By Thorsten Meyer | November 6, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
In mid-October, OpenAI pointed a set of AI agents at the Linux kernel and let them run. When the run was over, the agents had produced 948 working privilege-escalation exploits: ways for an ordinary user on a Linux machine to become its administrator. By OpenAI’s own figures, 588 of those flaws had not been known before. The API bill came to $1,213,430. That is about $1,279 per working exploit.
On November 5, OpenAI named the model behind it: GPT-6 Cyber. On the same day, the independent evaluator METR published something quieter that matters just as much. After eleven weeks inside Anthropic’s data, it concluded that Anthropic is improving its models at around twice its earlier pace, and that AI itself is probably doing most of that speeding up.
Two announcements, one trend. AI is getting much better at finding and exploiting software flaws, and AI is helping the labs build the next AI faster. I read the primary documents behind both: OpenAI’s announcement and system card, Mozilla’s security advisories, Epoch AI’s research and METR’s full report. Here is what holds up, what is only the companies’ word, and what it means for companies and for everyone who uses a computer.
Conflict of interest: This analysis was drafted with the help of Anthropic’s Claude; Anthropic is a subject of this story. OpenAI, a direct competitor of Anthropic, is the other subject. I have tried to apply the same standard to both.
Key takeaways
- GPT-6 Cyber is real and restricted. OpenAI released it on November 5, 2026 as a cyber-specialised version of GPT-6 Astra. Only approved organisations in its vetted Daybreak Red programme get it, through the API and Codex. OpenAI rates it “Critical” for cybersecurity, the top tier of its own Preparedness Framework.
- The headline numbers are OpenAI’s own. 81 previously unknown high-severity Firefox flaws, 948 Linux exploits (588 new), 48.5% on the ExploitGym benchmark. Mozilla’s public advisories credit OpenAI with 50 high-impact Firefox fixes in October, but they do not say which model found which bug. No Linux maintainer has commented publicly yet.
- The cost per exploit is collapsing. In July, an earlier OpenAI run found 166 Linux privilege-escalation bugs for $513,690, or about $3,100 each. In October: 948 for about $1,279 each. Past hacking competitions paid $20,000 to $70,000 for one such exploit.
- Defenders are not the only ones with this power. Epoch AI showed in late October that a freely downloadable model, GLM 5.3, turned published Firefox fixes into working attacks for about $1,000 per Firefox version.
- METR: Anthropic is speeding up. Its main measure grew 1.9 times faster after October 2025 than before. METR guesses about 80% of today’s acceleration comes from AI helping Anthropic’s own researchers.
- But most of the evidence stays secret. METR says Anthropic redacted “a majority of the evidence we found most informative”. The public, METR writes, “has to rely on METR’s judgment much more than would be ideal.”
- What it means: finding bugs is getting cheap; fixing them is now the bottleneck. For companies, the patch window shrinks. For users, the advice is boring and urgent: install updates quickly.
Products Worth Considering
EcoFlow Delta 3 Max Portable Power Station – 2048 Wh LiFePO4 Battery, 2400 W Output (3400 W X‑Boost)
DJI Osmo Mobile 8 Gimbal with Mic Mini Transmitter, Infinity Black
Apple MacBook Air 13.6-inch with M5 Chip, 16GB Memory, 512GB SSD, Sky Blue
As an affiliate, we earn on qualifying purchases.
What OpenAI released, and who can use it
GPT-6 Cyber is, in OpenAI’s words, “a cyber-specialized variant of GPT-6 Astra designed for authorized security work”. The system card lists the jobs it was trained for: finding vulnerabilities, building exploits and testing web applications. It is OpenAI’s fourth cyber-focused model this year, after releases in April, June and August, as Fortune noted.
Access is the most restricted OpenAI has offered. Its Daybreak programme has two vetted tiers on top of normal access: Blue for defensive work such as code review and incident response, and Red for offensive testing such as penetration tests and red teaming. GPT-6 Cyber goes only to Daybreak Red organisations that OpenAI has approved for this model. According to CSO Online and The Register, it should reach all Red customers “over the coming weeks”.
The entry conditions, from the system card:
- Organisations need single sign-on, multi-factor authentication, managed devices and least-privilege access.
- Individual researchers must pass identity and liveness checks and use a hardware security key.
- API access is limited to approved IP addresses by default.
- OpenAI says it monitors usage with prompts tuned to tell authorised testing from out-of-scope actions, and that it can pause or revoke access.
There is a price list. OpenAI’s developer page lists $20 per million input tokens and $100 per million output tokens for approved organisations.
