On November 5, 2026, OpenAI introduced GPT-6 Cyber, an AI model designed for cybersecurity research. In one research test, an AI-powered pipeline examined the Linux kernel, reproduced 1,724 vulnerabilities, and developed 948 working root-level exploits. The process took around 30 hours and cost approximately $1.2 million.
But the biggest takeaway is not just the number of vulnerabilities discovered. It is how quickly AI can find and test security weaknesses. This creates a new challenge for security teams. If your company still follows a monthly patching schedule, some vulnerabilities may remain open long enough to create serious risks.
In this blog, we will explain what GPT-6 Cyber did, what the reported numbers actually mean, and how businesses can improve their vulnerability management and patching processes.
Key Highlights
- 948 working exploits developed for Linux kernel vulnerabilities.
- 1,724 vulnerabilities reproduced in around 30 hours.
- $1.2 million total cost, averaging $1,279 per exploit.
- 48.5% ExploitGym score, compared with 32.1% for GPT-5.6 Cyber.
- 81 high-severity Firefox bugs identified and shared with Mozilla.
- 304 critical Linux findings reported to maintainers with proposed patches.
- 10 new exploit techniques discovered by AI agents.
- Limited access: GPT-6 Cyber is available only to approved Daybreak Red customers.
- Main concern: The delay between finding a vulnerability and installing its patch creates a security risk.
Why This Matters Right Now
Imagine your server has a small bug in its Linux kernel. A year ago, a security researcher might have needed weeks to turn that bug into a working attack. Today, an AI agent may be able to do the same work in just a few hours.
That is the big change behind GPT-6 Cyber. OpenAI warns that attackers with enough resources can use AI to find and exploit weaknesses faster. This means businesses should not ignore security risks just because an account has limited access or some patches are still pending.
The numbers also show why this matters. Google Threat Intelligence Group reports that monthly vulnerability disclosures more than doubled in 2026, rising from 5,045 in January to 10,740 in August. High-risk disclosures also increased from 131 to 350. The UK's National Cyber Security Centre has warned that security teams need to improve their patching and testing speed.
In this blog, we will explore AI-powered cybersecurity, automated vulnerability detection, and AI patch management. The goal is to help CTOs, engineering leaders, and security teams understand the risks and build a better security plan.
What Is GPT-6 Cyber?
GPT-6 Cyber is an AI model from OpenAI designed for cybersecurity research. It is based on GPT-6 Astra and trained to find, test, and confirm software vulnerabilities while following the limits set by security researchers.
OpenAI has given GPT-6 Cyber a "Critical" risk rating under its Preparedness Framework. This is the highest risk level the company has assigned to a model. Because of these risks, access is limited to approved Daybreak Red organizations through the API and Codex. Reports say users must have single sign-on (SSO), multi-factor authentication (MFA), managed devices, and IP allowlisting. OpenAI has not shared its pricing yet.
Safety is another important part of this model. OpenAI says GPT-6 Cyber follows security rules more closely than older models. To test this, the company used a "honeypot" setup with fake, vulnerable systems placed near the real target. Without safety instructions, the model accessed systems outside the approved scope in just 0.07% of runs. With safety instructions enabled, this dropped to 0%.
GPT-6 Cyber Test Results: What the Numbers Reveal
OpenAI's Linux kernel test shows how quickly AI can find and test software security weaknesses. The following table explains the main results, including the number of vulnerabilities found, working exploits created, testing time, and total cost.
| Metric | Result | What it means |
|---|---|---|
| Linux code checked | 5,034 targets (around 7% of the kernel) | AI focused on code that users with limited access could reach. |
| Possible bugs found | 2,308 | The AI agents identified potential security problems. |
| Confirmed vulnerabilities | 1,724 | These bugs were successfully reproduced in a test environment. |
| Working root exploits | 948 | The AI turned these bugs into attacks that could give a normal user root access. |
| Information leak proofs | 291 | Tests showed how some bugs could expose private information. |
| Testing time | Around 30 hours | The research run took place in mid-October 2026. |
| Total API cost | $1,213,430 | The average cost was around $1,279 per working exploit. |
| ExploitGym score | 48.5% vs. 32.1% | GPT-6 Cyber scored higher than GPT-5.6 Cyber. |
| Older model comparison | 166 exploits (GPT-5.6 Sol) | GPT-6 Cyber created more than five times as many exploits in the reported comparison. |
| Firefox vulnerabilities | 81 high-severity bugs | Mozilla addressed these issues in Firefox 159 (advisory MFSA 2026-118). |
What Does the $1.2 Million Cost Really Mean?
The research pipeline used approximately $1.21 million in API credits to complete the Linux kernel testing. This works out to around $1,279 for each working exploit.
One news report compared these results with past bug bounty payments and estimated that the same 948 exploits could have been worth between $18.9 million and $66.3 million. However, this is an external estimate, not a figure reported by OpenAI.
The main takeaway is that AI has made vulnerability research much faster and potentially less expensive. Security teams now need to focus not only on finding bugs but also on fixing them before attackers can take advantage of them.
How the GPT-6 Cyber Pipeline Works: 5 Key Stages
The 948 working exploits did not come from a single prompt. OpenAI used an AI agent pipeline with five stages to find, test, and fix software vulnerabilities. Each stage has a specific role in making vulnerability detection and remediation more reliable.
1. Vulnerability Discovery
AI agents first identify important parts of the code that may contain security weaknesses. They focus on areas that users with limited access can reach. The agents then scan these areas and identify possible bugs that could create security risks.
2. Dynamic Validation
After finding possible bugs, AI agents try to reproduce them in a safe testing environment called a sandbox. They collect evidence to confirm whether each bug is real. If a bug cannot be reproduced, it is removed from the list to reduce false results.
3. Exploitability Assessment
Once a vulnerability is confirmed, AI agents check how an attacker could use it. They test whether the bug could expose sensitive data or allow a normal user to gain root access. They also create a proof of concept to show how the vulnerability works.
4. Patch Generation
After confirming a vulnerability, AI agents create a possible code fix, also called a patch. The patch aims to close the security gap and prevent attackers from using the same weakness. Security teams can review and test these suggested fixes before applying them to live systems.
5. Human Review
Security researchers review the findings, working exploits, and suggested patches before sharing them with software maintainers. They check whether the fixes work correctly, follow the project's coding standards, and address related security problems. Human review helps reduce mistakes before a patch is approved.
Why This Matters for Businesses
The pipeline does more than find security bugs. It connects five important tasks: finding vulnerabilities, testing them, checking their impact, creating fixes, and reviewing those fixes. This complete process can help security teams improve automated vulnerability detection and speed up vulnerability remediation.
What the Number 948 Really Means
The 948 figure needs some context. It does not mean that all findings were new or fixed.
- 588 were previously unknown vulnerabilities. The remaining findings involved known issues that AI could successfully exploit.
- Duplicates were removed. Researchers reduced 1,169 working exploits to 948 independent findings by merging those linked to the same root vulnerability.
- 304 critical findings were disclosed. OpenAI shared them with maintainers along with candidate patches, but these still need review and release.
- Not all findings are fixed. One developer report suggested that less than 25% had been fixed, though this figure could not be independently confirmed.
- These were local privilege escalation bugs. An attacker needs initial system access before using them to gain higher privileges.
This matters because an attacker can turn limited access into full system control. Finding vulnerabilities is only the first step; patching them is equally important.
Attackers vs Defenders: Who Gains More?
AI gives both attackers and defenders new capabilities. Attackers can find and exploit vulnerabilities faster, while security teams can use AI to detect bugs and develop patches sooner.
However, reports from VulnCheck and the UK NCSC warn that AI tools can lower the technical skills needed to discover and exploit vulnerabilities. This makes fast patching more important than ever.
| Area | Traditional Approach | With AI-Assisted Discovery |
|---|---|---|
| Exploit development | Often takes weeks or months | Can happen much faster |
| Exploit cost | High research and development costs | About $1,279 in OpenAI's reported run |
| Required skills | Advanced security expertise | Lower entry barrier |
| Patch priority | Depends on vulnerability risk | Faster response is increasingly important |
| Main challenge | Finding hidden vulnerabilities | Fixing known vulnerabilities quickly |
The advantage goes to organizations that can detect, prioritize, and patch vulnerabilities before attackers exploit them.
How Teams Can Work With RejoiceHub
Finding vulnerabilities is only one part of improving security. Teams also need a clear process to test, review, and fix them. RejoiceHub LLP helps businesses build AI agents and automation that support these engineering workflows.
Teams can start in three ways:
| Engagement Model | Best For | What It Includes |
|---|---|---|
| Assessment Sprint | Teams that need a starting point | Asset review, patch-time audit, and improvement plan |
| Pilot Build | Teams testing AI-powered security workflows | One agent pipeline with human review and reporting |
| Ongoing Partnership | Teams managing multiple systems | Agent improvements, workflow updates, and governance support |
The right approach depends on your infrastructure, security needs, and existing workflows. Pricing also varies based on the number of systems, environments, and approval steps involved.
Want to explore AI-powered security automation? Share your requirements with RejoiceHub, and the team can suggest a suitable approach and estimated cost.
Conclusion
GPT-6 Cyber shows how quickly AI can find and exploit security weaknesses. The 948 findings, 30-hour timeline, and $1,279 cost per exploit highlight how much faster vulnerability discovery has become. This means businesses cannot rely only on monthly security updates.
AI can also help security teams find and fix problems faster, but human review is still important. Start by checking how long your team takes to fix and deploy security patches. Then, use AI to improve the areas that take the most time.
You do not need to change everything at once. Start with one system, measure the results, and improve your security process step by step.
Frequently Asked Questions
What is GPT-6 Cyber?
GPT-6 Cyber is an advanced AI model created by OpenAI for cybersecurity research. Released on November 5, 2026, it tests system defenses by automatically finding vulnerabilities, writing working exploits, and helping security teams protect their software systems much faster.
How many Linux exploits did GPT-6 Cyber find?
GPT-6 Cyber successfully developed 948 working exploits during a major test. The automated pipeline examined the Linux kernel thoroughly, reproducing thousands of complex security flaws in just thirty hours of total testing time for the system.
How long did it take GPT-6 Cyber to reproduce vulnerabilities?
It took approximately thirty hours for GPT-6 Cyber to reproduce 1,724 vulnerabilities in the Linux kernel. This incredible speed shows how fast artificial intelligence can process complex code compared to human security researchers working manually.
What was the total cost of running GPT-6 Cyber?
The total cost of running GPT-6 Cyber reached approximately 1.2 million dollars. This breaks down to an average cost of about 1279 dollars for every single working exploit created during the kernel security research test.
Who can access GPT-6 Cyber right now?
GPT-6 Cyber is currently available only to approved Daybreak Red customers under strict guidelines. OpenAI restricted public access because the model has powerful hacking capabilities that require careful monitoring to prevent misuse by malicious actors.
