of them, a more than five‑fold increase over its predecessor GPT‑5.6 Cyber. It also produced evidence for 81 new high‑severity bugs in Mozilla Firefox and highlighted 30 known issues that were under‑reported. OpenAI disclosed 304 critical Linux findings to the upstream maintainers with candidate patches and reported that Mozilla began fixing the Firefox issues shortly after receipt. Based on these results OpenAI raised the model’s cyber‑risk rating from High to Critical.
Why It Matters for Trust & Control Assurance — The episode underscores the need for robust AI‑governance controls that continuously test, monitor, and audit model outputs to prevent inadvertent weaponisation of powerful generative systems.
Who Is Affected — Technology SaaS providers, software vendors, and any organisation that integrates or relies on AI‑driven code‑analysis tools.
Recommended Actions
- Adopt an AI‑model risk‑management policy that mandates regular security testing, output validation, and documentation of findings.
- Map AI‑governance controls to your framework of record (e.g., NIST AI RMF) and collect evidence of model‑testing activities for audit readiness.
Technical Notes — The model was evaluated on public benchmarks such as ExploitGym, web‑penetration‑test suites, and real‑world codebases (Linux kernel, Firefox, GitLab, PostgreSQL, Jenkins). No CVE identifiers were disclosed in the announcement; the findings are reported as “high‑severity” by the affected vendors. Source: SecurityAffairs article