Skip to navigation

Threat reportThreat IntelligenceTL-2026-5418

OpenAI rates GPT-6 Cyber 'Critical' cyber risk after large-scale vulnerability discovery and exploit development

criticalACTIVE

OpenAI introduced GPT-6 Cyber and raised its cybersecurity risk rating from High to Critical. Per the report, the model reproduced 1,724 Linux kernel vulnerabilities and developed working exploits for 948 of them, produced evidence for 81 new high-severity Firefox vulnerabilities, and validated exploits for a critical Brotli flaw with potential RCE in downstream applications.

Key facts for GPT-6 Cyber risk rating

IdentifiersTL-2026-5418
Also known asGPT-6 Cyber Critical cyber risk rating, OpenAI Daybreak
SeverityCRITICAL
First disclosed
Exploitation statusNo exploitation observed (theoretical)
Affected productsLinux Linux kernel; Mozilla Firefox; Brotli Brotli compression library
ToolsExploitGym, GPT-5.6 Cyber, GPT-6 Astra, GPT-6 Cyber, GPT-6.1 Sol
MITRE ATT&CK techniquesT1068 Exploitation for Privilege Escalation, T1190 Exploit Public-Facing Application, T1203 Exploitation for Client Execution, T1587.004 Develop Capabilities: Exploits, T1588.006 Obtain Capabilities: Vulnerabilities, T1588.007 Obtain Capabilities: Artificial Intelligence, T1595.002 Active Scanning: Vulnerability Scanning
MotivationUNKNOWN
Target sectorstechnology, software, critical infrastructure, government administration
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for GPT-6 Cyber risk rating

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5418 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Jenkins, GitLab or PostgreSQL Service Spawning Shell or Downloader — AI-Accelerated Exploitation (TL-2026-5418)

Detects a Jenkins, GitLab (workhorse/puma/sidekiq/gitaly) or PostgreSQL server process spawning a shell, scripting runtime or download/netcat tool. TL-2026-5418 tracks AI-assisted exploit development (GPT-6 Cyber completed 95% of known-flaw exploitation tasks against GitLab, PostgreSQL and Jenkins), so exploitation of these internet-facing DevOps and database platforms will be faster and more frequent. Post-exploit command execution from the service process is the stable, behaviour-first signal regardless of the specific CVE; a curl/wget child additionally indicates ingress tool transfer. No CVE or network IOC is published for this threat.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059.004, T1105
  • Data sources: splunk_cim_endpoint_processes, sysmon_for_linux, auditd, defender_for_endpoint
  • Severity: high
  • Confidence: medium

Splunk SPL

| tstats summariesonly=false count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((Processes.parent_process_name="java" AND Processes.parent_process="*jenkins*") OR Processes.parent_process_name IN ("postgres","gitlab-workhorse","puma","sidekiq","gitaly","ruby")) Processes.process_name IN ("sh","bash","dash","curl","wget","nc","ncat","python","python3","perl") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process | rename Processes.* as * | convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName =~ "java" and InitiatingProcessCommandLine has "jenkins") or InitiatingProcessFileName in~ ("postgres", "gitlab-workhorse", "puma", "sidekiq", "gitaly", "ruby")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: Jenkins, GitLab or PostgreSQL Service Spawning Shell or Downloader
id: 3b9e6a14-7c52-4f0d-8a1e-d25c94f7b601
status: experimental
description: Detects Jenkins, GitLab or PostgreSQL service processes spawning a shell, scripting runtime or download/netcat tool, a common post-exploitation pattern on internet-facing DevOps and database platforms. Relevant to TL-2026-5418 AI-accelerated exploit development.
references:
    - https://securityaffairs.com/202546/ai/openai-rates-gpt-6-cyber-critical-after-major-vulnerability-discoveries.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: linux
detection:
    selection_java:
        ParentImage|endswith: '/java'
        ParentCommandLine|contains: 'jenkins'
    selection_other:
        ParentImage|endswith:
            - '/postgres'
            - '/gitlab-workhorse'
            - '/puma'
            - '/sidekiq'
            - '/gitaly'
            - '/ruby'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/python'
            - '/python3'
            - '/perl'
    condition: (selection_java or selection_other) and selection_child
falsepositives:
    - Jenkins build steps and pipelines that legitimately run shell commands
    - GitLab Runner or Gitaly invoking git helper scripts through sh
level: high

