Photo: Pexels
For decades, finding a serious software vulnerability was slow, skilled, expensive work. A security researcher spent weeks reading code, testing hunches and building a proof that a flaw could actually be exploited. The best researchers in the world might find a handful of important bugs in a year. That was the bottleneck that kept the internet, more or less, standing.
OpenAI has just put a price on removing that bottleneck: about $1,279. That is what it cost the company's new AI model, GPT-6 Cyber, to turn a suspected Linux kernel bug into a working root exploit — not once, but 948 times, in a single roughly 30-hour run. It also found 81 previously unknown high-severity vulnerabilities in Mozilla Firefox. The model was launched on 5 November 2026, and it is the clearest sign yet that the race to find security flaws is no longer a human race at all.
The announcement landed in the same week as an independent report saying Anthropic's AI research is now improving at roughly twice its old pace — with most of the evidence hidden from public view — and a US Justice Department task force aimed at unlawful uses of advanced AI. Taken together, the week tells a single story: the tools that find weaknesses in software are getting dramatically cheaper and faster, and nobody yet knows how fast the defences can keep up.
What OpenAI actually announced
GPT-6 Cyber is a specialised version of OpenAI's GPT-6 model, built for one job: cybersecurity research. It finds software vulnerabilities and develops working exploits to test whether a system's defences hold. OpenAI says it is "a major step up from GPT-5.6 Cyber" and that it "outperforms GPT-6 Astra on most cyber tasks, even when Astra does not refuse the request", according to Times Now's report on the launch.
The headline benchmark result is on ExploitGym, a test that measures a model's ability to exploit a known vulnerability. GPT-6 Cyber scored 48.5 per cent, against 32.1 per cent for GPT-5.6 Cyber. That is a large jump in a single generation, and it matters because ExploitGym measures the whole job — not just spotting a suspicious line of code, but building a working attack around it.
The model is not being released to the public. OpenAI has classified its cybersecurity capabilities as "Critical" — the highest risk rating in its system — and is making GPT-6 Cyber available only through its API and Codex to selected customers approved for its Daybreak Red programme. Access comes with strict controls: single sign-on, multi-factor authentication, managed devices, hardware security keys and IP allowlisting, at $20 and $100 per million input and output tokens respectively. The named early users include Mozilla, Palo Alto Networks, GitLab and Cisco.
OpenAI's stated goal is to put advanced cybersecurity research in the hands of trusted defenders while keeping it out of the hands of attackers. That is a reasonable goal. It is also, as this week showed, a goal that is already being tested from more than one direction at once.
The numbers that change the argument
The most important numbers in OpenAI's announcement are not the benchmark scores. They are the production figures from a single automated run in mid-October, described in OpenAI's own published account of the work.
The pipeline analysed 2,308 candidate Linux kernel findings. It dynamically reproduced 1,724 of them as real vulnerabilities. It produced 291 proofs of concept for information leaks and 1,169 working root exploits, which grouped into 948 distinct local privilege-escalation exploits — flaws that let an attacker with ordinary access take full control of a machine. OpenAI says it built a patch for each underlying flaw, disclosed 304 critical findings with proposed patches, and found at least 10 novel exploitation techniques in the process.
The whole run cost $1,213,430 in API credits. Divide that by 948 and you get roughly $1,279 per working root exploit. A human researcher would have taken years and cost many times more to produce the same output — and that is the point. The cost of finding a way into a system has collapsed to something a well-funded hobbyist group could afford, and the cost will keep falling as the models improve.
The Firefox results make the same point from a different angle. GPT-6 Cyber identified 81 previously unknown high-severity vulnerabilities in Mozilla Firefox, and OpenAI says it also found a critical remote code execution flaw in Brotli, a compression library used across the web. Mozilla was informed and has already started releasing fixes for several of the critical flaws. That is the system working as intended: the model found the bugs, the vendor was told, and patches went out. But it is worth pausing on the scale. Eighty-one high-severity flaws in one of the world's most scrutinised pieces of software, found by one model, in days.
None of this means the internet is about to collapse. It means the rate at which flaws are discovered has changed by an order of magnitude, and everything downstream — patching, testing, updating, the behaviour of the people who run the world's servers — now has to move at a speed it was never designed for.