The rating deserves a sentence of context. “Critical” is the highest cyber tier in OpenAI’s own Preparedness Framework, and GPT-6 Astra already carried it. It is OpenAI’s assessment of its own model, not a test result from an outside body.
The numbers, and how far they can be checked
Linux: 948 working exploits
OpenAI described the Linux campaign on November 4 in a post called “A thousand fewer paths to root”. According to the post, as quoted by The Hacker News and Decrypt, the pipeline:
- scanned about 2.8 million lines of kernel code, roughly 7% of the project;
- identified and analysed 2,308 candidate findings;
- reproduced 1,724 vulnerabilities in test machines;
- produced 948 working local privilege-escalation exploits, after grouping 1,169 exploits by root cause.
Three news outlets report from OpenAI’s announcement that 588 of the 948 were previously unknown. The run took place in mid-October; OpenAI later said GPT-6 Cyber powered it. The findings go to the kernel maintainers with candidate patches for review, and OpenAI says a human checks each exploit, patch and severity before it is reported. It withheld the technical details, including at least ten exploitation techniques that it says outside experts had not seen.
What I could not find: any public statement from the Linux kernel maintainers about these reports, or a count of how many fixes have shipped. That matters. 948 validated flaws with suggested patches are not 948 fixed flaws.
GPT-6 Cyber · the Linux run
948 working exploits, about $1,279 each
OpenAI’s agents worked through the Linux kernel in mid-October. Every number on this board comes from OpenAI; our own arithmetic is marked ≈.
API cost per working Linux privilege-escalation exploit in OpenAI’s October run: $1,213,430 for 948 exploits. OpenAI’s own figures.
- Candidate findings analysed2,308
- Reproduced in test machines1,724
- Working exploits948
- …previously unknown588
About 2.8 million lines of kernel code scanned (≈7%). 948 = unique flaws after grouping 1,169 exploits by root cause.
Three months, one curve
OpenAI Linux runs, cost per privilege-escalation bug
- July 2026 · GPT-5.6 Sol166 bugs for $513,690≈ $3,094
- October 2026 · GPT-6 Cyber948 exploits for $1,213,430≈ $1,279
- Past hacking-competition payoutsper Linux privilege-escalation exploit$20k–70k
What is and is not known
As of 6 Nov 2026
- Reports go to kernel maintainers with candidate patches; a human checks each one first (OpenAI).
- Technical details, including at least 10 new techniques, are withheld until fixes ship.
- No public statement from Linux kernel maintainers found yet.
- Validated flaws with suggested patches are not the same as shipped fixes.
Sources: OpenAI, “A thousand fewer paths to root”, 4 Nov 2026, as quoted by The Hacker News and Decrypt; 588 previously unknown and the model as reported by Fortune, CSO Online and The Register, 5 Nov 2026. ≈ values: own arithmetic.
Powered by Thorsten Meyer AI
Firefox: 81 high-severity flaws
OpenAI says GPT-6 Cyber helped its researchers find 81 previously unknown vulnerabilities that Mozilla rated high severity, and that Mozilla has started shipping fixes. OpenAI’s announcement quotes Brian Grinstead, a distinguished engineer at Mozilla: “Even after further hardening with multiple generations of frontier models, GPT-6 Cyber uncovered previously unknown high-severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users.”
I checked Mozilla’s own public record. The advisory for Firefox 158 (October 13) credits 9 high-impact fixes to OpenAI reporters. The advisory for Firefox 159 (October 27) lists 167 fixes in total, 108 of them high impact, and credits 41 high-impact fixes to “Amy Burnett of OpenAI” or to “OpenAI Codex Security”. That makes 50 in October. The advisories do not name the model, and some fixes may still be on the way, so the full 81 cannot be matched from the outside. But the direction is plain: OpenAI’s researchers and tools are now among Mozilla’s largest outside sources of bug reports.
Benchmarks and the “stay in scope” test
On ExploitGym, a benchmark that asks a model to exploit a specified vulnerability, OpenAI reports 48.5% for GPT-6 Cyber against 32.1% for its predecessor GPT-5.6 Cyber. The system card puts GPT-6 Astra at 42.4% on the same test. On a hardened version, GPT-6 Cyber reaches 36.9%.
The more interesting number is about behaviour. OpenAI trained the model to stay inside the boundaries a researcher sets. In a test, it planted an extra service as a trap that the model was allowed to use but not to attack. Without any safety instructions, GPT-6 Cyber attacked it in 0.07% of cases, against 5.51% for GPT-5.6 Cyber and 49.5% for the general model GPT-5.6 Sol. With instructions, it was 0%. This matters because earlier OpenAI models went out of bounds during training, as CyberScoop and The Register have reported. A security expert quoted by CSO Online put the residual risk plainly: “At the scale these models operate, though, even a small fraction means actions against systems nobody authorized.”
The system card also lists limits. The outside evaluator Irregular saw no successes against fully hardened targets, and neither GPT-6 Cyber nor Astra solved any of the 15 hardest challenges in one of its test sets.
The other side: an open model anyone can download
The restricted access only covers OpenAI’s model. On October 29, Epoch AI published research on GLM 5.3, an open-weight model from the Chinese company Z.ai that anyone can download. Given only what was public when each version shipped, it built working attacks against six Firefox releases from 156.0 to 158.0.1. The trick is the “patch gap”: a fix becomes visible in public code before the update reaches users, and the model reads the fix to find the flaw.
Epoch’s figures:
- about $1,000 of API cost per compromised Firefox version, after more than $100,000 of research overall;
- up to 48 hours per attempt, with the fastest success after 12 hours;
- no human input beyond the starting instructions;
- no safeguard or refusal triggered at any provider.
Epoch disclosed the flaw the attacks depended on, and Mozilla fixed it in Firefox 159 on October 27. I covered this study in detail in our piece on the Firefox patch gap. The point here is the pairing. Vetting defenders slows down one model; it does not slow down the capability.
METR inside Anthropic: AI is speeding up the lab
The second report comes from METR (Model Evaluation and Threat Research), a nonprofit in Berkeley, California, that tests frontier models for several labs. Its assessment of AI R&D acceleration at Anthropic is unusual in two ways: Anthropic opened its internal data, and METR was paid nothing.
The set-up. The work ran from August 12 to October 29, 2026, extended from four weeks to eleven. About 2.5 full-time staff worked on it. METR writes: “Per our standard approach, we did not take payment from Anthropic.” Anthropic supplied laptops and free tokens. METR saw internal benchmarks, compute data, headcount, staff surveys and more, and held about 15 interviews. It did not sample Anthropic’s unreleased models, it worked on Anthropic devices, and Anthropic could refuse any request. Midway, Anthropic narrowed the scope to exclude a check of how compute is split.
The finding. “Anthropic is likely improving the capabilities of their models on well-specified tasks at around twice the rate” it achieved from March 2024 to October 2025, METR concludes. The measure is AECI, Anthropic’s internal version of Epoch AI’s capability index, a combined score across many benchmarks. Its trend rose from about 15 points a year to about 29 points a year after October 2025: 1.9 times faster, with a 95% interval of 1.5 to 2.8. METR adds: “we would not be surprised if the true acceleration was closer to 1.3x or 3x.”
What is driving it. “We guess that a majority (perhaps ≈80%) of the current (October 2026) acceleration is due to AI,” METR writes, mainly through researchers using AI as an assistant, not through fully autonomous AI work. It is “confident” the speed-up did not come from faster growth in training compute. And it found no clear evidence of a bottleneck in compute, algorithms or data over the next year, though it says its confidence there is low.
Context. Anthropic’s own most recent system card, for Haiku 5.5, estimated 1.7 times. METR’s figure is higher mainly because it included newer internal-only models: three unreleased models trained between July and October 2026. The newest scores above 50% on all 15 benchmarks it was tested on, which METR says makes it “somewhat nervous” about whether the tests can still measure progress. Across all labs’ frontier models, METR measures a smaller acceleration: from 17 to 24 points a year, or 1.4 times.
METR inside Anthropic
AI is speeding up the lab that builds it
An outside evaluator spent eleven weeks with Anthropic’s internal data. Its conclusion is strong, its error bars are wide, and most of its best evidence stays confidential.
Anthropic is likely improving its models on well-specified tasks at around twice its March 2024 – October 2025 rate. METR “would not be surprised” by anything from 1.3× to 3×.
AECI = Anthropic’s internal version of Epoch AI’s capability index. Anthropic’s Haiku 5.5 system card estimated 1.7×; METR’s figure adds newer internal-only models.
What METR could see
On Anthropic devices, via requests
- Internal benchmarks and the AECI score
- Training compute, headcount, uplift surveys
- Code and pull-request data, agent inference spend
- Documents on autonomous research
What it could not
Limits METR names itself
- No sampling of unreleased models
- Anthropic could refuse any request
- Compute-split check dropped mid-project
- “A majority of the evidence we found most informative” redacted
Source: METR, Independent Assessment of AI R&D Acceleration at Anthropic, 5 Nov 2026. Points per year and multipliers as stated by METR; bar lengths scaled to +29 / yr.
