# OpenAI rates GPT-6 Cyber 'Critical' cyber risk after large-scale vulnerability discovery and exploit development

> OpenAI introduced GPT-6 Cyber and raised its cybersecurity risk rating from High to Critical. Per the report, the model reproduced 1,724 Linux kernel vulnerabilities and developed working exploits for 948 of them, produced evidence for 81 new high-severity Firefox vulnerabilities, and validated exploits for a critical Brotli flaw with potential RCE in downstream applications.

- **Published:** 2026-11-06T13:26:29Z
- **Last reviewed:** 2026-11-06T13:55:25.886Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5418
- **ID:** TL-2026-5418
- **Severity:** CRITICAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22

## Description

Security Affairs (2026-11-06) reports that OpenAI released GPT-6 Cyber, a security-research model, and elevated its cybersecurity risk rating from High to Critical. This entry tracks an AI-accelerated vulnerability discovery and exploit development capability. It is not a single CVE, and no CVEs, IOCs, CVSS score or threat-actor attribution are published in the source. Severity CRITICAL reflects OpenAI's own risk rating.

Reported capabilities: on ExploitGym the model scored 48.5% on vulnerability exploitation against 32.1% for GPT-5.6 Cyber, a roughly 51% relative improvement. In web penetration testing it identified 40.3% of vulnerabilities, against 32% for GPT-6 Astra. It completed 95% of exploitation tasks on known flaws in GitLab, PostgreSQL and Jenkins, tasks the Astra model refused. Against the Linux kernel it reproduced 1,724 vulnerabilities and developed working exploits for 948 of them, against 166 for GPT-5.6 Sol. It disclosed 304 critical findings to maintainers, with candidate patches. For Firefox it produced evidence for 81 new high-severity vulnerabilities and found 30 known issues to be more severe than originally reported. It identified a critical flaw in the Brotli compression library and validated exploits with potential remote code execution in downstream applications.

Safety measurements: the model avoided out-of-scope exploitation 99.93% of the time without a deployment prompt and 100% with one, against 94.49% for GPT-5.6 Cyber. Access is gated through OpenAI's Daybreak programs (Daybreak Red for exploit development and authorized testing, Daybreak Blue for vulnerability validation, Daybreak for Frontline Defenders with a $1 billion grant program, and Daybreak Red for Critical Infrastructure).

Related context from earlier OpenAI disclosures: on 2026-09-17 GPT-6 Astra became the first model rated Critical under the Preparedness Framework for cyber capability. In expert-led testing it built a browser exploit chain with unsandboxed code execution in 29 hours (12 more hours to adapt it to the stable release) and a kernel local privilege-escalation exploit in 12 hours. OpenAI withheld product names and exploit mechanics. GPT-6.1 Sol received the same Critical rating in an addendum dated 2026-09-29. OpenAI defines Critical as a model able to identify functional zero-day exploits of all severity levels in many hardened real-world critical systems, or to devise end-to-end novel cyberattack strategies.

Defender implications: the time between vulnerability discovery and working exploit is shrinking, and downstream consumers of widely embedded libraries such as Brotli should expect rapid exploit availability. Patch prioritisation for the Linux kernel, Firefox and internet-facing DevOps platforms (GitLab, Jenkins, PostgreSQL) should account for AI-assisted exploit development. Brotli patch status is not stated in the source, and no technical details on the flaw are published.

## MITRE ATT&CK

- T1587.004 Develop Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1595.002 Active Scanning: Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Jenkins, GitLab or PostgreSQL Service Spawning Shell or Downloader — AI-Accelerated Exploitation (TL-2026-5418)** (`TL-2026-5418-SPL-001`)