Why this week is different from the PHP-flaws week
This is not the first time AI has found a serious flaw before humans did. On 21 October, two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 in severity — were disclosed after being uncovered with the help of AI. European governments took public websites offline, Japan's finance ministry suspended services, and banks, airlines and tax authorities shut systems down from Tokyo to Helsinki. It was the week the world learned that a flaw in a language that powers a huge share of the web could go from unknown to a global emergency in hours.
The PHP episode was a warning. This week is the industrialisation of that warning. The PHP flaws were two bugs in one language. GPT-6 Cyber produced 948 working exploits in one run against one operating system kernel, plus dozens of flaws in a browser. A week earlier, on 28 October, Google had announced its own cyber-focused model, Gemini 4 Carbon. Anthropic has its Claude Mythos Preview, and Microsoft has its MDASH system. Every major AI lab now has a model whose job is to find weaknesses in software, and they are all getting better at it at the same time.
That changes the shape of the problem. A single dramatic flaw creates a single emergency, and emergencies can be managed — badly, sometimes, but managed. A steady, cheap, high-volume flow of newly discovered flaws creates a different problem: a permanent backlog. Vendors have to triage, patch, test and ship fixes for far more vulnerabilities than they used to, while attackers only need one unpatched system. The PHP week showed what happens when the disclosure clock collapses. GPT-6 Cyber suggests the clock is about to collapse permanently, for everything at once.
The other side of the race already has the same weapon
The most uncomfortable detail of the week did not come from OpenAI at all. It came from the open-weight side of the AI world, where models are released for anyone to download and run.
Days before OpenAI's announcement, Epoch AI showed that the open-weight GLM-5.3 model had built working exploit chains against six consecutive Firefox releases, each in as little as 12 hours, according to AI researcher Zvi Mowshowitz's 5 November roundup. That is the same browser, the same class of flaw, and the same result — achieved by a model that is not locked behind a Daybreak Red programme, a hardware security key or an IP allowlist.
This is the detail that breaks OpenAI's framing. The company's argument is that restricting GPT-6 Cyber to vetted defenders keeps the capability out of the wrong hands. But the capability is not only in OpenAI's hands. An open model reached the same destination within days, on its own. Restricting one model does not restrict the capability; it restricts one supplier of it.
That does not make OpenAI's caution pointless — a closed model with the best performance is still a meaningful advantage for defenders, and the vetting programme is a real barrier for casual misuse. But it does mean the debate has moved. The question is no longer whether exploit-finding AI should exist. It exists, in several labs, in both closed and open forms. The question is what the world does now that it does.
Anthropic's AI is improving twice as fast — and the proof is hidden
The second major report of the week came from METR, an independent research organisation that spent 11 weeks, from 12 August to 29 October, inside Anthropic with access to confidential development data. Its conclusion, published on 5 November: Anthropic is now improving its AI models' capabilities at approximately twice the rate it managed between March 2024 and October 2025. The central estimate is 1.9 times on METR's capability measure since October 2025, with a 95 per cent interval of 1.5 to 2.8 times. METR said it would not be surprised by anything from 1.3 to 3 times.
The finding matters because of what it implies. If AI helps researchers build better models, those models can then help build their successors even faster — a loop researchers call recursive self-improvement. METR found that most of the acceleration so far still comes from AI assisting people rather than independently running whole research projects, and it found no clear bottleneck that would necessarily stop further acceleration over the next year.
But there is a catch, and it is a large one. Anthropic had the right to redact the assessment, and it removed most of the material METR considered most informative: the per-stage acceleration estimates, the breakdown of compute, data and algorithms, the bottleneck analyses, the forecasts for future models and the specific benchmark names. The public can read the conclusion — AI research is speeding up, possibly past a threshold Anthropic's own IPO filing described as merely "imminent" — but cannot examine the evidence behind it.
That is a strange position for the world to be in. The most important claim about the pace of AI progress this year comes with a warning attached: the researchers are telling us to trust a conclusion we cannot verify, about a capability that is itself accelerating. METR's report is honest about that tension, and it is the tension that will define the next year of AI policy. If the models keep improving at twice the old rate, the window between a capability existing and the world understanding it keeps shrinking. The GPT-6 Cyber launch is a case in point: a model that can find 948 root exploits did not exist in public discussion a month ago, and now it is a product with a price list.
The gatekeepers' answer: lock it down
Faced with models that can find flaws faster than humans can fix them, the AI labs have converged on the same answer: gate the capability, vet the users, and keep the most powerful versions away from the open internet.
