Today ainotis Join

My notis

SafetyPublished Top storyAll news from that day

Ongoing case: Cyber-capable AI models 27 stories

GPT-6 Cyber found novel Firefox bugs and helped land fixes, Mozilla's Grinstead says

OpenAI says GPT-6 Cyber found 81 high-severity Firefox bugs; Mozilla's advisory credits 41 high-rated entries to reporters named as OpenAI and does not name the model.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

Share

Check our sources · 13 facts from 3 sources
How Mozilla strengthens Firefox security with GPT-6 Cyber: a video from OpenAI on YouTubeVideo: OpenAI on YouTube
watch on YouTube · Video still, linking to YouTube

Key points

  1. Brian Grinstead of Mozilla says that in early testing GPT-6 Cyber "not only identified novel vulnerabilities, but it worked efficiently" (0:24).
  2. He says the model's "reproducible test cases and fix patches helped our engineers land fixes quickly and get them out to users" (0:34).
  3. He says the tools are helping Mozilla "get those fixes shipped to millions of users" (0:44).

What happened

Brian Grinstead of Mozilla says OpenAI's GPT-6 Cyber found vulnerabilities in Firefox that were not known before, and that its test cases and patches helped Mozilla's engineers land fixes quickly.

He says it in a 53-second video that OpenAI published on its own channel on 5 November 2026, the day it announced the model.

Grinstead introduces himself as a distinguished engineer at Mozilla who works on Firefox. He says Firefox "entered 2026 as one of the world's most hardened and scrutinized code bases", so that "existing bugs are pretty subtle and hard to find" (0:14, 0:21).

Then, he says, in early testing GPT-6 Cyber "not only identified novel vulnerabilities, but it worked efficiently" (0:24).

He says the model's "reproducible test cases and fix patches helped our engineers land fixes quickly and get them out to users" (0:34), and that the tools are helping to "get those fixes shipped to millions of users" (0:44).

OpenAI's launch post puts numbers on it, and they are OpenAI's own. It says GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities that Mozilla classified as high severity, and showed that 30 known issues were more severe than previously reported. It says it disclosed them to Mozilla with proposed patches, and that Mozilla began landing fixes shortly after the reports.

Mozilla's security advisory for Firefox 159, dated 27 October 2026, lists 167 fixed vulnerabilities. It credits 41 of them, all rated high, to reporters named as OpenAI: "OpenAI Codex Security (kylebot)" on 34 entries and "Amy Burnett of OpenAI" on 7. The advisory does not name GPT-6 Cyber.

OpenAI describes GPT-6 Cyber as a cybersecurity model trained to find and validate exploitable vulnerabilities while staying within the scope that researchers set.

What it means for you

Our view

This is one Mozilla engineer's account, in a video OpenAI published on its own channel, and the counts come from OpenAI's launch post.

OpenAI says GPT-6 Cyber produced evidence for 81 novel high-severity vulnerabilities, while Mozilla's advisory credits 41 high-rated entries to reporters named as OpenAI and does not mention the model. The two counts are not shown to describe the same set, and no source says any of the bugs was exploited.

If you maintain software, treat the claim as a reason to try AI bug-finding on your own code, and before you rely on a vendor's count, look for the advisory that lists the fixes.

It adds no new facts.

Share this story

Your reaction

We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.

Check our sources

Every sentence above is checked against these 3 sources.

1 Brian Grinstead on GPT-6 Cyber and Firefox (OpenAI video)OpenAI · 5 Nov 2026 · 6 facts Open the source archived copy

  1. Brian Grinstead says in the video that, in early testing, GPT-6 Cyber 'not only identified novel vulnerabilities, but it worked efficiently' (0:24).

    Toned down to what the source says
    00:24 and hard to find. In early testing, GPT6 / 00:26 Cyber not only identified novel / 00:29 vulnerabilities, but it worked / 00:30 efficiently
    cite

  2. Grinstead says the model's 'reproducible test cases and fix patches helped our engineers land fixes quickly and get them out to users' (0:34).

