OpenAI's AI finds 948 flaws in Linux — and 81 in Firefox

OpenAI has announced a new AI model, GPT-6 Cyber, built to hunt for security flaws in software — and in its first major test, it found hundreds of flaws nobody knew about.

In a report published on Wednesday, November 4, 2026, OpenAI says its system examined the Linux kernel — the core of the Linux operating system that runs Android phones, web servers and supercomputers. The system flagged 2,308 possible flaws, confirmed 1,724 as real vulnerabilities, and built 948 working attacks that an ordinary user could use to gain full control of a computer.

The whole test cost US$1,213,430 in API usage — about US$1,279 per flaw. By comparison, in July the earlier model, GPT-5.6 Sol, found 166 flaws for US$513,690 using the same system.

Linux developers are already fixing the flaws. Ten days after the scan finished, 61 of the 948 flaws had already been patched, 43 had staging patches, and 299 were being discussed publicly.

The model also examined the Firefox browser and found 81 previously unknown flaws, which Mozilla classified as high severity and began fixing. It also found that 30 already-known flaws were worse than previously reported.

OpenAI's system works in five stages: finding parts of the code that may contain flaws, confirming a flaw is real, testing whether it can be exploited, generating a fix, and a final review by human researchers before reporting to developers.

In a sample of 166 exploits, the AI used 10 new attack techniques that, according to OpenAI, even security experts had not seen before.

Two things to keep in mind. First, these results are OpenAI's own — they have not been independently verified. Second, not all 948 flaws are fixed yet; fixes are being sent to developers gradually. And these flaws require someone to already have an ordinary account on the computer — they are not a way to break into any computer from afar.

For now, GPT-6 Cyber is available only to approved customers. OpenAI has also announced a US$1 billion grant programme for frontline cybersecurity defenders with limited resources.

What does this mean for you?

Linux is everywhere — your Android phone, many web services and programs you use every day depend on its kernel. The good news is that these flaws were found and reported to developers before criminals could use them. But the fixes only reach you through updates — so update your phone and computer regularly, and don't switch off automatic updates.

For developers and security professionals in East Africa, the work is changing: AI can do in a few hours the flaw-hunting work that used to take weeks. That is an opportunity to learn cybersecurity skills, which are in demand more every day.

But there is another side: this same ability to find flaws could be misused by criminals. That is why OpenAI has restricted access to this model to approved customers only — and why security updates should be installed as soon as they are available.