OpenAI's GPT-6 Cyber reportedly found 81 unknown flaws in Firefox

OpenAI has released 'GPT-6 Cyber', a model specialized for cybersecurity, to a limited set of customers, Fortune reported on Nov. 5. Access is reportedly limited to selected customers of Daybreak Red, OpenAI's restricted-access cyber model for testing defenses from an attacker's point of view. Under OpenAI's internal safety framework, the model's cyber risk is rated 'Critical', the highest level. It also reportedly found 81 previously unknown serious flaws in the Firefox browser. OpenAI's X post (around 17:00 UTC on Nov. 5, based on the post ID) and its announcement page could not be accessed, and all scores and figures are based on Fortune's reporting.

For Japanese companies: For now, Japanese companies are unlikely to get access to this model any time soon. But the faster AI finds flaws, the more updates browsers and business software will need, and the less time attackers will need to turn a patch into an exploit. Companies should check how many days it takes them to bring Firefox and Chrome on employees' devices up to date.

What was reported, and what remains unconfirmed

Fortune's report establishes three things. First, the model is called GPT-6 Cyber and is specialized for security. Second, access is limited to selected Daybreak Red customers. Third, it reportedly found 81 previously unknown serious flaws in Firefox. Fortune framed the release as coming amid growing alarm about AI-driven cyberattacks.

Much remains unknown. Has Mozilla, the organization that makes Firefox, confirmed the 81 flaws? Have they been assigned identifiers and fixed, or are they still unpatched? Does GPT-6 Cyber use the same weights as GPT-6 Astra with looser refusal limits, or was it trained separately? How much does it cost, and what criteria were used to select customers? None of these points has been confirmed through primary sources.

'Critical' is the top tier of OpenAI's framework

OpenAI classifies model risk in tiers under an internal framework called Preparedness. 'Critical' is the highest tier. In the cyber category, it means the company itself judges the model to have capabilities that could lead to severe harm.

This is not the first time an OpenAI model has been rated 'Critical' for cyber. The system card (primary source) for GPT-Rosalind-6, a biology model released on Oct. 30 only to vetted organizations, said it uses the same weights as GPT-6 Astra and rated it 'Critical' for cyber. The Oct. 26 addendum for GPT-6.1 Terra also rated it 'Critical' for cyber. What is new is that OpenAI has released a dedicated model that lets users directly apply that top-tier capability to testing defenses.

Why only selected customers

Daybreak Red was already a restricted-access model. On Nov. 4, it became available on AWS GovCloud (US-East), a cloud for the U.S. government (primary source). Releasing GPT-6 Cyber only to a further-selected subset of those customers suggests OpenAI considers the model too dangerous to offer to general developers.

This approach mirrors that of other major companies. Google's Gemini 4 Carbon is still available only to selected cyber defenders and trusted partners through a program called Fairwind. Anthropic, through an access-review system launched on Oct. 6, offers its top model, Claude Mythos 5.1, in three tiers: defense, offensive testing and critical infrastructure. Giving the strongest cyber capabilities only to vetted parties is becoming the industry standard. It is not yet known whether OpenAI has applied to cyber the approach it used for the biology version: selling its flagship model to selected parties with restrictions loosened.

How to read Firefox's 81 flaws

Firefox had already drawn attention as a benchmark for AI cyber capabilities. In late October, Epoch AI reported that GLM 5.3, an open-weight model anyone can obtain, was able to build working exploit code from Firefox's public patches (primary source). It succeeded on all six versions before the updates reached users, at a cost of about $1,000 per version. That case involved exploiting flaws that had already been fixed.

If the report is accurate, GPT-6 Cyber goes a step further: it found 81 unpatched flaws that no one knew about. If defenders find and fix them first, attacks can be prevented. But if the same capability reaches attackers, attacks exploiting unknown holes (zero-day attacks) will increase. That is also why OpenAI is restricting who can use the model.

Still, it is too early to take the figure of 81 at face value. Candidate flaws found by AI can include ones whose severity was misjudged, as well as duplicates. Until Mozilla confirms them and publishes fix records, the figure should be read as a reported number.

What to watch

If OpenAI's announcement page and system card become accessible, the scores and the details of the Preparedness evaluation can be verified. Another key question is when Mozilla will publish fixes and identifiers for the 81 flaws. How far will GPT-6 Cyber spread to other customers and governments? And how well will limiting access to selected parties prevent leakage to attackers? None of these questions has been answered yet.