OpenAI's GPT‑6 Cyber AI Discovers 81 Firefox Zero‑Days and 948 Linux Kernel Privilege‑Escalation Bugs
What Happened — OpenAI announced its GPT‑6 Cyber model, an AI system built to locate and validate software flaws. In internal testing the model identified 81 previously unknown high‑severity vulnerabilities in the Firefox browser and generated working exploits for 948 distinct Linux kernel bugs, including local‑privilege‑escalation paths that could let an unprivileged user obtain root. The research also reproduced 1,724 of 2,308 potential Linux flaws and produced patches for many of the Firefox issues, which Mozilla has begun releasing. Access to GPT‑6 Cyber is currently limited to a small group of OpenAI “Daybreak Red” customers, with broader rollout planned later.
Why It Matters for Trust & Control Assurance — The ability of frontier AI to automate large‑scale vulnerability discovery underscores the need for explicit AI‑model governance and continuous evidence of risk‑mitigation controls.
Who Is Affected — Software vendors, open‑source projects, cloud‑service providers, and any organization that relies on third‑party code libraries.
Recommended Actions –
- Map your AI development and testing processes to AI‑governance control objectives (e.g., risk assessment, model validation, exploit‑mitigation).
- Capture and retain evidence of AI‑driven testing, patch validation, and remediation timelines for audit readiness.
Technical Notes – The model uncovered high‑severity CVE‑style flaws in Firefox (severity > 7.0) and Linux kernel bugs that enable local privilege escalation (CWE‑284). No public CVE identifiers were assigned at the time of reporting. Source: BleepingComputer