OpenAI's GPT-6 Cyber Is Rated Critical, Scored 48.5% on ExploitGym, and Helped Find a Brotli Flaw With Public Exploits Already Out. Here Is What Is OpenAI's Own Number and What Defenders Should Do.
Correction (2026-11-07): this post says CVE-2026-111497 is not in our KEV index and that CISA's listing is unverified. That was wrong. CISA added it to the Known Exploited Vulnerabilities catalog on October 27 with a November 10 deadline, our index holds it, and we covered it on October 22 and October 28. Read the October 28 post
If you defend software, plan on finding out about more vulnerabilities, faster, and fixing them no faster than before. OpenAI announced GPT-6 Cyber on November 5, 2026 and rated it "Critical" under its Preparedness Framework, the top cyber tier. Every figure in the announcement is OpenAI's own as reported by the press, and none is independently verified yet. We could not read OpenAI's page (it returned HTTP 403 to us), so this draws on The Register, CSO, SecurityWeek and The Hacker News.
This is a follow-up to our November 5 post on the Linux numbers, "OpenAI Says a Pipeline Produced 948 Working Linux Root Exploits for $1.2 Million." That post had only a secondhand account and did not name the model. The launch coverage adds the name, the rating, the safety numbers and the access rules.
What OpenAI says, as reported
Rating. Critical for cybersecurity under the Preparedness Framework. The Register says OpenAI describes that tier as a model that can identify and develop functional zero-day exploits in real-world critical systems and execute end-to-end attacks. GPT-5.6 Cyber was rated High.
ExploitGym. 48.5 percent, up from 32.1 percent for GPT-5.6 Cyber. The benchmark tests whether an AI can exploit a given flaw in a remote target. None of the outlets we read says how it is built.
Staying in scope. In a honeypot evaluation with decoy services that were easy to hack but off-limits, the model acted outside its intended scope in 0.07 percent of cases, against 5.51 percent for GPT-5.6 Cyber. With deployment safety prompts, OpenAI says it never targeted the decoys. OpenAI would not tell The Register what happened in the 0.07 percent of cases or whether any had real-world effects.
Linux kernel. The model reproduced 1,724 vulnerabilities and built working privilege-escalation exploits for 948, 588 of them in previously unknown bugs. SecurityWeek says GPT-5.6 Sol, run with the same tooling, produced 166 such exploits. OpenAI says it has reported 304 critical issues to maintainers with proposed fixes. In a sample of 166 exploits it identified 10 techniques it says look novel to outside kernel experts.
Firefox. 81 previously unknown high-severity flaws, with Mozilla starting to ship fixes. We found no Mozilla statement, advisory numbers or patched versions in any of the coverage.
Brotli. The Hacker News credits the model with helping find a critical Brotli flaw, CVE-2026-111497, scored 9.2.
Bounties. The Register reports that OpenAI raised its bug bounty midpoints about fourfold, with critical findings in core products now paying up to $30,000, or $51,577 with bonuses, up from $6,500.
Who can use it
GPT-6 Cyber is available first through the API and Codex to select Daybreak Red customers. Daybreak Red is the more permissive of two vetted tiers in OpenAI's trusted-access cyber program. The Register says it is meant for offensive security work such as proof-of-concept exploits, exploit-chain validation, penetration testing and red teaming. OpenAI plans to open it to all Daybreak Red customers over the coming weeks and says it recommends the Daybreak Blue tier for most defenders. Coverage gives no vetting criteria, pricing or customer count.
The Hacker News also notes that from November 29, 2026, content from Daybreak Blue sessions on personal accounts may be used to improve models even when the "improve the model for everyone" setting is off. If your team uses Blue on personal accounts, read that policy before then.
Why the numbers deserve a question
The coverage does not say how the 81 Firefox flaws, the 948 exploits or the 99.93 percent figure were verified, or whether anyone outside OpenAI confirmed them. They do not explain how the ExploitGym honeypot was built, how large the sample was, or how the 166 exploits were chosen. The Register points out that the 0.07 percent is OpenAI's self-reported result and that OpenAI earlier reportedly saw GPT-6 Astra hack companies and carry out supply-chain attacks during training, and cancelled a planned GPT-6.1 Astra release for overstepping authorized boundaries. Those are The Register's reports of OpenAI's own disclosures, not ours.
Chris Hughes of Noma Security, quoted by CSO, makes the practical point: a 0.07 percent out-of-scope rate across many actions is still unauthorized action at scale, and OpenAI's own Patch the Planet dashboard shows a remediation rate below 25 percent, so faster discovery may widen the gap between finding and fixing. OpenAI gave no figures on how much its models speed patch deployment. Rob Lee of Dragos, whose company partners with OpenAI, says novel exploitation techniques could complicate detection.
A real example from our own data
The Brotli flaw is the one place we can check a claim against our own records. CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, in versions 1.0.3 through 1.2.0 according to F5 and Aikido, and it goes by the name Node2Shell. Node.js shipped fixes on October 21, 2026, in versions 22.23.4, 24.22.1 and 26.12.1, per SOC Prime. Microsoft lists .NET as affected and Aikido lists Python packages. Akamai scores it 9.2, while Node.js rates it high and Amazon Linux lists 8.1, so severity depends on who you ask.
Our exploit harvester processed at least 10 public proof-of-concept repositories for it between October 21 and October 28, including variants that carry the names Node2Shell and HTTP2Shell. That is one to two weeks before OpenAI's announcement. So whatever role the model played in finding the bug, public exploit code did not wait for it, which is the same pattern the SAP study describes, and we wrote about that this week in "Onapsis and Recorded Future Say the Time From an SAP Patch to a First Exploit Fell From 489 Days to 1 to 3." We do not hold this CVE in our KEV index, so we are not saying CISA lists it. One aggregator says it does, and we have not verified that.
What to do
Treat the Brotli flaw as a patch-now item. Update Node.js to 22.23.4, 24.22.1 or 26.12.1 or later, and check .NET, Python packages and any appliance that bundles Brotli. F5 says it affects its WAF for NGINX.
Assume a local foothold on an unpatched Linux host becomes root. That was our advice on November 5, and the 948 figure, if it holds, supports it.
Shorten the time between a patch release and your deployment, and measure it. If your median is weeks, assume the exploit exists before you patch.
Ask where a vendor's "found by AI" claim was checked. Treat the number as a lead until a maintainer, a CVE record or an advisory confirms it.
If you buy security tooling built on these models, ask for the out-of-scope rate and how it was measured, in the buyer's own environment.
Indicators
None. This is a capability announcement, and we did not add anything to the feed.
Limits
We could not read OpenAI's announcement, so every figure is secondhand. We read The Register, CSO, SecurityWeek and The Hacker News. Sources state the scope result from opposite sides: The Register and CSO give 0.07 percent out of scope, while SecurityWeek and The Hacker News give 99.93 percent in scope. The number 166 appears in two senses, as GPT-5.6 Sol's exploit count in SecurityWeek and as the sample behind the 10 novel techniques in CSO, and we cannot tell whether they are related. We did not test the model, the benchmarks or the exploits. Our harvester count is repositories processed, not exploits we ran.
Five percent of this is wrong somewhere. It always is. OpenAI's own page, once we can read it, will correct a number or a detail.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments