948 Linux flaws in one run: what OpenAI's GPT-6 Cyber means for your servers

TL;DR. On November 5, OpenAI introduced GPT-6 Cyber, a model only for vetted security teams. OpenAI rates it "Critical" on its own risk scale for cyberattacks, the highest level. In a single run in mid-October, it reproduced 1,724 flaws in the Linux kernel and wrote a working attack for 948 of them that gives a plain user account full control of the machine. Cost: $1,279 per flaw. OpenAI draws the conclusion itself: a plain account on a Linux system without the latest updates is, for well-resourced attackers, practically as good as root, the account with every permission. We counted how fast the fixes arrive. Of 23 kernel fixes credited to OpenAI that the widely used long-term version 6.12 needs, five had shipped by October 30.

What OpenAI reported

There are two publications: the research report from November 4 and the model launch from November 5. The setup is a chain of agents. Scouts picked 5,034 targets in the kernel, about 2.8 million lines or roughly 7 percent of the code. Analyst agents reported 2,308 possible flaws from them in twelve hours. Other agents tried to reproduce each one in an isolated virtual machine and succeeded for 1,724. Finally, agents wrote real attacks on a system with the usual protections of a standard distribution. After removing duplicate root causes, 948 distinct flaws remained that turn a plain account into root. Only then did people review the results and report them.

Then there is Firefox. According to OpenAI, the model found 81 previously unknown flaws there that Mozilla rates as high severity. Mozilla's security advisory for Firefox 159 from October 27 lists 108 flaws rated "high". For 41 of them, OpenAI is named as the reporter; we counted. The jump from the previous generation is large: in July, GPT-5.6 Sol found 166 such Linux flaws with the same setup. The new model found more than five times as many, even though the code had been hardened further in the meantime.

What a flaw costs now

The whole run cost $1,213,430 in compute, or $1,279 per flaw with a working attack. Hacking contests such as Pwn2Own and TyphoonPWN have paid $20,000 and $70,000 for such a Linux attack. In Google's kernelCTF bounty program, which uses a specially hardened kernel, the chain wrote 21 such attacks in 112 hours for about $32,936, though with one protection removed that is normally active there. By then, the program had accepted 26 attacks on previously unknown flaws of this kind in all of 2026.

OpenAI writes the most important point itself: once a flaw has been disclosed, even less capable models could develop exploits for it. So the model stays locked away, but the findings become public with every fix.

Our test: where the fixes stand

A flaw that has been found protects nobody until the fix runs on your server. The path there has four stops: the Linux main branch, the long-term versions, the distribution, and your update with a reboot. On November 6, we searched the public Linux history, with the main branch as of the evening of November 5. Since October 1, 41 changes mention OpenAI. In 14 of them, other developers listed Codex as a tool they used. 27 come from OpenAI's security research. We compared these 27 with the long-term releases from October 30 and with the queue for the next release.

• The fixes trickle in. The five that made it into the long-term versions took 10 to 17 days from the main branch to a release. 19 of the 27 fixes were only written on or after October 24.
• The bugs are old. 26 of the 27 fixes name the change that introduced the bug. The oldest dates from March 2008. That is why they also affect versions that have been running for years.
• The distribution matters too. Debian 13 already ships version 6.12.115 with the five fixes through its security channel. Debian 12 is at 6.1.190 there, so it has none of the four that only came with 6.1.191.
• 27 is not 948. Many flaws are not public yet, and developers fixed others without crediting OpenAI. Our count only sees the visible part.

The catch

• Self-reported. All figures about the run come from OpenAI; there is no independent audit. By November 6, we found no public statement from the kernel developers. And OpenAI sells access to exactly this model.
• Local means someone is already in. All 948 flaws turn a plain account into root. An attacker first needs a foot in the door, for example through a vulnerable web application, a stolen password or a container.
• The agents make mistakes too. In an early run they reported 200 successful attacks. 20 of them reached root through a different unknown flaw than the one assigned. The first proposed fixes were sometimes too large or missed variants of the same flaw.
• Access is limited, for now. Only selected customers in OpenAI's Daybreak Red program get GPT-6 Cyber, usually only from approved networks. In a test without its deployment instructions, it went beyond its assignment in 0.07 percent of cases; according to The Register, OpenAI did not explain those cases.

What this means for mid-sized companies

Linux sits in many places nobody counts as a server: the web shop and website, network storage, firewall, VPN gateway, cameras, controllers and the cloud. On devices, the vendor supplies the kernel and decides when an update comes. A test by the security firm Dragos, quoted in OpenAI's launch, shows how far the models reach into industrial plants: in a mock power plant, a model given almost no instructions found two unknown flaws in the engineering software that manages protective relay data.

Finding flaws has become cheap. The bottleneck is now closing them: with the kernel developers, with the distributions and with every company that has to install updates.

What you should do now

1. Write down your Linux inventory. Every system running Linux, including devices such as storage, firewalls or controllers. Add the kernel version and who supplies the updates.
2. Put kernel updates on a fixed schedule, with a reboot. A new kernel only takes effect after a reboot or through live patching. Plan maintenance windows weekly or every two weeks instead of once a quarter.
3. Treat every account like root. Remove unused accounts and shared logins. Run services separately, in their own virtual machines or in containers with extra isolation such as gVisor or Firecracker, which OpenAI also recommends.
4. Ask your device vendors. When does the update for storage, firewall and controllers arrive, and how long will updates keep coming? Get it in writing. Devices without updates belong on the replacement list.
5. Let browsers update automatically. Firefox 159 alone closed 108 flaws rated "high".
6. Re-check your own software with every model generation. OpenAI's own lesson from the run: a new model with the same setup finds what the old one missed. If you build software, plan a new review for each generation.

Finding flaws now costs a fraction of what it used to. Closing them is still work, and part of it is yours. If you want to know where AI takes load off your IT security and where it creates new work, we are happy to talk.