OpenAI's Daybreak Red programme is the clearest example. Google gated its Gemini 4 Carbon behind a staged rollout to cyber defenders first, then trusted partners, with the US government given voluntary pre-release testing. Anthropic's Claude Mythos Preview is similarly restricted. The pattern is consistent: the labs that build these models also get to decide who is a legitimate defender, and the decision is made behind closed doors.
There are good reasons for that. A model that can find 948 Linux exploits in 30 hours would be a gift to any criminal group or hostile state that got hold of it, and the open-weight GLM-5.3 result shows that the gift is already partly out of the box. Gating the best closed models is a genuine, if partial, defence.
But gating creates its own problems. The first is concentration: a small number of companies now control the best tools for finding flaws in the software the whole world runs on, and they decide who gets access. The second is accountability: when Anthropic can redact most of an independent evaluation of its own progress, the public's ability to judge the risks depends on the company's goodwill. The third is the patching gap. The defenders who most need these tools — small companies, open-source projects, hospitals, schools, the local businesses that run the internet's long tail — are the least likely to be on an approved list for a restricted programme.
Meanwhile, governments are starting to respond in their own way. The US Justice Department launched a Super Intelligence Task Force this week to investigate unlawful uses of advanced AI, focused on threats from foreign governments and criminal organisations alongside AI-enabled fraud. And in a filing on 4 November, TeraWulf disclosed that Google will backstop Anthropic's $19 billion Kentucky lease obligations if Anthropic defaults or becomes insolvent — a reminder that the AI build-out now involves financial commitments so large that even a company the size of Google is underwriting them.
The politics of the build-out is shifting too. Google announced a $17 billion investment in a Wyoming data centre this week, partly powered by a planned 702-megawatt fuel-cell development. OpenAI, within 48 hours of its cyber announcement, published a National Community Compact and a Compute Campus Policy Blueprint promising to drop non-disclosure agreements with public officials and to pay the full electricity and infrastructure costs of the facilities it owns. The timing is not a coincidence: voters rejected data-centre projects in 40 of 41 ballot measures across the United States last week. The labs are learning that building the infrastructure for these models requires public consent, and that consent is no longer automatic.
What it means for everyone else
Strip away the announcements, and three things are now true that were not true a year ago. Each one changes the job of keeping software safe.
First, discovery is no longer the scarce resource. For most of computing history, finding a vulnerability was the hard part. That is over. A single model run can now produce more working exploits than a team of human researchers could in a year, at a cost of about $1,279 each. The scarce resource is now everything that comes after discovery: deciding which flaws matter, writing patches, testing them, shipping them, and getting millions of people and companies to install them. That pipeline was built for a world where a few dozen serious flaws surfaced each month, not hundreds in a weekend. The organisations that do this work — vendors, open-source maintainers, IT teams — are about to be asked to run much faster, with no extra staff, and the backlog will show up first in the software nobody owns and nobody maintains.
Second, the attacker-defender balance has tilted, and it has tilted towards whoever moves first. A defender has to fix everything; an attacker needs one unpatched system. When flaws were expensive to find, that asymmetry was manageable, because the supply of new flaws was limited. When flaws cost $1,279 to produce, the supply is effectively unlimited, and the asymmetry becomes the whole game. The only defence that scales is automation on the defender's side too: AI that finds the flaw, writes the patch, tests it and ships it, with a human checking the work. OpenAI says its pipeline already generates patches for the flaws it finds, and that is the direction the whole field has to go. But patching is harder than finding. A bad patch breaks systems; a missed patch leaves them open. The race now is not who can find flaws fastest, but who can fix them fastest without breaking things.
Third, the knowledge gap is becoming a power gap. METR's report shows that the most important facts about AI's progress are increasingly known only to the companies building the models and the evaluators they let inside. The public gets conclusions; the evidence stays redacted. That is understandable as a commercial decision and dangerous as a social one, because the decisions that follow — what to regulate, what to fund, what to warn the public about — depend on evidence the public cannot see. If AI capability is doubling its improvement rate, the institutions that are supposed to oversee it need access to the measurements, not just the summaries. The METR report is a warning about that, as much as it is a warning about acceleration itself.
