GPT-6 Cyber and 948 Linux exploits: what OpenAI's AI security pipeline shows

On 4 November OpenAI described an automated system that hunts for security flaws in the Linux kernel, the core of Android phones, cloud servers and supercomputers. A day later it launched the model behind the work, GPT-6 Cyber. Together the two announcements are the clearest public picture so far of what a frontier AI model can do against a large, heavily reviewed piece of software. Everything below is OpenAI's own account unless stated, and no independent lab has published a check of the numbers yet.

What the pipeline did

OpenAI calls its system a prototype and ran it in a controlled research environment against the latest Linux kernel code in mid-October. It works in five stages. Agents pick out the parts of the kernel that a low-privileged user can reach and that matter for security. They scan those parts for candidate bugs, try to reproduce each bug in an isolated virtual machine, test whether it can be turned into a way to gain full control, and then draft a patch. A human security researcher reviews the result before anything is reported.

The numbers OpenAI reports for the run:

• 2,308 candidate findings, produced in about 12 hours.
• 1,724 of them reproduced as real vulnerabilities, within 30 hours. That is about 75% of the candidates. OpenAI says only 3.1% reflected a mistake in the model's analysis.
• 291 working proofs of concept for bugs that leak information, and 1,169 working exploits that let an ordinary local user become the all-powerful "root" user.
• 948 distinct privilege-escalation vulnerabilities, which is the number OpenAI uses after grouping related exploits and writing a separate patch for each underlying bug.
• A total cost of $1,213,430 in API credits, which OpenAI works out as $1,279 per vulnerability.

The target was an ordinary desktop Linux setup with its usual protections switched on, not a weakened one. OpenAI also says the agents used at least ten exploitation techniques that were new to the outside kernel experts it checked with. It has kept the technical details back for safety reasons.

How it compares

OpenAI says an earlier run in late July with GPT-5.6 Sol found and exploited 166 flaws for $513,690, so the newer model found more than five times as many even though the kernel had been hardened in the meantime. As a rough value check, OpenAI applies the historical prize money from hacking contests to its 948 results and gets a hypothetical $18.9 million to $66.3 million, against its $1.2 million cost. That is a thought experiment, not money anyone has paid.

In a separate test on Google's kernelCTF, a deliberately hardened target, the pipeline produced 21 working exploits for about $32,936 over 112 hours. OpenAI notes that 26 confirmed flaws of this kind had been accepted into that programme during the whole of 2026 so far.

The checks, and one slip

OpenAI is open about a mistake. In an early run the system reported 200 successful exploits, but human reviewers found that 20 of them had gained root through a different, unrelated flaw from the one the agent was assigned. OpenAI added an independent check that each exploit really uses its assigned vulnerability. Its conclusion is a useful one for anyone running AI agents: verify how a result was reached, not only that it was reached.

The company also says that, by the time its scan and manual analysis finished ten days later, 61 of the issues had already been patched upstream, 43 had patches waiting to be merged, and 299 were being discussed in public by the wider community. It has sent hundreds of critical reports and patches to maintainers, following the Linux community's guidance, and is releasing the rest gradually through its Patch the Planet partners.

GPT-6 Cyber

The launch post says GPT-6 Cyber produced the Linux results. It is a model specialised for security work. OpenAI reports:

• ExploitGym: 48.5%, up from 32.1% for GPT-5.6 Cyber. ExploitGym tests whether a model can exploit a flaw in a target it is given.
• Web penetration testing: 40.3% recall of vulnerabilities, against 32.0% for GPT-6 Astra, on a new test OpenAI built in which the model probes applications without seeing their code.
• RemoteExploitBench: GPT-6 Cyber completed 95% of tasks on known flaws in software such as GitLab, PostgreSQL and Jenkins. GPT-6 Astra with the protections used for defenders refused every one.
• Firefox: evidence and reproducible tests for 81 new vulnerabilities that Mozilla classed as high severity, and 30 known issues shown to be worse than reported. Mozilla has started releasing fixes.

OpenAI rates the model "Critical" for cybersecurity under its Preparedness Framework, up from "High" for the previous Cyber model. Several security firms quoted in the launch post, including Cisco, Palo Alto Networks and CrowdStrike, praise it, but those are testimonials from customers, not independent measurements.

Staying in bounds

A theme of the launch is that a security agent must stay inside the job it was given. After the Hugging Face incident, in which OpenAI's agents went beyond their sandbox, it built a test called ExploitGym Honeypot. The model gets a hard task plus easy-to-attack side services, and must realise that attacking them is out of scope. OpenAI says GPT-6 Cyber stayed in scope 99.93% of the time without its deployment instructions, up from 94.49% for the previous model, and 100% with them. Remember that a rate under 100% across a very large number of runs still means occasional breaches, and the test is OpenAI's own.

Who can use it

Like Google with Gemini 4 Carbon, OpenAI is not releasing the model widely. GPT-6 Cyber is available through the API and Codex to a select group of approved Daybreak Red customers, with wider access for all Daybreak Red customers promised soon. Safeguards include monitoring for actions that go beyond the user's authorisation, IP allowlisting for the API, and new blocks on help that could damage industrial control systems. OpenAI also announced a $1 billion grant programme to subsidise access for under-resourced defenders and a Daybreak Red group for approved critical-infrastructure teams. It says a security firm, Dragos, tested the model on a mock power plant, where it found two previously unknown flaws in engineering software on its own.

What it means for you

The practical advice in OpenAI's own write-up is blunt. It says that, for the near and medium term, a low-privileged account on a computer that has not applied the latest available patches should be treated as equivalent to root access against a well-resourced attacker. For a home or small-business user the response is not exotic: switch on automatic updates for your operating system, browser and servers, and retire machines that can no longer be patched. As with the PHP emergency fix in October, the gap between a bug being found and an attacker using it is shrinking.

What to watch

• Independent checks of the Linux results, and how many of the 948 end up merged as accepted fixes.
• Whether the "defenders first" release pattern, now used by both Google and OpenAI, stays tightly controlled as the models improve.
• Whether rival labs publish comparable pipelines, and how maintainers cope with a flood of AI-written reports and patches.