OpenAI’s GPT‑6 Cyber AI Model Discovers 81 High‑Severity Firefox Vulnerabilities and 948 Linux Kernel Flaws
What Happened — OpenAI released GPT‑6 Cyber, a frontier‑model variant trained to locate software weaknesses, simulate attacker exploitation, and suggest patches. In a series of controlled tests the model identified 81 previously unknown high‑severity bugs in Mozilla Firefox and crafted working exploits for 948 Linux‑kernel vulnerabilities. OpenAI used the findings to harden its own training infrastructure, tighten network segmentation, and report the issues to vendors, who have begun issuing patches. The model was also evaluated with Dragos on a mock power‑plant environment, where it uncovered two zero‑day flaws in engineering software that could expose protective‑relay settings. All testing was performed under strict authorization, with sandboxing, human‑in‑the‑loop review, and “Private Safety Processing” safeguards.
Why It Matters for Trust & Control Assurance — The episode highlights the need for continuous, automated vulnerability‑management controls that generate defensible evidence for audit readiness.
Who Is Affected — Technology‑SaaS providers, browser vendors, operating‑system maintainers, and any organization that relies on complex software stacks.
Recommended Actions
- Integrate AI‑assisted scanning into your vulnerability‑management program and map findings to your control framework.
- Document remediation steps and retain evidence (scan logs, patch tickets) in a centralized Trust Center for audit reviewers.
Technical Notes
- Attack vector: AI‑driven vulnerability discovery (model‑generated exploit code).
- Vulnerabilities: 81 high‑severity Firefox bugs (CVE IDs pending), 948 Linux‑kernel flaws (including a critical Brotli RCE).
- Safeguards: sandboxed execution, action‑review pipelines, credential‑use monitoring, and human oversight for high‑risk workflows.