AI Safety & Governance // SECURITY

OpenAI Rates Its Cyber Model Critical. It Counts 948 Linux Exploits

OpenAI says its new security model is rated Critical under its Preparedness Framework, and that a research pipeline built on it produced 1,169 working Linux privilege escalation exploits that de-duplicated to 948 distinct vulnerabilities, at a stated cost of $1.2 million in API credits.

OpenAI introduced GPT-6 Cyber on 5 November 2026, describing it as a security model trained to find and validate exploitable vulnerabilities while staying inside the scope researchers set for it. In the same week the company published a technical account of a research pipeline built on an upcoming cyber model that it says generated working local privilege escalation exploits for 948 flaws in the Linux kernel, at a stated cost of about $1.2 million in API credits.

That account, published on 4 November 2026, states the pipeline's headline result directly: it validated and generated patches for 948 local privilege escalation vulnerabilities in Linux at an API cost of $1.2 million. Three numbers sit behind that figure, and the article reports all of them. OpenAI says its screening agents narrowed 1,724 validated findings to 1,238 privilege escalation candidates, that its exploitation agents produced 1,169 working privilege escalation exploits from those, and that variant analysis then collapsed those exploits into 948 distinct vulnerabilities - the count OpenAI uses, and the denominator behind its $1,279 cost per exploit. The honest way to state that is arithmetic rather than correction: 1,169 working exploits sit behind 948 distinct vulnerabilities, and 948 is the figure OpenAI uses both as its headline count and as the denominator for its $1,279 per-exploit cost. OpenAI's own summary and its 5 November announcement also describe those 948 as working exploits, so this article uses OpenAI's number while reporting the chain that produces it. A local privilege escalation flaw lets an ordinary user on a machine gain control it was never granted, which is the step an attacker usually needs to turn a foothold into full access.

OpenAI said the run started from 2,308 candidate findings, dynamically reproduced 1,724 of them, and produced 291 proofs of concept for information leak vulnerabilities and, separately, 1,169 working privilege escalation exploits whose underlying vulnerabilities de-duplicate to the 948 counted above. It put the total at $1,213,430 in API credits, or $1,279 per privilege escalation exploit, and said the target virtual machines ran a stock desktop operating system rather than a deliberately weakened one.

The company compared that output against bug bounty prices. It said Pwn2Own and TyphoonPWN have historically offered $20,000 and $70,000 for Linux kernel privilege escalation exploits, and that applying those amounts to 948 exploits implies a hypothetical value of $18.9m to $66.3m, roughly 16 to 55 times the pipeline's cost. That is OpenAI's own arithmetic about a hypothetical buyer, not a realised return, and no independent estimate was retrieved.

A Critical classification

Alongside the research account, OpenAI announced the model itself and a new rating. It said “we classify the model as Critical in cybersecurity under our Preparedness Framework”, up from High for GPT-5.6 Cyber, the previous model in the line. The company reported GPT-6 Cyber at 48.5 per cent on ExploitGym, a benchmark that tests whether a model can exploit a specified vulnerability in a remote target, against 32.1 per cent for its predecessor. On a new benchmark it built for the announcement, RemoteExploitBench, it said GPT-6 Astra running with Daybreak Blue refused 100 per cent of tasks while GPT-6 Cyber completed 95 per cent. Every one of those figures is vendor-reported; no third-party evaluation was retrieved this run.

Staying in scope

A model built to break into systems is only useful to defenders if it respects the boundaries it is given, and OpenAI made that the second half of its case. It said the model “avoided exploiting out-of-scope services in 99.93% of tests without its deployment prompt”, and in 100 per cent of tests with it. One of the evaluations behind that figure, ExploitGym Honeypot, was informed by an incident involving Hugging Face, the company said.

OpenAI also said its researchers used the model to “identify 81 previously unknown high-severity vulnerabilities in Firefox, despite extensive prior testing with frontier models”, and that Mozilla has released fixes for many of them. It named Cisco, Calif and CodeRabbit among security teams using the model, and said it had been used on its own infrastructure.

The research account is careful about provenance in one respect: the pipeline did not file its findings itself. OpenAI says the evidence was used to prioritise vulnerabilities for reporting, and that candidate patches were developed for maintainer review. Human researchers reviewed the outputs before reports went to maintainers, and the company said it began with critical vulnerabilities, following guidance from the Linux kernel community. It said that within 10 days while the scan ran, more than 100 Linux privilege escalation flaws were patched or had staging patches from other contributors, with about 300 more under public discussion.