    Toned down to what the source says
    00:34 our layered defenses. Its reproducible / 00:36 test cases and fix patches helped our / 00:38 engineers land fixes quickly and get / 00:40 them out to users.
    cite

  3. The video 'How Mozilla strengthens Firefox security with GPT-6 Cyber' is 53 seconds long and was uploaded on 5 November 2026 to the OpenAI channel.

    "title":"How Mozilla strengthens Firefox security with GPT-6 Cyber","lengthSeconds":"53" ... "publishDate":"2026-11-05T09:14:11-08:00","ownerChannelName":"OpenAI"
    cite

  4. Grinstead introduces himself as a distinguished engineer at Mozilla who works on Firefox (0:02).

    00:02 I'm Brian Ginstead. I'm a distinguished / 00:04 engineer at Mozilla and I work on / 00:06 Firefox.
    cite

  5. Grinstead says Firefox 'entered 2026 as one of the world's most hardened and scrutinized code bases' (0:14) and that 'existing bugs are pretty subtle and hard to find' (0:21).

    Toned down to what the source says
    00:14 and fix vulnerabilities. Firefox entered / 00:17 2026 as one of the world's most hardened / 00:19 and scrutinized code bases. So, at this / 00:21 point, existing bugs are pretty subtle / 00:24 and hard to find.
    cite

  6. Grinstead says the tools are helping Mozilla 'get those fixes shipped to millions of users' (0:44).

    00:40 them out to users. These tools are truly / 00:42 helping us find and fix security bugs / 00:44 and get those fixes shipped to millions / 00:46 of users, which is absolutely core to
    cite
2 GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agentsOpenAI · 5 Nov 2026 · 4 facts Open the source archived copy

  1. OpenAI's post introducing GPT-6 Cyber is dated 5 November 2026.

    OpenAI November 5, 2026 Product Security Safety GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents
    cite

  2. OpenAI says GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity, and showed that an additional 30 known issues were more severe than previously reported. the company says

    During a vulnerability research campaign, GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity, and showed that an additional 30 known issues were more severe than previously reported.
    cite

  3. OpenAI says it disclosed the findings to Mozilla along with proposed patches, and that Mozilla began landing fixes shortly after receiving the reports. the company says

    We disclosed the findings to Mozilla, along with proposed patches to help its engineers develop fixes. Mozilla was supportive of this work, and began landing fixes shortly after receiving the reports
    cite

  4. OpenAI describes GPT-6 Cyber as a cybersecurity model trained to find and validate exploitable vulnerabilities while staying within the scope that researchers set.

    A cybersecurity model trained to find and validate exploitable vulnerabilities, while staying within the scope that researchers set.
    cite
3 Security Vulnerabilities fixed in Firefox 159 (MFSA 2026-118)Mozilla · 27 Oct 2026 · 3 facts Open the source archived copy

  1. Mozilla Foundation Security Advisory 2026-118, 'Security Vulnerabilities fixed in Firefox 159', is dated 27 October 2026 and lists 167 vulnerabilities.

    Mozilla Foundation Security Advisory 2026-118 Security Vulnerabilities fixed in Firefox 159 Announced October 27, 2026 Impact high Products Firefox Fixed in Firefox 159
    cite

  2. In advisory 2026-118, 'OpenAI Codex Security (kylebot)' is credited as reporter on 34 entries and 'Amy Burnett of OpenAI' on 7 entries, all 41 rated high impact.

    Reporter OpenAI Codex Security (kylebot) Impact high
    cite

  3. Advisory 2026-118 does not mention GPT-6 Cyber.

    Reporter Amy Burnett of OpenAI Impact high
    cite

Topics

The morning email

On the mornings we publish: the three top stories and up to four short ones. Free.

We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep