OpenAI Built an AI That Can Hack Linux 948 Ways — and Locked It Away on Day One

Every AI company has the same problem now, and OpenAI just showed it in the clearest form yet. The better an AI gets at finding security holes, the more dangerous it becomes to let anyone use it. So OpenAI built a model that is very good at finding security holes — and then locked it away on the day it announced it.

The model, and the decision not to ship it

The model is called GPT-6 Cyber, announced on 5 November. On ExploitGym, a benchmark that tests whether an AI can actually exploit software vulnerabilities rather than just describe them, OpenAI says it scores 48.5%. The previous model, GPT-5.6 Cyber, scored 32.1%, OpenAI says. Another OpenAI model, GPT-6 Astra, scored 42.4%. The jump matters because ExploitGym is not a quiz. It is a test of whether the model can do the thing — find the hole, write the exploit, make it work.

The numbers OpenAI reports

OpenAI says the model found 81 previously unknown high-severity flaws in Firefox, and Mozilla has shipped fixes for many of them, according to OpenAI — catalogued in Mozilla advisory MFSA 2026-118. It reproduced 1,724 Linux kernel vulnerabilities and built 948 working local-privilege-escalation exploits, the kind that let an attacker who already has a foothold on a machine take full control of it. It also flagged a critical flaw in Brotli, the compression library used across the web, catalogued as CVE-2026-111497 with a severity score of 9.2 out of 10.

Why "Critical" changed everything

OpenAI has classified the model as "Critical" under its own Preparedness Framework, up from "High" for the previous generation. That classification is OpenAI’s internal judgement, not an independent verdict — but it is the reason for what happened next. GPT-6 Cyber is not available to the public: only through the API and Codex, OpenAI’s coding tool, and only to a small group of vetted customers in a programme called Daybreak Red. Everyone else can read about what it can do. Almost nobody can use it.

This is the paradox at the centre of defensive security. The same capability that makes GPT-6 Cyber useful is what makes it dangerous: a model that can find 81 unknown Firefox flaws can also find the flaws that have not been fixed yet. OpenAI’s answer is to keep the model in the hands of people it has vetted, and to let the fixes reach the public before the capability does. That is a reasonable answer — and an admission that the company believes this model is powerful enough that its release cannot be managed the normal way.

The safety number that sounds reassuring

There is a second number in the announcement that deserves attention, because it is about safety rather than capability. OpenAI says GPT-6 Cyber stays within its assigned scope 99.93% of the time without a safety prompt, against 94.49% for the previous model: when told to test a specific system, it almost never wanders off and starts probing something else. That matters because an automated hacking tool that wanders is not a tool — it is an incident waiting to happen. The improvement is real, and it is also the kind of number that sounds reassuring until you remember what 0.07% means at machine scale: out of every 10,000 actions, seven go somewhere they were not supposed to.

Read the numbers as claims, not verdicts

All of these numbers come from OpenAI itself. None of them has been independently verified. The benchmark scores are controlled-lab results, not real-world attack rates — a model that scores 48.5% on ExploitGym will not succeed 48.5% of the time against a real, defended system. The Firefox flaws are real in the sense that Mozilla fixed them, which is the strongest evidence in the announcement. The rest is a company’s account of its own model’s abilities, and it should be read that way. If even half of what OpenAI reports is accurate, the frontier of automated vulnerability discovery has moved a long way in a single generation.

A busy week for OpenAI — and a locked door

The context is a week in which OpenAI has been moving fast on several fronts at once. The same week brought the news that Cat Wu, the product leader behind Anthropic’s Claude Code, is joining OpenAI to lead product management for Core Products. OpenAI also announced plans to acquire Pierre Computer Company for Codex’s Git workflows, and released Images 2.6 with GIF animation and 50% faster generation. The company is hiring its rival’s people, buying its rival’s tools, and building models it will not release.

The question GPT-6 Cyber raises is not whether AI can hack. It can, and now there is a number for how well: 948 working exploits, built in a lab, from a model that most people will never touch. The question is who gets to decide which capabilities are too dangerous to release — and whether a decision made by one company, however carefully, is enough. For now, OpenAI has decided: the model stays locked away, the flaws it found are being fixed, and the rest of us get to read about what it can do without being allowed to find out for ourselves.