OpenAI says GPT-6 Cyber found 81 Firefox flaws, and Mozilla has started shipping fixes
OpenAI says its new cybersecurity model helped researchers find 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity. The company says Mozilla has already released fixes for many of the issues, though it has not provided a complete public mapping of every finding to a particular browser update.
The model, GPT-6 Cyber, is designed to help security researchers find and test weaknesses and suggest fixes. It is not a new option available to every ChatGPT user: access is restricted to approved users through OpenAI’s Daybreak Red security program.
The findings are a reminder that even software examined by experienced security teams can have bugs hiding in its code. They are also company-reported research results, not evidence that the 81 Firefox issues were exploited against users.
Image: Mozilla
What OpenAI says it found in Firefox
In its announcement, OpenAI says GPT-6 Cyber produced evidence and reproducible tests for the 81 new findings. It also identified 30 previously known issues that appeared more severe than earlier assessments suggested. Those 30 are a separate group, not another 30 newly discovered vulnerabilities.
Image: OpenAI
OpenAI says it shared the findings and candidate patches with Mozilla. Mozilla’s Firefox 159 advisory lists multiple security fixes that credit OpenAI researchers or OpenAI Codex Security. The advisory does not itself establish which model found each issue or match the full set of 81 to specific fixes.
If you use Firefox, the practical step is the familiar one: keep it updated. The announcement does not say that every issue affects every version or that every fix is included in Firefox 159.
Image: OpenAI
The Linux test measured something different
In separate research, OpenAI says the model reproduced 1,724 Linux kernel vulnerabilities and developed working local privilege-escalation exploits for 948 of them. An exploit demonstrates that a weakness can be used in the tested conditions; that figure is not a count of 948 newly discovered bugs.
The company says it disclosed 304 critical findings to maintainers with proposed patches and is working on other fixes. Its research write-up describes human review before findings are reported, rather than treating the model’s proposed patches as automatically ready to deploy.
OpenAI rates GPT-6 Cyber’s cybersecurity capability as “Critical” under its own preparedness framework. The system card describes identity verification and other access controls; OpenAI’s benchmark and scope-following results should be read as tests under its stated conditions, not a guarantee that the model will never make a mistake.
