{"id":"AIBD-1226","title":"OpenAI says that its GPT-6 Cyber model found 81 previously unknown severe flaws in Firefox, and Mozilla's advisory for Firefox 159 credits OpenAI Codex Security with 34 of the flaws it fixed","summary":"OpenAI says that GPT-6 Cyber found 81 previously unknown severe flaws in Firefox. Mozilla's advisory for Firefox 159 credits OpenAI Codex Security with 34 of the 167 flaws it fixed.","date_observed":"2026-11-05","date_basis":"source publication","date_precision":"day","benefit_status":"reported","account":"OpenAI released GPT-6 Cyber on 5 November 2026. It is a model trained to find security flaws, build working exploits and propose patches. OpenAI says that its researchers used the model in a targeted campaign against Firefox. The model found 81 previously unknown severe flaws, although earlier AI models had already tested the browser. OpenAI also says that the model showed 30 known issues to be more severe than first thought. The Decoder and TNW report that Mozilla accepted the reports and has shipped fixes. The Decoder links the claim to Mozilla's advisory for Firefox 159, announced on 27 October 2026. The advisory lists 167 fixed flaws. It credits OpenAI Codex Security with 34 of them, all rated high, and an OpenAI researcher with 7 more. The figure of 81 is OpenAI's own. The Decoder notes that no independent testing of the model has been published.","category":"protective response","unexpected":false,"purpose":"OpenAI built GPT-6 Cyber to find security flaws in software, build working exploits and propose patches for vetted defenders.","system":"GPT-6 Cyber","model_version":null,"developer":"OpenAI","deployer":"OpenAI (security research team)","location":null,"domain":"Cybersecurity / vulnerability research","segment":"Technology","registry_ids":{},"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed flaws that OpenAI reported. Its advisory for Firefox 159 credits OpenAI Codex Security with 34 high-impact flaws among the 167 that it fixed."},{"group":"societal","depth":null,"reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}],"ai_role":{"status":"assessed","statement":"Mozilla's advisory names OpenAI Codex Security as the reporter of 34 flaws, so those finds are the agent's. OpenAI researchers ran the campaign, and Mozilla's engineers wrote and shipped the fixes. The count of 81 comes from OpenAI, and no independent testing of the model has been published."},"evidence":[{"kind":"news report","citation":"The Decoder, 5 November 2026.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"makers","quote":"In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, even though the browser had already been tested with earlier AI models."},{"kind":"news report","citation":"The Decoder, 5 November 2026. On Mozilla's response.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"makers","quote":"Mozilla accepted the reports and has already shipped fixes."},{"kind":"news report","citation":"TNW (The Next Web), 5 November 2026.","title":"OpenAI's GPT-6 Cyber found 81 new Firefox flaws and is rated 'Critical'","url":"https://thenextweb.com/news/openai-gpt-6-cyber-launch-firefox-linux-daybreak-red","date":"2026-11-05","written_by":"makers","quote":"OpenAI researchers used the model to find 81 previously unknown high-severity flaws in Firefox. Mozilla has started releasing fixes."},{"kind":"other","citation":"Mozilla Foundation Security Advisory 2026-118, Security Vulnerabilities fixed in Firefox 159, announced 27 October 2026.","title":"Security Vulnerabilities fixed in Firefox 159","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/","date":"2026-10-27","written_by":"beneficiary","quote":"CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component Reporter OpenAI Codex Security (kylebot) Impact high"},{"kind":"news report","citation":"The Decoder, 5 November 2026. On the evidence for the model.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"independent","quote":"All benchmark numbers come from OpenAI itself. No independent testing of the model has been published so far.","supports_benefit":false}],"replication":{"produced_by":["A model trained for security research, run by OpenAI researchers in a targeted campaign against one browser","A maintainer whose security team triaged the reports and shipped fixes"],"must_hold":["The maintainer must accept AI-generated reports and fix them before attackers find the same flaws","Researchers must check that each reported flaw is real before it is filed"],"echoes":[]},"paired_incident":null,"headline":"Mozilla fixes Firefox flaws found by OpenAI's *GPT-6 Cyber*","metric":"81 previously unknown severe flaws","comparator":{"against":"Firefox before the campaign, already tested with earlier AI models","before":"81 severe flaws that no one had reported","after":"reports that Mozilla accepted, with fixes shipping","basis":"assumed","quote":"In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, even though the browser had already been tested with earlier AI models.","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/"},"later":{"status":"unknown","date":null,"note":"The benefit was first reported on 5 November 2026, and no later report was found.","quote":null,"url":null},"learns_from_data":{"value":"shown","note":"The Decoder reports that OpenAI trained GPT-6 Cyber to find vulnerabilities, develop exploits and suggest patches.","quote":"OpenAI has unveiled GPT-6 Cyber, an AI model specifically trained to find security vulnerabilities, develop working exploits, and suggest patches.","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/"},"benefit_categories":["privacy_protection"],"size":{"reach":{"band":1,"fact":"One organization, Mozilla, fixed the flaws in Firefox.","quote":"Mozilla accepted the reports and has already shipped fixes.","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","reason":null},"duration":{"band":5,"fact":"A fixed flaw stays fixed in the browser's code, a hazard removed for good.","quote":"Mozilla accepted the reports and has already shipped fixes.","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","reason":null},"distribution":{"band":null,"fact":null,"quote":null,"url":null,"reason":"The benefit went to one software project, and no groups are compared."},"frequency":{"band":1,"fact":"One campaign found the flaws, and Mozilla fixed them in one release.","quote":"In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, even though the browser had already been tested with earlier AI models.","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","reason":null}},"value":null,"developer_country":"United States","deployer_country":"United States","unrated_because":null,"brief_notes":null,"brief":null,"confidence":"claimed","shade":"low","claim_status":"The beneficiary's account","claim_basis":"Sources: two news reports from the makers and the beneficiary's other source. For the benefit itself, the cited sources include no independent source and no finding by an external body.","case_jurisdictions":[],"design":"no comparison","certainty":"very low","certainty_reasons":["Starts very low because no comparison was measured."],"profile":{"case_id":"AIBD-1226","source_ids":["AIBD-1226-source-0001","AIBD-1226-source-0002","AIBD-1226-source-0003","AIBD-1226-source-0004","AIBD-1226-source-0005"],"families":{"strategic assessments":{"state":"unresolved","record_ids":[]},"evaluations":{"state":"unresolved","record_ids":[]},"monetary observations":{"state":"unresolved","record_ids":[]},"institutional decisions":{"state":"unresolved","record_ids":[]}},"fields":{"actors[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"developer":"OpenAI","deployer":"OpenAI (security research team)"}}},"actors[].ownership_control":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"ai_contribution":{"state":"value_present","value":{"kind":"record_fields","fields":{"ai_role":{"status":"assessed","statement":"Mozilla's advisory names OpenAI Codex Security as the reporter of 34 flaws, so those finds are the agent's. OpenAI researchers ran the campaign, and Mozilla's engineers wrote and shipped the fixes. The count of 81 comes from OpenAI, and no independent testing of the model has been published."}}}},"ai_relationship":{"state":"value_present","value":{"kind":"record_fields","fields":{"category":"protective response","ai_role":{"status":"assessed","statement":"Mozilla's advisory names OpenAI Codex Security as the reporter of 34 flaws, so those finds are the agent's. OpenAI researchers ran the campaign, and Mozilla's engineers wrote and shipped the fixes. The count of 81 comes from OpenAI, and no independent testing of the model has been published."}}}},"assessments[].alternatives":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"assessments[].assessor_date":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"assessments[].depth":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed flaws that OpenAI reported. Its advisory for Firefox 159 credits OpenAI Codex Security with 34 high-impact flaws among the 167 that it fixed."},{"group":"societal","reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}]}}},"assessments[].display_confidence":{"state":"value_present","value":{"kind":"structured","data":{"confidence":"low","evidence_word":"claimed","claim_status":"The beneficiary's account","basis":"Sources: two news reports from the makers and the beneficiary's other source. For the benefit itself, the cited sources include no independent source and no finding by an external body.","interpretation":"Existing display rule preserved; the richer outcome-specific confidence question still needs review."}}},"assessments[].rationale":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed flaws that OpenAI reported. Its advisory for Firefox 159 credits OpenAI Codex Security with 34 high-impact flaws among the 167 that it fixed."},{"group":"societal","reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}]}}},"assessments[].rubric_version":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"assessments[].status_basis":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"assessments[].target":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed flaws that OpenAI reported. Its advisory for Firefox 159 credits OpenAI Codex Security with 34 high-impact flaws among the 167 that it fixed."},{"group":"societal","reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}]}}},"availability":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"brief":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"case_kind":{"state":"value_present","value":{"kind":"structured","data":{"classification":"deployment","answer":"A deployment. OpenAI researchers ran the model against a real, released browser.","scope":"The period and activity described in the case."}},"display":{"answer":"A deployment. OpenAI researchers ran the model against a real, released browser.","inferred":false},"source_refs":["AIBD-1226-source-0001"]},"case_links[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"claims[].evidence_links":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"claims[].evidence_strength":{"state":"value_present","value":{"kind":"structured","data":{"answer":"The beneficiary's account. Sources: two news reports from the makers and the beneficiary's other source. For the benefit itself, the cited sources include no independent source and no finding by an external body.","evidence_word":"claimed","claim_status":"The beneficiary's account"}},"display":{"answer":"The beneficiary's account. Sources: two news reports from the makers and the beneficiary's other source. For the benefit itself, the cited sources include no independent source and no finding by an external body.","inferred":false},"source_refs":["AIBD-1226-source-0001","AIBD-1226-source-0002","AIBD-1226-source-0003","AIBD-1226-source-0004","AIBD-1226-source-0005"]},"claims[].missingness":{"state":"value_present","value":{"kind":"text","text":"The count of 81 flaws comes from OpenAI, and no independent testing of the model has been published. Mozilla's advisory credits OpenAI Codex Security without naming the model behind it."},"display":{"answer":"The count of 81 flaws comes from OpenAI, and no independent testing of the model has been published. Mozilla's advisory credits OpenAI Codex Security without naming the model behind it.","inferred":false},"source_refs":["AIBD-1226-source-0001","AIBD-1226-source-0004"]},"claims[].proposition":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"cross_border_flows[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"decisions[].action_outcome":{"state":"unresolved","family":"institutional decisions"},"decisions[].grounds":{"state":"unresolved","family":"institutional decisions"},"decisions[].institution_task":{"state":"unresolved","family":"institutional decisions"},"decisions[].success_criterion":{"state":"unresolved","family":"institutional decisions"},"deployment_stage":{"state":"value_present","value":{"kind":"structured","data":{"classification":"routine use","answer":"The system was in routine use. OpenAI offers the model to vetted security teams.","scope":"The period and activity described in the case."}},"display":{"answer":"The system was in routine use. OpenAI offers the model to vetted security teams.","inferred":false},"source_refs":["AIBD-1226-source-0001"]},"economics[].amount":{"state":"unresolved","family":"monetary observations"},"economics[].costs[]":{"state":"unresolved","family":"monetary observations"},"economics[].counterfactual":{"state":"unresolved","family":"monetary observations"},"economics[].currency_price_basis":{"state":"unresolved","family":"monetary observations"},"economics[].gross_net":{"state":"unresolved","family":"monetary observations"},"economics[].measure_type":{"state":"unresolved","family":"monetary observations"},"economics[].period_unit":{"state":"unresolved","family":"monetary observations"},"economics[].realization":{"state":"unresolved","family":"monetary observations"},"economics[].recipient_payer":{"state":"unresolved","family":"monetary observations"},"economics[].return_payback":{"state":"unresolved","family":"monetary observations"},"economics[].valuation_method":{"state":"unresolved","family":"monetary observations"},"evaluations[].ai_uplift":{"state":"unresolved","family":"evaluations"},"evaluations[].comparator":{"state":"unresolved","family":"evaluations"},"evaluations[].design":{"state":"unresolved","family":"evaluations"},"evaluations[].effect":{"state":"unresolved","family":"evaluations"},"evaluations[].exposure":{"state":"unresolved","family":"evaluations"},"evaluations[].id":{"state":"unresolved","family":"evaluations"},"evaluations[].measurement_method":{"state":"unresolved","family":"evaluations"},"evaluations[].metric":{"state":"unresolved","family":"evaluations"},"evaluations[].reproduction_materials":{"state":"unresolved","family":"evaluations"},"evaluations[].setting_sample":{"state":"unresolved","family":"evaluations"},"evaluations[].uncertainty_limitations":{"state":"unresolved","family":"evaluations"},"external_references[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"follow_up[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"later":{"status":"unknown","note":"The benefit was first reported on 5 November 2026, and no later report was found."}}}},"human_oversight":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"id":{"state":"value_present","value":{"kind":"record_fields","fields":{"id":"AIBD-1226"}}},"infrastructure_dependencies[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].beneficiaries":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].beneficiary_count":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].claim":{"state":"value_present","value":{"kind":"record_fields","fields":{"account":"OpenAI released GPT-6 Cyber on 5 November 2026. It is a model trained to find security flaws, build working exploits and propose patches. OpenAI says that its researchers used the model in a targeted campaign against Firefox. The model found 81 previously unknown severe flaws, although earlier AI models had already tested the browser. OpenAI also says that the model showed 30 known issues to be more severe than first thought. The Decoder and TNW report that Mozilla accepted the reports and has shipped fixes. The Decoder links the claim to Mozilla's advisory for Firefox 159, announced on 27 October 2026. The advisory lists 167 fixed flaws. It credits OpenAI Codex Security with 34 of them, all rated high, and an OpenAI researcher with 7 more. The figure of 81 is OpenAI's own. The Decoder notes that no independent testing of the model has been published."}}},"outcomes[].distribution":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].duration":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].id":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].stakeholder_group":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed flaws that OpenAI reported. Its advisory for Firefox 159 credits OpenAI Codex Security with 34 high-impact flaws among the 167 that it fixed."},{"group":"societal","reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}]}}},"outcomes[].status":{"state":"value_present","value":{"kind":"record_fields","fields":{"benefit_status":"reported"}}},"outcomes[].tradeoffs":{"state":"value_present","value":{"kind":"text","text":"The same model builds working exploits, so OpenAI limits it to vetted security teams."},"display":{"answer":"The same model builds working exploits, so OpenAI limits it to vetted security teams.","inferred":false},"source_refs":["AIBD-1226-source-0001"]},"outcomes[].unexpected":{"state":"value_present","value":{"kind":"record_fields","fields":{"unexpected":false,"purpose":"OpenAI built GPT-6 Cyber to find security flaws in software, build working exploits and propose patches for vetted defenders."}}},"places[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"developer_country":"United States","deployer_country":"United States"}}},"purpose":{"state":"value_present","value":{"kind":"record_fields","fields":{"purpose":"OpenAI built GPT-6 Cyber to find security flaws in software, build working exploits and propose patches for vetted defenders."}}},"record_dates":{"state":"value_present","value":{"kind":"record_fields","fields":{"date_observed":"2026-11-05","date_basis":"source publication","date_precision":"day"}}},"replication.attempts[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"replication.conditions":{"state":"value_present","value":{"kind":"record_fields","fields":{"replication":{"produced_by":["A model trained for security research, run by OpenAI researchers in a targeted campaign against one browser","A maintainer whose security team triaged the reports and shipped fixes"],"must_hold":["The maintainer must accept AI-generated reports and fix them before attackers find the same flaws","Researchers must check that each reported flaw is real before it is filed"],"echoes":[]}}}},"sector":{"state":"value_present","value":{"kind":"record_fields","fields":{"domain":"Cybersecurity / vulnerability research","segment":"Technology"}}},"sources[].access_version":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"sources[].citation_locator":{"state":"value_present","value":{"kind":"record_fields","fields":{"evidence":[{"kind":"news report","citation":"The Decoder, 5 November 2026.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"makers","quote":"In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, even though the browser had already been tested with earlier AI models."},{"kind":"news report","citation":"The Decoder, 5 November 2026. On Mozilla's response.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"makers","quote":"Mozilla accepted the reports and has already shipped fixes."},{"kind":"news report","citation":"TNW (The Next Web), 5 November 2026.","title":"OpenAI's GPT-6 Cyber found 81 new Firefox flaws and is rated 'Critical'","url":"https://thenextweb.com/news/openai-gpt-6-cyber-launch-firefox-linux-daybreak-red","date":"2026-11-05","written_by":"makers","quote":"OpenAI researchers used the model to find 81 previously unknown high-severity flaws in Firefox. Mozilla has started releasing fixes."},{"kind":"other","citation":"Mozilla Foundation Security Advisory 2026-118, Security Vulnerabilities fixed in Firefox 159, announced 27 October 2026.","title":"Security Vulnerabilities fixed in Firefox 159","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/","date":"2026-10-27","written_by":"beneficiary","quote":"CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component Reporter OpenAI Codex Security (kylebot) Impact high"},{"kind":"news report","citation":"The Decoder, 5 November 2026. On the evidence for the model.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"independent","quote":"All benchmark numbers come from OpenAI itself. No independent testing of the model has been published so far.","supports_benefit":false}]}}},"sources[].id":{"state":"value_present","value":{"kind":"identifiers","identifiers":["AIBD-1226-source-0001","AIBD-1226-source-0002","AIBD-1226-source-0003","AIBD-1226-source-0004","AIBD-1226-source-0005"],"role":"Existing evidence items, in their original order"}},"sources[].language":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"sources[].relationship":{"state":"value_present","value":{"kind":"record_fields","fields":{"evidence":[{"kind":"news report","citation":"The Decoder, 5 November 2026.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"makers","quote":"In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, even though the browser had already been tested with earlier AI models."},{"kind":"news report","citation":"The Decoder, 5 November 2026. On Mozilla's response.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"makers","quote":"Mozilla accepted the reports and has already shipped fixes."},{"kind":"news report","citation":"TNW (The Next Web), 5 November 2026.","title":"OpenAI's GPT-6 Cyber found 81 new Firefox flaws and is rated 'Critical'","url":"https://thenextweb.com/news/openai-gpt-6-cyber-launch-firefox-linux-daybreak-red","date":"2026-11-05","written_by":"makers","quote":"OpenAI researchers used the model to find 81 previously unknown high-severity flaws in Firefox. Mozilla has started releasing fixes."},{"kind":"other","citation":"Mozilla Foundation Security Advisory 2026-118, Security Vulnerabilities fixed in Firefox 159, announced 27 October 2026.","title":"Security Vulnerabilities fixed in Firefox 159","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/","date":"2026-10-27","written_by":"beneficiary","quote":"CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component Reporter OpenAI Codex Security (kylebot) Impact high"},{"kind":"news report","citation":"The Decoder, 5 November 2026. On the evidence for the model.","title":"OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them","url":"https://the-decoder.com/openais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them/","date":"2026-11-05","written_by":"independent","quote":"All benchmark numbers come from OpenAI itself. No independent testing of the model has been published so far.","supports_benefit":false}]}}},"sources[].upstream_sources":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"strategic_assessments[]":{"state":"unresolved","family":"strategic assessments"},"summary":{"state":"value_present","value":{"kind":"record_fields","fields":{"summary":"OpenAI says that GPT-6 Cyber found 81 previously unknown severe flaws in Firefox. Mozilla's advisory for Firefox 159 credits OpenAI Codex Security with 34 of the 167 flaws it fixed.","account":"OpenAI released GPT-6 Cyber on 5 November 2026. It is a model trained to find security flaws, build working exploits and propose patches. OpenAI says that its researchers used the model in a targeted campaign against Firefox. The model found 81 previously unknown severe flaws, although earlier AI models had already tested the browser. OpenAI also says that the model showed 30 known issues to be more severe than first thought. The Decoder and TNW report that Mozilla accepted the reports and has shipped fixes. The Decoder links the claim to Mozilla's advisory for Firefox 159, announced on 27 October 2026. The advisory lists 167 fixed flaws. It credits OpenAI Codex Security with 34 of them, all rated high, and an OpenAI researcher with 7 more. The figure of 81 is OpenAI's own. The Decoder notes that no independent testing of the model has been published."}}},"systems[].autonomy_permissions":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].component_role":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].deployment_configuration":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].inputs_outputs":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].model_name":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].model_version":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].product_name":{"state":"value_present","value":{"kind":"record_fields","fields":{"system":"GPT-6 Cyber"}}},"systems[].provider":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"title":{"state":"value_present","value":{"kind":"record_fields","fields":{"title":"OpenAI says that its GPT-6 Cyber model found 81 previously unknown severe flaws in Firefox, and Mozilla's advisory for Firefox 159 credits OpenAI Codex Security with 34 of the flaws it fixed","headline":"Mozilla fixes Firefox flaws found by OpenAI's *GPT-6 Cyber*"}}},"version":{"state":"value_present","value":{"kind":"identifiers","identifiers":["2d553ad5d72e7c15f1712180e93047280ba42186ca446401b189e8c253469d14"],"role":"SHA-256 of the complete public record and its assessments"},"evidence_note":"SHA-256 of the public record, its assessments, and its displayed answers and notes, excluding its own identifier and the derived coverage summary."},"workflow":{"state":"value_present","value":{"kind":"record_fields","fields":{"account":"OpenAI released GPT-6 Cyber on 5 November 2026. It is a model trained to find security flaws, build working exploits and propose patches. OpenAI says that its researchers used the model in a targeted campaign against Firefox. The model found 81 previously unknown severe flaws, although earlier AI models had already tested the browser. OpenAI also says that the model showed 30 known issues to be more severe than first thought. The Decoder and TNW report that Mozilla accepted the reports and has shipped fixes. The Decoder links the claim to Mozilla's advisory for Firefox 159, announced on 27 October 2026. The advisory lists 167 fixed flaws. It credits OpenAI Codex Security with 34 of them, all rated high, and an OpenAI researcher with 7 more. The figure of 81 is OpenAI's own. The Decoder notes that no independent testing of the model has been published.","replication":{"produced_by":["A model trained for security research, run by OpenAI researchers in a targeted campaign against one browser","A maintainer whose security team triaged the reports and shipped fixes"],"must_hold":["The maintainer must accept AI-generated reports and fix them before attackers find the same flaws","Researchers must check that each reported flaw is real before it is filed"],"echoes":[]}}}}}}}