OpenAI’s GPT-6 Cyber found 81 Firefox flaws earlier AI testing missed
Researchers have disclosed a vulnerability affecting OpenAI-style agents, reported by Firefox.
Researchers have disclosed a vulnerability affecting OpenAI-style agents, reported by Firefox.
OpenAI has introduced GPT-6 Cyber, a version of GPT-6 Astra trained to find software vulnerabilities, test how attackers could exploit them, and help develop fixes.
The model is designed for authorized security testing of websites and applications.
The company said it used the findings to patch software, tighten network restrictions, and report issues to maintainers and vendors.
Mozilla has released fixes for many of the Firefox flaws, with the model contributing proposed patches.
Even after further hardening with multiple generations of frontier models, GPT 6 Cyber uncovered previously unknown high-severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users, said Brian Grinstead , Distinguished Engineer at Firefox.
Any organization running OpenAI-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
OpenAI used GPT-6 Cyber to help secure its systems, including the infrastructure used to train its AI models.
Researchers used GPT-6 Cyber alongside other OpenAI models to develop and validate exploits demonstrating how a critical Brotli vulnerability could allow remote code execution in affected applications.
Prompt injection works precisely because the agent can't reliably tell its owner's instructions apart from text it's merely processing -- that's a structural gap, not a one-off bug.
The company said it added or strengthened safeguards to address the risks posed by the model’s cybersecurity capabilities.
These include monitoring for actions outside the user’s authorization, targeted monitoring for emerging threats, Private Safety Processing, protections against stolen credentials, and checks to block high-risk cyber assistance.
Firefox's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
In controlled security tests, agents using GPT-6 Cyber and other OpenAI models combined vulnerabilities to escape isolated virtual environments and run code on the host computers.
OpenAI researchers also used the model to identify 81 previously unknown Firefox vulnerabilities classified by Mozilla as high severity and develop working exploits for 948 Linux kernel vulnerabilities.
Sandboxing, action review, and human oversight for high-risk workflows were also recommends.
In the separate ExploitGym Honeypot evaluation, GPT-6 Cyber avoided exploiting an out-of-scope service in 99.93% of tests without deployment safety instructions and 100% with them.
It has increased investment in threat investigations to detect model use involving operational technology and industrial control systems.
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.
What happened
Researchers have disclosed a vulnerability affecting OpenAI-style agents, reported by Firefox.
OpenAI has introduced GPT-6 Cyber, a version of GPT-6 Astra trained to find software vulnerabilities, test how attackers could exploit them, and help develop fixes.
The model is designed for authorized security testing of websites and applications.
What changed
The company said it used the findings to patch software, tighten network restrictions, and report issues to maintainers and vendors.
Mozilla has released fixes for many of the Firefox flaws, with the model contributing proposed patches.
Even after further hardening with multiple generations of frontier models, GPT 6 Cyber uncovered previously unknown high-severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users, said Brian Grinstead , Distinguished Engineer at Firefox.
Who is affected
Any organization running OpenAI-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
OpenAI used GPT-6 Cyber to help secure its systems, including the infrastructure used to train its AI models.
Researchers used GPT-6 Cyber alongside other OpenAI models to develop and validate exploits demonstrating how a critical Brotli vulnerability could allow remote code execution in affected applications.
Why it matters
Prompt injection works precisely because the agent can't reliably tell its owner's instructions apart from text it's merely processing -- that's a structural gap, not a one-off bug.
The company said it added or strengthened safeguards to address the risks posed by the model’s cybersecurity capabilities.
These include monitoring for actions outside the user’s authorization, targeted monitoring for emerging threats, Private Safety Processing, protections against stolen credentials, and checks to block high-risk cyber assistance.
Technical details
Firefox's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
In controlled security tests, agents using GPT-6 Cyber and other OpenAI models combined vulnerabilities to escape isolated virtual environments and run code on the host computers.
OpenAI researchers also used the model to identify 81 previously unknown Firefox vulnerabilities classified by Mozilla as high severity and develop working exploits for 948 Linux kernel vulnerabilities.
Response
Sandboxing, action review, and human oversight for high-risk workflows were also recommends.
In the separate ExploitGym Honeypot evaluation, GPT-6 Cyber avoided exploiting an out-of-scope service in 99.93% of tests without deployment safety instructions and 100% with them.
It has increased investment in threat investigations to detect model use involving operational technology and industrial control systems.
What security teams should do
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.
What remains unknown
OpenAI researchers also used the model to identify 81 previously unknown Firefox vulnerabilities classified by Mozilla as high severity and develop working exploits for 948 Linux kernel vulnerabilities.
Even after further hardening with multiple generations of frontier models, GPT 6 Cyber uncovered previously unknown high-severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users,” said Brian Grinstead , Distinguished Engineer at Firefox.
Attribution
Help Net Security: OpenAI has introduced GPT-6 Cyber, a version of GPT-6 Astra trained to find software vulnerabilities, test how attackers could exploit them, and help develop fixes.
What to watch next
Watch for updated vendor guidance and fixed-version details.