OpenAI has introduced GPT-6 Cyber, an AI model the company says discovered 81 never-before-reported high-severity vulnerabilities in Firefox and produced working exploits for 948 distinct Linux kernel flaws — a volume of output that reframes a familiar question for security teams: when the bottleneck in bug hunting shifts from discovery to triage, who absorbs the load?
Both figures are OpenAI's own claims as relayed in a BleepingComputer report, which described the model as targeting widely deployed open-source components. Neither count has been confirmed by the affected vendors, and no CVE assignments or security patches have been announced in connection with the disclosures. If the numbers hold up under vendor review, they would represent a significant step up in the scale of automated vulnerability discovery.
What OpenAI actually claims
The claim has two parts, and the distinction matters. First, the 81 Firefox findings are characterised as never-before-reported, high-severity vulnerabilities — the kind of reports that would normally flow through Mozilla's bug bounty and security review process. Second, the 948 Linux kernel entries are described not merely as identified flaws but as bugs for which the model developed working exploits.
That second claim is the more consequential one. Generating a plausible bug report and generating a functional exploit are different tasks, and the latter is what pushes the finding from the security-improvement column into the dual-use column.
The verification caveat
At the time of publication, neither figure had been independently confirmed. The source gives no indication that Mozilla has received or triaged the Firefox reports, and Linux kernel maintainers have not confirmed that the exploit material reached them. The distinction between independently confirmed vulnerabilities and unvalidated model output matters here — the figures should be read strictly as OpenAI's own self-reported tally until vendors confirm receipt.
Why it matters
Firefox and the Linux kernel sit underneath a large share of global consumer and server infrastructure, so the story is less about one product's bug backlog than about where discovery capacity is moving. If a model can surface hundreds of high-severity issues in core infrastructure on demand, the constraint on open-source security stops being "can anyone find these bugs" and becomes "can anyone review them in time." Volunteer-led projects with small maintainer pools are least equipped to absorb that kind of intake surge.
The dual-use dimension cuts the other way: exploit generation at this scale compresses the window between disclosure and weaponisation for everyone. Expect the resulting debate to focus on safeguards, disclosure timelines and access controls rather than on whether the raw numbers are impressive.
For security teams in Hong Kong and elsewhere that are already weighing AI-assisted testing against manual research workflows, the practical question is less about model benchmarks than about integration — how findings are validated, deduplicated and prioritised before they reach an engineer.
What remains undisclosed
OpenAI has not explained how GPT-6 Cyber will be distributed, whether findings are released as reproducible reports, or what validation the counts passed through. It has also not detailed the disclosure process used for the Firefox and kernel bugs — whether vendors were notified before the model's unveiling, and on what schedule. Answers to those questions will determine whether this is a technical milestone or a product announcement.
This is a developing story. BleepingComputer published the report on 6 November; as of publication there is no vendor confirmation of the claimed findings, and we will update this article if responses from OpenAI, Mozilla or kernel maintainers arrive.
OpenAI 推出了 GPT-6 Cyber，這是一款該公司聲稱發現了 Firefox 中 81 項從未有人報告的高嚴重性漏洞、並為 948 項不同的 Linux kernel 缺陷製作出可用 exploit 的 AI 模型。這項產出數量，重新定義了一個安全團隊熟悉的問題：當漏洞搜尋的瓶頸由發現轉移到分類（triage）時，由誰來消化這股工作量？
上述兩項數字均為 OpenAI 自行聲稱，經 BleepingComputer 報導轉述，該報導形容模型的目標是廣泛部署的開源組件。兩個數目均未獲相關廠商證實，亦沒有任何 CVE 指派或安全修補程式與這些披露同時公布。若數字經廠商審核後成立，將代表自動化漏洞發現的規模出現重大躍升。
OpenAI 究竟聲稱了什麼
該項聲稱分為兩部分，兩者的區別十分重要。第一，81 項 Firefox 發現被描述為從未有人報告、高嚴重性的漏洞——這類報告通常會經 Mozilla 的 bug bounty 及安全審核流程處理。第二，948 項 Linux kernel 條目不單被描述為已識別的缺陷，更聲稱模型已為這些 bug 開發出可用的 exploit。
第二項聲稱的影響更為深遠。生成一份合理的 bug 報告與生成一個實際可運作的 exploit 是截然不同的任務，而後者正是將發現從「改善安全」類別推向「雙重用途」類別的關鍵。
驗證上的保留
截至發稿時，兩個數字均未獲獨立確認。消息來源沒有表示 Mozilla 已收到或處理這些 Firefox 報告，Linux kernel 維護者亦未確認 exploit 材料已送達他們手中。在這裡，已獨立確認的漏洞與未經驗證的模型輸出之間的區別十分重要——在廠商確認收妥之前，這些數字只應嚴格視為 OpenAI 自行報告的統計。
為何重要
Firefox 與 Linux kernel 承載著全球相當大比例的消費者及伺服器基礎設施，因此這則新聞的重點不在於單一產品的 bug 積壓，而在於發現能力正在轉移。如果一個模型可以按需浮現數百項核心基礎設施中的高嚴重性問題，開源安全的限制便不再是「有沒有人能找到這些 bug」，而是「有沒有人能及時審查它們」。維護者人數稀少、以志願者主導的開源專案，最難以消化這類湧入的工作量。
雙重用途的維度則指向另一面：這個規模的 exploit 生成，為所有人壓縮了漏洞披露與武器化之間的時間窗口。預期隨之而來的爭論將集中在保障措施、披露時間表及存取控制上，而非原始數字是否驚人。
對於香港及其他地區正在將 AI 輔助測試與人手研究流程作比較評估的安全團隊而言，實際問題與模型基準關係不大，反而在於整合方式——發現在到達工程師手上之前，如何經過驗證、去除重複（deduplication）及排定優先次序。
尚未披露的事項
OpenAI 未有說明 GPT-6 Cyber 將如何分發、發現是否會以可重現的報告形式發布，以及這些數字經過了何種驗證。該公司亦未詳述 Firefox 及 kernel bug 所採用的披露流程——廠商是否在模型亮相前已獲通知，以及按何種時間表進行。這些問題的答案，將決定此事究竟是一個技術里程碑，還是僅為一項產品發布。
本報導仍在持續發展。BleepingComputer 於 11 月 6 日刊出該報導；截至發稿，尚未有廠商確認所聲稱的發現，若收到 OpenAI、Mozilla 或 kernel 維護者的回覆，我們將更新本文。