| Claim as published | Status | Basis |
|---|
| OpenAI introduced GPT-6 Cyber on 5 November 2026. | Verified | Publication date and headline on the OpenAI article page, opened this run. |
| OpenAI says a pipeline using its cyber model validated and generated patches for 948 local privilege escalation vulnerabilities in Linux at an API cost of $1.2 million. | Attributed | Quoted from OpenAI's A thousand fewer paths to root, 4 November 2026. Vendor-reported; not independently audited. |
| The pipeline cost $1,213,430 in API credits, or $1,279 per exploit, and reproduced 1,724 vulnerabilities from 2,308 candidates. | Attributed | OpenAI research account, read this run. Costs are the company's own accounting. |
| OpenAI classifies GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. | Attributed | OpenAI announcement, read this run. The framework and the rating are OpenAI's own. |
| OpenAI reports 48.5 per cent on ExploitGym versus 32.1 per cent for GPT-5.6 Cyber, and 95 per cent completion on RemoteExploitBench. | Attributed | OpenAI announcement, read this run. Vendor benchmarks; evaluation settings were not independently inspected. |
| OpenAI says the model avoided exploiting out-of-scope services in 99.93 per cent of tests without its deployment prompt and 100 per cent with it. | Attributed | OpenAI announcement, read this run. Alignment evaluation results are self-reported. |
| OpenAI says its researchers identified 81 previously unknown high-severity vulnerabilities in Firefox and that Mozilla has released fixes for many. | Attributed | OpenAI announcement, read this run. Mozilla was not contacted and no Mozilla advisory was retrieved. |
| The hypothetical $18.9m to $66.3m valuation is OpenAI's own comparison against historical bug bounty prices. | Attributed | OpenAI research account. Presented in the article as a hypothetical, not a realised value. |
THAF verified draft pipeline, run of 2026-11-09, single-agent fallback (no delegation tool was available in this run). The primary document is OpenAI's GPT-6 Cyber announcement, published 5 November 2026, located on OpenAI's own news index this run and opened and read in full. The secondary document is OpenAI's security publication A thousand fewer paths to root, published 4 November 2026, also located on the same index and opened and read in full. Both are OpenAI publications: they are the company's own account of its own model and its own evaluation, and no independent evaluation or third-party report was retrieved. Every quotation in the article is drawn from the primary announcement and was checked character for character against its retrieved text; material from the secondary account is paraphrased and attributed to OpenAI rather than quoted. The OpenAI system card, linked from the announcement, was not opened this run, so nothing here rests on it.
| # | Claim now in the article | Source | Status |
|---|
| C1 | OpenAI’s screening agents narrowed 1,724 validated findings to 313 information-leak candidates and 1,238 local privilege escalation candidates. | OpenAI, “A thousand fewer paths to root”, 4 November 2026, Exploitability assessment section. | VERIFIED — quoted figure from the retrieved account. |
| C2 | The exploitation agents produced 291 information-leak proofs of concept and 1,169 working local privilege escalation exploits. | Same account, same section. | VERIFIED. |
| C3 | Variant analysis produced 948 distinct patches, and OpenAI says it uses that number “to determine the overall number of unique LPEs”. | Same account, same section. | VERIFIED — this is the sentence that defines 948. |
| C4 | OpenAI also describes the 948 as working exploits, in its own summary and in the 5 November announcement. | 4 November introduction and Findings section; 5 November announcement. | VERIFIED — recorded so the article does not assert a distinction stricter than its sources. |
Produced under human editorial authority. Nothing in this file is published.