Known false positives:

  • Jenkins build jobs and pipeline steps that legitimately run sh/bash commands as the Jenkins service account
  • GitLab Gitaly/Sidekiq invoking git hooks or helper scripts through a shell
  • PostgreSQL archive_command or COPY ... PROGRAM used by DBAs for backups

Tuning notes: Restrict to hosts tagged as internet-facing Jenkins/GitLab/PostgreSQL servers. Allowlist known build-agent hosts and the exact command lines of approved pipeline steps and archive_command scripts. Prioritise hits where the child is curl/wget/nc or where the user is the database/service account. Requires the Endpoint data model to be populated (CIM-mapped Sysmon for Linux, auditd or EDR process data).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Firefox Process Spawning Shell or Script Interpreter — Browser Exploit Chain · unlock with TL Creds
  • Linux Kernel Oops, KASAN or Protection-Fault Messages — Kernel Exploit Attempt · unlock with TL Creds
  • Exploitation-Scanner User-Agents Against Internet-Facing Web Services · unlock with TL Creds
  • Jenkins Script Console and CLI Remoting Endpoint Access · unlock with TL Creds
  • Setuid or Setgid Bit Set via chmod — Post-Exploitation Privilege Persistence · unlock with TL Creds
  • AI Exploit-Development Tooling Command Lines (ExploitGym, GPT-6 Cyber, GPT-6 Astra, pwntools) · unlock with TL Creds
  • Linux Kernel LPE Indicator — Root Execution From Writable Directory by Non-Root Session · unlock with TL Creds
  • Repeated DNS Resolution of OpenAI API Endpoints From a Single Host (AI-Assisted Tooling Hunt) · unlock with TL Creds

Indicators of compromise for GPT-6 Cyber risk rating

As of 2026-11-06, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5418.

22 indicators of compromise · unlock with TL Creds. Compare plans

How GPT-6 Cyber risk rating works

Security Affairs (2026-11-06) reports that OpenAI released GPT-6 Cyber, a security-research model, and elevated its cybersecurity risk rating from High to Critical. This entry tracks an AI-accelerated vulnerability discovery and exploit development capability. It is not a single CVE, and no CVEs, IOCs, CVSS score or threat-actor attribution are published in the source. Severity CRITICAL reflects OpenAI's own risk rating.

Reported capabilities: on ExploitGym the model scored 48.5% on vulnerability exploitation against 32.1% for GPT-5.6 Cyber, a roughly 51% relative improvement. In web penetration testing it identified 40.3% of vulnerabilities, against 32% for GPT-6 Astra. It completed 95% of exploitation tasks on known flaws in GitLab, PostgreSQL and Jenkins, tasks the Astra model refused. Against the Linux kernel it reproduced 1,724 vulnerabilities and developed working exploits for 948 of them, against 166 for GPT-5.6 Sol. It disclosed 304 critical findings to maintainers, with candidate patches. For Firefox it produced evidence for 81 new high-severity vulnerabilities and found 30 known issues to be more severe than originally reported. It identified a critical flaw in the Brotli compression library and validated exploits with potential remote code execution in downstream applications.

Safety measurements: the model avoided out-of-scope exploitation 99.93% of the time without a deployment prompt and 100% with one, against 94.49% for GPT-5.6 Cyber. Access is gated through OpenAI's Daybreak programs (Daybreak Red for exploit development and authorized testing, Daybreak Blue for vulnerability validation, Daybreak for Frontline Defenders with a $1 billion grant program, and Daybreak Red for Critical Infrastructure).

Related context from earlier OpenAI disclosures: on 2026-09-17 GPT-6 Astra became the first model rated Critical under the Preparedness Framework for cyber capability. In expert-led testing it built a browser exploit chain with unsandboxed code execution in 29 hours (12 more hours to adapt it to the stable release) and a kernel local privilege-escalation exploit in 12 hours. OpenAI withheld product names and exploit mechanics. GPT-6.1 Sol received the same Critical rating in an addendum dated 2026-09-29. OpenAI defines Critical as a model able to identify functional zero-day exploits of all severity levels in many hardened real-world critical systems, or to devise end-to-end novel cyberattack strategies.

Defender implications: the time between vulnerability discovery and working exploit is shrinking, and downstream consumers of widely embedded libraries such as Brotli should expect rapid exploit availability. Patch prioritisation for the Linux kernel, Firefox and internet-facing DevOps platforms (GitLab, Jenkins, PostgreSQL) should account for AI-assisted exploit development. Brotli patch status is not stated in the source, and no technical details on the flaw are published.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities; T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation for GPT-6 Cyber risk rating

Patches

  • Apply upstream Linux kernel and Firefox updates that address the vulnerabilities disclosed by OpenAI
  • Apply the Brotli fix once published by maintainers (patch status not stated in the source)

Immediate actions

  • Prioritise patching of Linux kernel, Firefox and Brotli-dependent applications as maintainers release fixes for the disclosed findings
  • Inventory applications and services that embed the Brotli library so fixes can be applied quickly once available
  • Reassess severity of previously known Firefox issues, since 30 were found to be more severe than reported

Workarounds

  • No source-stated workarounds; reduce exposure of unpatched internet-facing services until fixes are applied

Longer-term hardening

  • Shorten patch-to-deploy cycles for internet-facing DevOps and database platforms such as GitLab, Jenkins and PostgreSQL
  • Adopt AI-assisted vulnerability discovery and validation defensively, for example via OpenAI Daybreak Blue or Daybreak Red where eligible
  • Treat exploit development as increasingly automated when assigning patch SLAs

Affected and fixed versions

  • Linux — Linux kernel
    Vulnerable versions: Not specified in source
    Fixed in: Candidate patches provided to maintainers; versions not specified
  • Mozilla — Firefox
    Vulnerable versions: Not specified in source
  • Brotli — Brotli compression library
    Vulnerable versions: Not specified in source

Timeline of GPT-6 Cyber risk rating

Last updated · revalidated 1× · latest source

  • locked-ioc-19 launches locked-ioc-4, available only via locked-ioc-8 and rated High under the Preparedness Framework.
  • Coverage of Daybreak expansion into locked-ioc-5 (defensive) and locked-ioc-8 (vulnerability research and exploit validation) with identity verification, monitoring and legal attestations.
  • Hardware security keys become mandatory for Daybreak accounts.
  • locked-ioc-19 classifies locked-ioc-10 as the first model rated Critical for cyber capability under its Preparedness Framework, after testing that produced a browser exploit chain and a kernel local privilege-escalation exploit; two zero-days disclosed to maintainers with details withheld.
  • Fortune, relayed by Reuters, reports an upcoming locked-ioc-9 model; locked-ioc-19 had not yet confirmed it (per Tech Insider).
  • locked-ioc-19 publishes an addendum giving locked-ioc-11 the same Critical cyber rating as locked-ioc-10, with the same safeguards stack.
  • SecurityWeek reports locked-ioc-18 has begun rolling out patches for the 81 new high-severity Firefox flaws documented by locked-ioc-9.
  • Access is gated through locked-ioc-8, locked-ioc-5, Daybreak for Frontline Defenders ($1 billion grant program) and locked-ioc-8 for Critical Infrastructure.
  • Reported results: evidence for 81 new high-severity Firefox vulnerabilities, 30 known Firefox issues found more severe than reported, and a critical locked-ioc-20 flaw with validated exploits and potential RCE in downstream applications.
  • Reported results: locked-ioc-9 reproduced 1,724 locked-ioc-7 vulnerabilities and developed working exploits for 948, and 304 critical findings were disclosed to maintainers with candidate patches.
  • Security Affairs reports that locked-ioc-19 introduced locked-ioc-9 and raised its cybersecurity risk rating from High to Critical.

Update history

Sources cited for GPT-6 Cyber risk rating

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats