Skip to navigation

Threat reportThreat IntelligenceTL-2026-5445

OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws

mediumMONITORING

OpenAI unveiled GPT-6 Cyber, a model for vulnerability discovery and exploit development rated 'Critical' under its Preparedness Framework. Per BleepingComputer it found 81 previously unknown high-severity Firefox vulnerabilities and produced local privilege escalation exploits for 948 distinct Linux kernel flaws.

Key facts for GPT-6 Cyber vulnerability model

IdentifiersTL-2026-5445
Also known asGPT-6 Cyber, Daybreak Red GPT-6 Cyber
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsMozilla Firefox; Linux kernel community Linux kernel
ToolsExploitGym, GPT-5.6 Sol, GPT-5.6-Cyber, GPT-6 Astra, GPT-6 Cyber, OpenAI Codex Security
MITRE ATT&CK techniquesT1203 Exploitation for Client Execution, T1587.004 Exploits, T1588.006 Vulnerabilities, T1588.007 Artificial Intelligence
MotivationUNKNOWN
Target sectorstechnology, government administration, critical-infrastructure
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for GPT-6 Cyber vulnerability model

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5445 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unprivileged-to-Root Shell via Kernel LPE (auditd euid 0 / uid non-zero)

TL-2026-5445: GPT-6 Cyber reportedly produced unprivileged-to-root Linux kernel LPE exploits for 948 flaws. Detects a shell whose effective uid is 0 while its real uid is a logged-in non-root user, the credential-transition result of kernel exploitation and setuid abuse (T1068, T1548.001).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1068, T1548.001
  • Data sources: linux_auditd, index=linux sourcetype=linux:audit, DeviceProcessEvents
  • Severity: critical
  • Confidence: high

Splunk SPL

index=linux sourcetype="linux:audit" type=SYSCALL success=yes euid=0 uid!=0 auid!=0 auid!=4294967295 (exe="/bin/sh" OR exe="/bin/bash" OR exe="/bin/dash" OR exe="/usr/bin/sh" OR exe="/usr/bin/bash" OR exe="/usr/bin/dash" OR exe="/usr/bin/zsh")
| stats count min(_time) as first_seen values(comm) as comm values(ppid) as ppid by host auid uid euid exe
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen host auid uid euid exe comm ppid count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName == "root" and InitiatingProcessAccountName != "root"
| where FileName in~ ("sh", "bash", "dash", "zsh")
| where InitiatingProcessFileName !in~ ("sudo", "su", "login", "sshd", "pkexec", "cron", "crond", "systemd", "gdm-session-worker", "lightdm")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId

Sigma

title: Linux Shell Running With Effective UID 0 and Non-Root Real UID
id: 7d2e9a54-5b13-4c8f-a6e0-92f1b3c8d702
status: experimental
description: Detects a shell executing with euid 0 while the real uid is non-root, the unprivileged-to-root result of a Linux kernel local privilege escalation exploit (TL-2026-5445, T1068).
references:
  - https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/
  - https://www.bleepingcomputer.com/news/security/openais-new-gpt-6-cyber-ai-finds-81-firefox-flaws-948-linux-bugs/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.privilege-escalation
  - attack.t1068
  - attack.t1548.001
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    success: 'yes'
    euid: '0'
    exe|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
  filter_root:
    uid: '0'
  condition: selection and not filter_root
falsepositives:
  - Administrators deliberately running setuid-root shells for recovery tasks
  - Container runtimes with user namespace remapping
level: high

Known false positives:

  • Administrators intentionally running setuid-root shells (bash -p) during recovery
  • Container or user-namespace tooling that maps uid 0 inside a namespace

Tuning notes: Requires auditd execve/setuid syscall rules (-a always,exit -F arch=b64 -S execve). Exclude known service accounts via auid and namespace-mapped container hosts. Raise severity when the same auid ran a binary from /tmp or /dev/shm beforehand (see SPL-003).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Vulnerable [indicator] Build Below 159 ([indicator] Exposure) · unlock with TL Creds
  • Root Process Spawned by Non-Root Non-Broker Parent (Linux LPE) · unlock with TL Creds
  • Non-Browser OpenAI API Access and Exploit-AI Tool Strings (Policy Hunt) · unlock with TL Creds
  • [indicator] Spawning Shell or Download Utility (Linux) · unlock with TL Creds
  • Setuid Bit Set on File in Writable Directory (Post-LPE Persistence) · unlock with TL Creds
  • Command Line Referencing AI Exploit-Development Tooling (Policy Hunt) · unlock with TL Creds
  • [indicator] Spawning Shell or LOLBin (Browser Exploitation, Windows Sysmon) · unlock with TL Creds
  • Exploit Staging From Temp Path Followed by Root Shell (Linux LPE Chain) · unlock with TL Creds

Indicators of compromise for GPT-6 Cyber vulnerability model

As of 2026-11-06, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5445.

14 indicators of compromise · unlock with TL Creds. Compare plans

How GPT-6 Cyber vulnerability model works

Access is limited to approved customers in OpenAI's Daybreak Red program.

This record tracks an emerging capability, not an exploited vulnerability: AI-accelerated vulnerability discovery and exploit development. No CVE, in-the-wild exploitation, threat actor, or network indicator is reported in any source.