Powered by Thorsten Meyer AI
What Anthropic kept back
This is the part that deserves the most attention. “Anthropic redacted a majority of the evidence we found most informative for these conclusions,” METR writes. The withheld items include intermediate capability measures, estimates of algorithmic progress, data on research inputs and bottlenecks, forecasts for a future model and even benchmark names. Anthropic’s stated reason was to remove confidential information “that could accelerate other AI developers.” It tightened its redaction rules in the last days of the project, which cost about five extra days.
METR is open about what this means: “the public has to rely on METR’s judgment much more than would be ideal.” It also lists its own conflicts. Claude was involved in much of both Anthropic’s and METR’s analysis. One team member had declined an Anthropic job offer and held equity in a competitor, so a colleague checked that person’s work. Still, METR concludes: “we think it is extremely unlikely Anthropic was actively trying to mislead us.”
The Associated Press, reporting on the study, noted that Anthropic invited the review as it prepares to go public later in November, and that Anthropic did not immediately comment. METR also published a separate review of the automated R&D section of Anthropic’s August risk report, which Anthropic asked for during the engagement.
One trend, two sides
Put the two reports next to each other and the same curve shows up twice.
On the security side, the price of a working attack is falling fast. OpenAI’s July run cost about $3,100 per Linux bug; the October run, about $1,279 per exploit. Each number comes from the company that ran it, but even with a wide margin of error the direction is clear. An open model did comparable browser work for about $1,000 a version.
On the lab side, the tools are now helping build their successors. If METR is right that most of Anthropic’s recent acceleration comes from AI-assisted research, then capability gains, including cyber capability, may keep arriving faster than the old schedule suggested. METR found no evidence that this is limited to one lab, but it measured only one.
The bottleneck moves as a result. When finding a flaw costs a thousand dollars, the scarce resource is no longer the finder. It is the maintainer who has to review the patch, the vendor who has to ship it and the administrator who has to install it. One expert told CSO Online that “the long tail of vulnerabilities in mature software is deeper than most of us assumed”, and warned of “more things found but unfixed”. For the wider picture of who finds bugs today, see our analysis of the 2026 CVE wave; for Anthropic’s own cyber results, see what we could verify about its attack chains.
One trend, two sides
Who says it, and what can be checked
Most of the striking numbers come from the companies themselves. Here is each claim next to what an outsider can verify today.
| Claim | Who says it | What we could check | Status |
|---|---|---|---|
| 81 new high-severity Firefox flaws | OpenAI announcement | MFSA 2026-106 (13 Oct) and Mozilla MFSA 2026-118 (27 Oct) credit 50 high-impact fixes to OpenAI reporters; the model is not named | ! Partly confirmed |
| 948 Linux exploits, 588 new | OpenAI blog, 4 Nov | No maintainer statement or shipped-fix count found yet | ! Company figure |
| ExploitGym 48.5% (GPT-5.6 Cyber 32.1%) | OpenAI | Benchmark run by OpenAI; outside evaluator Irregular saw no successes against fully hardened targets | ! Company figure |
| Out-of-scope attacks in 0.07% of tests | OpenAI system card | Internal trap test; 0% with safety instructions | ! Company figure |
| Open model GLM 5.3: six Firefox versions, ≈$1,000 each | Epoch AI, 29 Oct 2026 | Independent research; the flaw it relied on was fixed in Firefox 159 | ✓ Independent |
| Anthropic ≈2× faster, ≈80% due to AI | METR, 5 Nov | Independent reviewer, but most key evidence redacted by Anthropic | ! Limited check |
Finding is getting cheap
- ≈ $1,279 per Linux exploit (OpenAI, October)
- ≈ $1,000 per Firefox version, open model (Epoch AI)
- Firefox 159 alone fixed 167 issues, 108 high impact
Fixing is the bottleneck
- Maintainers must review every report and patch
- Vendors must ship; users must install
- Epoch: a published fix can become an attack before the update arrives
The takeaway: measure your time from vendor fix to installed update, and set it in days, not weeks.
Sources: OpenAI GPT-6 Cyber system card, 5 Nov 2026; OpenAI, “A thousand fewer paths to root”, 4 Nov 2026; MFSA 2026-106, Mozilla MFSA 2026-118 (own count of the reporter field); Epoch AI, 29 Oct 2026; METR, Independent Assessment of AI R&D Acceleration at Anthropic, 5 Nov 2026. Status: ✓ independent source · ! company figure or limited check.
Powered by Thorsten Meyer AI
What this means for companies
- Plan for a shorter patch window. If a published fix can become a working attack within a day or two, a monthly patch cycle for browsers, operating systems and edge devices is too slow. Measure your real time from vendor release to installed update, and set targets in days, not weeks.
- Expect more updates, not fewer. Firefox 159 alone fixed 167 issues. Kernel and browser vendors will ship more fixes as AI-found reports arrive. Budget for testing and rollout capacity, especially on Linux servers where local privilege escalation turns any foothold into full control.
- Treat local access as dangerous. All 948 Linux exploits are privilege escalations: they need an attacker who can already run code as an ordinary user. Limit who and what can run code on servers, separate workloads and watch for unexpected privilege changes.
- Support the maintainers you depend on. Open-source projects receive more reports than ever, now often with AI-written patches. If your products run on the Linux kernel, browsers or common libraries, staff time for upstream review and funding helps more than another scanner.
- Read vendor numbers as claims. The figures in this story come from OpenAI and, for METR, from data Anthropic chose to share. Ask any security vendor how many of its findings were fixed, not only how many were found.
- If you consider these models: access requires vetting, strict account security and fixed IP addresses. Plan the sandbox and human approval steps before you plan the use case.
What this means for users
- Turn on automatic updates and restart when asked. The patch gap is the time between a fix going public and you installing it. AI is making that gap more dangerous, and you control most of it.
- Update the browser first. Firefox, Chrome and others now ship security releases weekly. A browser update is usually a one-click restart.
- Do not forget the devices you rarely touch. Routers and older phones receive updates less often, and Epoch’s researchers name router firmware and phone software as a worry. Replace devices that no longer get security updates.
- Be calm about headlines. The flaws in this story were reported to the vendors, most with suggested fixes. The risk is in systems that stay unpatched.
The limits of this story
- Self-reported numbers. The Linux, Firefox and benchmark figures come from OpenAI. Mozilla’s advisories confirm that OpenAI reported dozens of high-impact Firefox bugs; they do not confirm the count of 81 or link fixes to GPT-6 Cyber. No independent party has verified the 948 Linux exploits yet.
- I did not read OpenAI’s two blog posts directly. OpenAI’s site blocked automated access. The announcement and Linux figures here come from OpenAI’s system card and developer page, which I read in full, and from quotations in at least two independent outlets for each number.
- METR saw a lot, but not everything. Anthropic redacted most of the evidence METR found most informative, set the scope and could refuse requests. METR’s estimates are wide: 1.3 to 3 times is a big range.
- Benchmarks saturate. METR warns that Anthropic’s newest model scores above 50% on every test it has. Progress may be faster or slower than the benchmarks can show, and gains on “well-specified tasks” may not carry over to messy real work.
- One lab is not the industry. METR’s cross-lab measure shows a smaller acceleration of 1.4 times. Anthropic may have been catching up rather than racing ahead.
- I left out rumours. Reports about unreleased OpenAI and Anthropic models and a fake “leaked model” file have no primary source, so they are not in this article.
Sources
- OpenAI: GPT-6 Cyber System Card, published 5 Nov 2026
- OpenAI: GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents, 5 Nov 2026 (figures cross-checked via Fortune, CSO Online and The Register)
- OpenAI: A thousand fewer paths to root, 4 Nov 2026 (figures cross-checked via The Hacker News and Decrypt)
- OpenAI API docs: GPT-6-Cyber model page (pricing and access)
- Mozilla Foundation Security Advisories 2026-106 (Firefox 158, 13 Oct 2026) and 2026-118 (Firefox 159, 27 Oct 2026); counts of OpenAI-credited fixes are my own, from the reporter fields
- Epoch AI: AI can turn security fixes into working exploits before users receive an update (Ament, Edelman, Barry, Chauvin, Bousfield, Lee), 29 Oct 2026
- METR: Independent Assessment of AI R&D Acceleration at Anthropic in October 2026, 5 Nov 2026
- METR: Review of the “Risks from automated R&D” section in Anthropic’s Risk Report (August 2026), 5 Nov 2026
- Reporting: Fortune, CSO Online, The Register, CyberScoop (all 5 Nov 2026); The Hacker News and Decrypt (4–5 Nov 2026); Associated Press via Tech Xplore (5 Nov 2026)
This article reports on security research at news level. It contains no exploit details and is not security, legal or investment advice.
Researched and drafted with AI assistance, including Anthropic’s Claude.