Detects a Jenkins, GitLab (workhorse/puma/sidekiq/gitaly) or PostgreSQL server process spawning a shell, scripting runtime or download/netcat tool. TL-2026-5418 tracks AI-assisted exploit development (GPT-6 Cyber completed 95% of known-flaw exploitation tasks against GitLab, PostgreSQL and Jenkins), so exploitation of these internet-facing DevOps and database platforms will be faster and more frequent. Post-exploit command execution from the service process is the stable, behaviour-first signal regardless of the specific CVE; a curl/wget child additionally indicates ingress tool transfer. No CVE or network IOC is published for this threat.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004, T1105
- **Data sources:** splunk_cim_endpoint_processes, sysmon_for_linux, auditd, defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
| tstats summariesonly=false count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((Processes.parent_process_name="java" AND Processes.parent_process="*jenkins*") OR Processes.parent_process_name IN ("postgres","gitlab-workhorse","puma","sidekiq","gitaly","ruby")) Processes.process_name IN ("sh","bash","dash","curl","wget","nc","ncat","python","python3","perl") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process | rename Processes.* as * | convert ctime(firstTime) ctime(lastTime)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName =~ "java" and InitiatingProcessCommandLine has "jenkins") or InitiatingProcessFileName in~ ("postgres", "gitlab-workhorse", "puma", "sidekiq", "gitaly", "ruby")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Jenkins, GitLab or PostgreSQL Service Spawning Shell or Downloader
id: 3b9e6a14-7c52-4f0d-8a1e-d25c94f7b601
status: experimental
description: Detects Jenkins, GitLab or PostgreSQL service processes spawning a shell, scripting runtime or download/netcat tool, a common post-exploitation pattern on internet-facing DevOps and database platforms. Relevant to TL-2026-5418 AI-accelerated exploit development.
references:
    - https://securityaffairs.com/202546/ai/openai-rates-gpt-6-cyber-critical-after-major-vulnerability-discoveries.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: linux
detection:
    selection_java:
        ParentImage|endswith: '/java'
        ParentCommandLine|contains: 'jenkins'
    selection_other:
        ParentImage|endswith:
            - '/postgres'
            - '/gitlab-workhorse'
            - '/puma'
            - '/sidekiq'
            - '/gitaly'
            - '/ruby'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/python'
            - '/python3'
            - '/perl'
    condition: (selection_java or selection_other) and selection_child
falsepositives:
    - Jenkins build steps and pipelines that legitimately run shell commands
    - GitLab Runner or Gitaly invoking git helper scripts through sh
level: high
```

**Known false positives:**

- Jenkins build jobs and pipeline steps that legitimately run sh/bash commands as the Jenkins service account
- GitLab Gitaly/Sidekiq invoking git hooks or helper scripts through a shell
- PostgreSQL archive_command or COPY ... PROGRAM used by DBAs for backups

**Tuning notes:** Restrict to hosts tagged as internet-facing Jenkins/GitLab/PostgreSQL servers. Allowlist known build-agent hosts and the exact command lines of approved pipeline steps and archive_command scripts. Prioritise hits where the child is curl/wget/nc or where the user is the database/service account. Requires the Endpoint data model to be populated (CIM-mapped Sysmon for Linux, auditd or EDR process data).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Firefox Process Spawning Shell or Script Interpreter — Browser Exploit Chain (locked: unlock with TL Creds)
- Linux Kernel Oops, KASAN or Protection-Fault Messages — Kernel Exploit Attempt (locked: unlock with TL Creds)
- Exploitation-Scanner User-Agents Against Internet-Facing Web Services (locked: unlock with TL Creds)
- Jenkins Script Console and CLI Remoting Endpoint Access (locked: unlock with TL Creds)
- Setuid or Setgid Bit Set via chmod — Post-Exploitation Privilege Persistence (locked: unlock with TL Creds)
- AI Exploit-Development Tooling Command Lines (ExploitGym, GPT-6 Cyber, GPT-6 Astra, pwntools) (locked: unlock with TL Creds)
- Linux Kernel LPE Indicator — Root Execution From Writable Directory by Non-Root Session (locked: unlock with TL Creds)
- Repeated DNS Resolution of OpenAI API Endpoints From a Single Host (AI-Assisted Tooling Hunt) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [OpenAI rates GPT-6 Cyber Critical after major vulnerability discoveries (Security Affairs)](https://securityaffairs.com/202546/ai/openai-rates-gpt-6-cyber-critical-after-major-vulnerability-discoveries.html)
- [GPT-6 Astra classified Critical for cybersecurity (InfoQ)](https://infoq.com/news/2026/09/gpt-6-astra-critical-cyber)
- [OpenAI gives GPT-6.1 Sol its top cyber risk rating, at a fifth of Astra's price (The Decoder / mixed-news)](https://mixed-news.com/en/openai-gpt-6-1-sol-critical-cyber-rating-fifth-astra-price/)
- [Expanding Daybreak as the cyber defense window narrows (OpenAI)](https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/)
- [OpenAI Daybreak: Trusted Access for Cyber overview (OpenAI Help Center)](https://help.openai.com/en/articles/20001258-openai-daybreak-trusted-access-for-cyber)
- [OpenAI extends 'Daybreak' security project and reveals new cyber model (TechRadar)](https://techradar.com/pro/security/openai-extends-daybreak-security-project-and-reveals-new-cyber-model-but-for-approved-users-only)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5418