BleepingComputer (Lawrence Abrams, 2026-11-06) reports that OpenAI's GPT-6 Cyber is rated 'Critical' under the OpenAI Preparedness Framework, up from the 'High' rating of the previous model. The article states the model found 81 previously unknown high-severity Firefox vulnerabilities and links the work to Mozilla advisory MFSA2026-118. In Linux kernel research it identified 2,308 potential issues, reproduced 1,724, and developed local privilege escalation exploits (unprivileged user to root) for 948 distinct flaws. On the ExploitGym benchmark it reached a 48.5% exploit success rate versus 32.1% for GPT-5.6 Cyber. Access is not public; it is limited to approved Daybreak Red customers, with expansion to all Daybreak Red customers planned. OpenAI is quoted: 'It is clear that we have a limited window to use frontier models to secure software.'

Corroboration: Mozilla's advisory MFSA2026-118 (Firefox 159, announced 2026-10-27) fixes well over 100 CVEs (repeated automated extractions of the page returned inconsistent totals, so no exact count is asserted here) and credits OpenAI Codex Security (handle 'kylebot', dozens of entries) and Amy Burnett of OpenAI, with most findings identified internally by Mozilla. That advisory does not itself confirm the figure of 81 or attribute the findings to GPT-6 Cyber, so the 81 and 948 figures rest on the single BleepingComputer article. Secondary sources describe the Daybreak program: Daybreak Blue gives approved defenders GPT-5.6 Sol without system-level cyber safeguards, and Daybreak Red offers purpose-trained cyber models (GPT-5.6-Cyber, announced 2026-08-10, rated 'High') for authorized vulnerability research and exploit validation, gated by identity verification, account monitoring and legal attestations. Some secondary sources attribute the first 'Critical' cyber rating to a separate model, GPT-6 Astra (2026-09-03/04); the relationship between GPT-6 Astra and GPT-6 Cyber is not established in the reviewed sources.

Defensive relevance: the time from disclosure to a working Linux LPE exploit is likely to shrink as comparable capabilities spread. Defenders should prioritize rapid kernel and Firefox patching, monitor for unprivileged-to-root escalation behavior, and track whether comparable capability reaches unrestricted or adversary-accessible models. Severity and status are analyst-assigned, not stated by the sources.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution

Resource Development

T1587.004 Exploits; T1588.006 Vulnerabilities; T1588.007 Artificial Intelligence

Remediation for GPT-6 Cyber vulnerability model

Patches

  • Firefox 159 (MFSA2026-118)
  • Distribution/vendor Linux kernel security updates

Immediate actions

  • Update Firefox to 159 or later per Mozilla advisory MFSA2026-118
  • Apply current vendor Linux kernel security updates promptly, prioritizing local privilege escalation fixes
  • Monitor Linux hosts for unprivileged-to-root escalation and unexpected setuid/credential changes

Workarounds

  • No workaround applies; this is a capability item, not a single vulnerability

Longer-term hardening

  • Shorten patch SLAs for kernel and browser vulnerabilities, assuming AI-assisted exploit development compresses time-to-exploit
  • Apply kernel hardening and least privilege to limit post-compromise escalation
  • Track AI vendor capability tiers and access programs as part of threat-landscape monitoring

Affected and fixed versions

  • Mozilla — Firefox
    Vulnerable versions: versions prior to 159
    Fixed in: 159 (MFSA2026-118)
  • Linux kernel community — Linux kernel
    Vulnerable versions: Not specified in source
    Fixed in: Not specified in source

Timeline of GPT-6 Cyber vulnerability model

  • locked-ioc-14 expands Daybreak into Blue (locked-ioc-7 without system-level cyber safeguards) and Red (purpose-trained locked-ioc-2, rated 'High' under the Preparedness Framework) tiers with identity verification and legal attestations.
  • Per secondary reporting, locked-ioc-14 publishes a safety overview rating locked-ioc-8 at Critical cyber capability and announces a $1 billion Daybreak commitment to critical infrastructure operators; relationship to locked-ioc-6 is not established.
  • A secondary source dates the locked-ioc-8 release and Daybreak for Frontline Defenders launch to this day.
  • locked-ioc-11 announces locked-ioc-13 159 and advisory locked-ioc-5 (well over 100 CVEs, majority High impact), crediting locked-ioc-1 ('locked-ioc-12') and locked-ioc-9 of locked-ioc-14 among reporters; the advisory does not attribute findings to locked-ioc-6.
  • Per BleepingComputer ('Thursday' before its 2026-11-06 article), locked-ioc-14 announces locked-ioc-6 with Critical cybersecurity capabilities, available only to approved locked-ioc-4 customers with planned expansion to all locked-ioc-4 customers.
  • BleepingComputer reports locked-ioc-6 rated Critical: 81 new high-severity locked-ioc-13 flaws, 2,308 candidate Linux kernel issues, 1,724 reproduced, LPE exploits for 948 distinct flaws, 48.5% locked-ioc-10 success vs 32.1% for GPT-5.6 Cyber; access limited to approved locked-ioc-4 customers.

Sources cited for GPT-6 Cyber vulnerability model

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats