🔍 Read the full analysis: AI At A New Pace? The GPT-6 Cyber And METR Report Findings on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
OpenAI named GPT-6 Cyber on Nov. 5, saying it powered a Linux security exercise that produced 948 working privilege-escalation exploits, including 588 flaws it described as previously unknown. METR separately reported that Anthropic’s model capabilities have advanced about 1.9 times faster since October 2025, but said much of the evidence is not public. Both developments point to faster AI-assisted vulnerability discovery and AI contributing to AI research, though key results rely on company data and remain difficult to verify independently.
OpenAI named GPT-6 Cyber on Nov. 5, saying the model powered an October exercise that generated 948 working Linux privilege-escalation exploits, including 588 flaws the company said were previously unknown. On the same day, independent evaluator METR reported that Anthropic’s measured AI progress accelerated after October 2025, while cautioning that much of the evidence it reviewed is not public.
OpenAI describes GPT-6 Cyber as a cybersecurity-focused version of GPT-6 Astra, intended for authorized security work such as vulnerability discovery, exploit development and web application testing. Access is restricted to organisations approved for the Daybreak Red programme, which covers offensive security testing. OpenAI says it uses identity checks, access controls and monitoring, and can suspend access. The model is rated “Critical” under OpenAI’s own cybersecurity framework; that rating is the company’s assessment, not an independent certification.
OpenAI’s account of the Linux exercise says its pipeline scanned about 2.8 million lines of kernel code, examined 2,308 candidate findings and reproduced 1,724 vulnerabilities in test environments. It then produced 948 working local privilege-escalation exploits, grouping findings by root cause. The company reported that 588 were previously unknown. These figures come from OpenAI’s description; the supplied material does not include an independent audit of the exercise or a public response from Linux maintainers.
METR’s report concerns a separate development. After an 11-week review of Anthropic data, the evaluator said its main measure of model progress grew about 1.9 times faster after October 2025 than before. METR estimated that AI assistance may account for roughly 80% of the acceleration in Anthropic’s research process. That estimate is an interpretation of evidence reviewed by METR, not a directly observed share confirmed by Anthropic in the supplied material.
GPT-6 Cyber · the Linux run
948 working exploits, about $1,279 each
OpenAI’s agents worked through the Linux kernel in mid-October. Every number on this board comes from OpenAI; our own arithmetic is marked ≈.
API cost per working Linux privilege-escalation exploit in OpenAI’s October run: $1,213,430 for 948 exploits. OpenAI’s own figures.
- Candidate findings analysed2,308
- Reproduced in test machines1,724
- Working exploits948
- …previously unknown588
About 2.8 million lines of kernel code scanned (≈7%). 948 = unique flaws after grouping 1,169 exploits by root cause.
Three months, one curve
OpenAI Linux runs, cost per privilege-escalation bug
- July 2026 · GPT-5.6 Sol166 bugs for $513,690≈ $3,094
- October 2026 · GPT-6 Cyber948 exploits for $1,213,430≈ $1,279
- Past hacking-competition payoutsper Linux privilege-escalation exploit$20k–70k
What is and is not known
As of 6 Nov 2026
- Reports go to kernel maintainers with candidate patches; a human checks each one first (OpenAI).
- Technical details, including at least 10 new techniques, are withheld until fixes ship.
- No public statement from Linux kernel maintainers found yet.
- Validated flaws with suggested patches are not the same as shipped fixes.
Sources: OpenAI, “A thousand fewer paths to root”, 4 Nov 2026, as quoted by The Hacker News and Decrypt; 588 previously unknown and the model as reported by Fortune, CSO Online and The Register, 5 Nov 2026. ≈ values: own arithmetic.
Powered by Thorsten Meyer AI
Faster Discovery, Shorter Patch Windows
If OpenAI’s reported results are representative, AI systems can help find and turn software flaws into working attacks at a scale that could strain security teams. The concern is not limited to who discovers a vulnerability: defenders must verify reports, prepare fixes and distribute patches before flaws are reused. The source material says the October Linux run cost about $1.21 million, or roughly $1,279 per exploit, compared with about $3,100 per exploit in an earlier OpenAI run in July. Those are company-reported costs and outputs, not a general price forecast.
The capabilities also are not exclusive to restricted commercial systems. The source says Epoch AI reported in late October that a freely downloadable model called GLM 5.3 could turn published Firefox fixes into working attacks for about $1,000 per Firefox version. That account raises the possibility that public vulnerability information and accessible models could help attackers as well as defenders. The practical implication for organisations is pressure to shorten the time between finding, fixing and deploying a patch. For individual users, prompt software updates remain a concrete defensive step.
METR’s finding matters for a different reason: if AI is helping researchers build stronger AI systems, progress could accelerate through a feedback loop. METR’s estimate suggests this may already be happening at Anthropic, but the report does not establish that the same pattern applies across all AI companies or will continue at the measured rate.
Popular right now
KitchenAid Classic Series 4.5-Quart Tilt-Head Stand Mixer, Onyx Black
Dreame L40 Ultra Gen 2 Robot Vacuum and Mop with 25,000 Pa Suction
KitchenAid 5.5-Qt Bowl-Lift Stand Mixer, Porcelain White (KSM55SXXX)
As an affiliate, we earn on qualifying purchases.
Two Findings, Different Evidence
The OpenAI and METR developments are related by the broader role of AI in cybersecurity and research, but they are not one joint study. OpenAI disclosed the Linux work on Nov. 4 in a post titled “A thousand fewer paths to root,” then named GPT-6 Cyber as the model behind it on Nov. 5. The source material also reports that OpenAI described a separate Firefox effort, with 81 previously unknown high-severity flaws. Mozilla’s October public advisories credited OpenAI with 50 high-impact Firefox fixes, but did not identify which model found each issue. The figures refer to different descriptions and should not be treated as directly interchangeable.
OpenAI’s reported July comparison offers a limited cost benchmark: an earlier run found 166 Linux privilege-escalation bugs for $513,690, or about $3,100 each, compared with the October figure of roughly $1,279 per reported exploit. The source also contrasts those costs with historical hacking-competition awards of $20,000 to $70,000 for one exploit. These comparisons describe different activities and do not establish the market value or typical cost of vulnerability research.
METR evaluates model capabilities and progress using its own research methods. In this case, it reviewed Anthropic data over 11 weeks. Its report says Anthropic redacted “a majority of the evidence we found most informative,” limiting what outside readers can check. METR wrote that the public “has to rely on METR’s judgment much more than would be ideal.” That caveat is central to interpreting its conclusion.
““a majority of the evidence we found most informative””
— METR
What Public Evidence Cannot Verify
The reported Linux totals, the number of previously unknown flaws and the per-exploit cost are OpenAI’s figures in the material provided. It is not clear whether Linux maintainers have independently confirmed the totals, how many findings have been fixed or disclosed, or whether the 948 figure represents distinct vulnerabilities after all root-cause grouping. The source also does not provide a public technical audit of the model’s contribution to each result.
For Firefox, Mozilla’s advisories credit OpenAI with 50 high-impact fixes in October, but do not specify which model found which flaw. The separate claim of 81 previously unknown high-severity Firefox flaws is attributed to OpenAI and cannot be mapped to those advisories from the information supplied. The timing and status of each fix are not fully detailed.
METR’s 1.9-times comparison and 80% estimate also carry limits. The former depends on METR’s measure of progress, while the latter is an estimate of AI’s contribution to Anthropic’s research acceleration. With much of the underlying evidence withheld, readers cannot independently reproduce the analysis from the supplied material. The findings do not prove that every lab is accelerating at the same pace or that the pace will persist.
Disclosure, Access and Patch Progress
OpenAI’s stated next step is to extend GPT-6 Cyber access to approved Daybreak Red organisations; the supplied material says wider availability to those customers was expected over the coming weeks. It does not give a complete schedule, identify all approved organisations or say when the reported Linux findings will be publicly documented. Further disclosures from OpenAI and responses from Linux maintainers could clarify which issues were fixed and how the totals were counted.
Security teams will need to track advisories and apply verified fixes as they become available. The supplied material does not specify a single release date or patch schedule for the Linux findings. METR’s report may prompt further scrutiny of how AI research acceleration is measured and what evidence companies make available to independent evaluators; no additional review or response is confirmed here.
For now, the confirmed public development is a restricted cyber model accompanied by company-reported security results, alongside an evaluator’s finding of faster progress at Anthropic under significant evidence limits. Whether those results mark a lasting change in the pace of vulnerability discovery and model development remains open.
Key Questions
What did OpenAI say GPT-6 Cyber did?
OpenAI said GPT-6 Cyber powered an October Linux exercise that produced 948 working local privilege-escalation exploits, including 588 flaws the company described as previously unknown. The totals are OpenAI-reported and are not independently verified in the supplied material.
Who can access GPT-6 Cyber?
OpenAI says access is limited to organisations it approves for the Daybreak Red programme, which supports offensive security testing. The company describes identity checks, access controls and monitoring for the programme.
What did METR find about Anthropic?
METR said its main measure of Anthropic’s model progress grew about 1.9 times faster after October 2025 than before. It estimated that AI assistance may explain about 80% of the acceleration, but much of its underlying evidence was redacted.
Are the reported vulnerabilities confirmed by maintainers?
The supplied material does not include public confirmation from Linux maintainers of OpenAI’s reported totals. It also does not give a complete account of which findings have been fixed or disclosed.
What should computer users do now?
Install software and security updates promptly, and follow notices from the vendors and projects whose products they use. The supplied material does not identify a specific patch schedule for the reported Linux findings.
Source: ThorstenMeyerAI.com