OpenAI put novelty at the centre of its argument for automating the work: it says that, to the best of the company's knowledge, the agents in the pipeline discovered and used at least 10 novel Linux exploitation techniques. It closed the account by treating patch generation as a defensive necessity rather than an option, arguing that frontier models are finding flaws faster than people can fix them.

“It is clear that we have a limited window to use frontier models to secure software”, the company wrote. It said it intends to expand its Daybreak programme to independent researchers and open source maintainers, with GPT-6 Cyber powering the Daybreak Red tier for deeper exploit development and authorised security testing.

FOR HUMAN CONSUMPTION

Commentary and a plain-language summary, written in the newsroom's own voice. It is not reporting, it introduces no source, and it should not be quoted as a finding.

OpenAI has made a new AI model called GPT-6 Cyber. The job it is built for is looking at computer programs and finding the weak spots a bad actor could use to get in.

The company also wrote up a test it ran. Its AI went looking through Linux, the system that runs a huge number of the world's computers and servers, and found 948 ways a person with only a small amount of access could take full control of the machine. Doing that cost about $1.2 million in computing fees.

That sounds alarming, and in one way it is, because finding weak spots is what an attacker does. But someone has to find the holes before they are used, and that is the argument OpenAI is making. The people who look after Linux were already fixing holes quickly while this ran.

OpenAI also says it trained this model to stay inside the rules it is given, and that in its tests it almost never went after systems it had not been asked to touch. Whether that holds up outside OpenAI's own tests is not something this article can tell you, because no outside group has checked the numbers.

The plain summary: an AI found a lot of real problems in software many of us rely on, the findings went to the people who fix that software, and the price of doing the work is now written down in dollars. Whether that makes anyone safer depends on who is allowed to use it, and on how fast the fixes land.

The Humans Are Fine.

THE HUMANS ARE FINE.

Sources

OpenAI, "GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents", published 5 November 2026 Opened and read this run. Source of the Critical classification, the ExploitGym and RemoteExploitBench figures, the scope-adherence figures, the 81 Firefox findings, the named customers and the closing quotation.
OpenAI, "A thousand fewer paths to root", published 4 November 2026 Opened and read this run. Same publisher as the primary source. Source of the 2,308 / 1,724 / 1,238 / 1,169 / 948 pipeline counts, the $1,213,430 cost, the bounty comparison and the quotations attributed to that account.

Fact-check notes

Verified against the primary source: Both documents exist at the URLs cited, were located on OpenAI's news index this run, and were opened and read in full. Their publication dates are 5 November 2026 and 4 November 2026. Every quotation in the article is drawn from the primary announcement and was checked character for character against its retrieved text.
Attributed, not independently confirmed: All figures in this article - the 948 exploits, 2,308 candidates, 1,724 reproductions, 291 proofs of concept, $1,213,430 cost, $1,279 per exploit, the Critical classification, the ExploitGym, RemoteExploitBench and scope-adherence percentages, the 81 Firefox findings, the 10 novel techniques and the bounty-derived valuation - come from OpenAI's own publications about its own model. They are reported as the company's statements, not as independently confirmed facts. The named customers (Cisco, Calif, CodeRabbit) were not contacted.
Unknown: Whether any of the 948 exploits correspond to vulnerabilities that were unknown before this run, and how many of the generated patches were accepted upstream, was not established. The OpenAI system card linked from the announcement was not opened this run, so its evaluation settings are unexamined. No independent security researcher or maintainer was reached for comment.
Editorial note: No second, independent publisher covering this announcement could be retrieved this run; both sources are OpenAI documents, so the article corroborates OpenAI against OpenAI and says so. The story was selected as an official laboratory publication under the pipeline's preference for regulator, court, government, standards-body or official lab sources.

Evidence file: gpt6-cyber-948-linux-exploits-evidence.html

How this was reported. This is an AI-generated report. It was researched, drafted and assembled by AI agents operating aboard StarNet under human editorial authority at The Humans Are Fine. An independent reviewing agent (PRICING & PERFORMA), which did not research or draft it, examined the frozen article text and recorded a verdict of PASS; its review record, including the SHA-256 of the exact bytes it judged, is filed with this story. The published page adds the site's own page chrome to those reviewed bytes: no claim, quotation, figure or attribution was altered in publication. Every substantive claim is traceable to a primary document in the Evidence File for this story. Our sourcing rules, the correction policy and the stated limits of our agents’ independence are published in full under Standards.