None of this is an argument against building these models. A world in which AI finds flaws and patches them before attackers do is a safer world than the one we have now, where most flaws are found by attackers first and disclosed only after the damage is done. The Binance hack of 30 October — $6.3 billion stolen, the largest crypto theft on record — is a reminder of what the old world costs. But the transition from one world to the other is the dangerous part, and it is happening faster than the institutions built to manage it.
What to watch next
1. Mozilla's patch timeline. The 81 Firefox flaws GPT-6 Cyber found are the first public test of the new disclosure pipeline. How fast the fixes ship, and whether any are exploited in the wild first, will tell us how much slack the system has.
2. The next open-weight release. GLM-5.3 showed that open models can match closed ones on this task within days. The next open-weight release with cyber capability will test whether gating closed models matters at all.
3. Anthropic's IPO and its next filing. Anthropic's S-1 filing in October described the 2x acceleration threshold as imminent. METR now says it may already have been crossed. The company's next quarterly filing, and its November IPO, will show whether investors price that acceleration as an opportunity, a risk, or both.
4. The patching backlog. Watch for vendors and open-source projects announcing that they are changing how they triage vulnerabilities — longer lists, faster releases, more automation. The first project to say publicly that it cannot keep up will be a significant moment.
5. The Justice Department task force. The Super Intelligence Task Force's first cases will show whether the US government's response to AI misuse is enforcement against criminals, or pressure on the labs themselves. The distinction matters for everyone building with these tools.
Frequently asked questions
What is GPT-6 Cyber?
GPT-6 Cyber is a specialised version of OpenAI's GPT-6 model, launched on 5 November 2026, designed for cybersecurity research. It finds software vulnerabilities and builds working exploits to test defences. OpenAI has classified its cyber capabilities as "Critical" and restricted access to selected customers in its Daybreak Red programme.
How many vulnerabilities did GPT-6 Cyber actually find?
In one roughly 30-hour run in mid-October, OpenAI's pipeline analysed 2,308 candidate Linux kernel findings, reproduced 1,724 as real vulnerabilities, and produced 948 distinct working local privilege-escalation exploits. It also identified 81 previously unknown high-severity vulnerabilities in Mozilla Firefox, and a critical remote code execution flaw in the Brotli compression library.
What does it cost to find a vulnerability with AI now?
OpenAI says the Linux run cost $1,213,430 in API credits, which works out to about $1,279 per working root exploit. That is far cheaper than human-led vulnerability research, and the cost is expected to fall as the models improve.
Can anyone use GPT-6 Cyber?
No. Access is limited to vetted organisations in OpenAI's Daybreak Red programme, through the API and Codex, with strict controls including hardware security keys and IP allowlisting. However, open-weight models such as GLM-5.3 have shown they can build working Firefox exploits too, so the capability is not limited to OpenAI's model alone.
What did the METR report say about Anthropic?
METR, an independent research organisation, estimated on 5 November that Anthropic is improving its AI capabilities at about twice its previous pace — a central estimate of 1.9 times since October 2025. Anthropic redacted most of the most informative evidence from the roughly 100-page assessment, so the public cannot examine the measurements behind the conclusion.
Does this mean software is now unsafe?
Not exactly. The flaws GPT-6 Cyber found were disclosed to vendors with proposed patches, and Mozilla has already started releasing fixes. The risk is not that AI has made software worse; it is that flaws are now discovered far faster than they can be patched, and the organisations that maintain software — especially small and open-source projects — may struggle to keep up with the volume.
Sources
- Times Now — "OpenAI Launches GPT-6 Cyber To Take On Claude Mythos And Gemini, Finds Flaws Hackers Could Exploit" (6 November 2026): timesnownews.com
- The Neuron — "Everything That Happened in AI Today, Friday, November 6" (6 November 2026): theneuron.ai
- AI News Brief — "AI News Brief, 2026-11-06" (6 November 2026): ai-news-brief.com
- Medium — "The Week the Meters Arrived: 1.9x, $1,279, and Minus $2.3 Trillion" (6 November 2026): medium.com
- Mark McNeilly (Substack) — "The New News in AI: 11/6/26 Edition" (6 November 2026): markmcneilly.substack.com
- Social coverage: Instagram and Threads posts on the GPT-6 Cyber launch, including @devcode.ai's summary of OpenAI's Linux pipeline figures (6 November 2026). No X post was used as a source — none was found in the social search that could be verified.
For more on technology, markets and the forces shaping the online world, visit abdulrahimmughal.com.