Mozilla fixes Firefox flaws found by OpenAI’s GPT-6 Cyber
OpenAI says that GPT-6 Cyber found 81 previously unknown severe flaws in Firefox. Mozilla’s advisory for Firefox 159 credits OpenAI Codex Security with 34 of the 167 flaws it fixed.
2for an organization
Mozilla fixed flaws that OpenAI reported. Its advisory for Firefox 159 credits OpenAI Codex Security with 34 high-impact flaws among the 167 that it fixed.
Not ratedfor society
No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited.
OpenAI released GPT-6 Cyber on 5 November 2026. It is a model trained to find security flaws, build working exploits and propose patches. OpenAI says that its researchers used the model in a targeted campaign against Firefox. The model found 81 previously unknown severe flaws, although earlier AI models had already tested the browser. OpenAI also says that the model showed 30 known issues to be more severe than first thought. The Decoder and TNW report that Mozilla accepted the reports and has shipped fixes. The Decoder links the claim to Mozilla’s advisory for Firefox 159, announced on 27 October 2026. The advisory lists 167 fixed flaws. It credits OpenAI Codex Security with 34 of them, all rated high, and an OpenAI researcher with 7 more. The figure of 81 is OpenAI’s own. The Decoder notes that no independent testing of the model has been published.
Mozilla’s advisory names OpenAI Codex Security as the reporter of 34 flaws, so those finds are the agent’s. OpenAI researchers ran the campaign, and Mozilla’s engineers wrote and shipped the fixes. The count of 81 comes from OpenAI, and no independent testing of the model has been published.
Limits
The count of 81 flaws comes from OpenAI, and no independent testing of the model has been published. Mozilla’s advisory credits OpenAI Codex Security without naming the model behind it.
Trade-offs
The same model builds working exploits, so OpenAI limits it to vetted security teams.
Shown. The Decoder reports that OpenAI trained GPT-6 Cyber to find vulnerabilities, develop exploits and suggest patches.
“OpenAI has unveiled GPT-6 Cyber, an AI model specifically trained to find security vulnerabilities, develop working exploits, and suggest patches.” Source
In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, even though the browser had already been tested with earlier AI models.
Mozilla accepted the reports and has already shipped fixes.
All benchmark numbers come from OpenAI itself. No independent testing of the model has been published so far.
CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component Reporter OpenAI Codex Security (kylebot) Impact high
Details
AI system
Workflow
A model trained for security research, run by OpenAI researchers in a targeted campaign against one browser. A maintainer whose security team triaged the reports and shipped fixes.
Follow-up
Conditions for replication
The maintainer must accept AI-generated reports and fix them before attackers find the same flaws. Researchers must check that each reported flaw is real before it is filed.
OpenAI built GPT-6 Cyber to find security flaws in software, build working exploits and propose patches for vetted defenders.
Cite this benefit
Peter H. Vartanian. (2026). Mozilla fixes Firefox flaws found by OpenAI's GPT-6 Cyber (AIBD-1226). Artificial Intelligence Benefits Database. https://petervartanian.xyz/aibd/records/AIBD-1226.html (archived at https://doi.org/10.57967/hf/11470)