The short version: OpenAI released GPT-6 Cyber on November 5, and it is not something a small business can simply buy; access runs through an approved-customer program called Daybreak Red. What reaches you is its output. In one October run the model built working exploits for 948 Linux kernel flaws at about $1,280 apiece in API credits. Every one is a local privilege escalation: it turns an ordinary login into full control of the machine, and it needs that login first. So the question for an owner is not whether AI can break Linux. It is who holds a login on the Linux machines you depend on, and who your website shares a server with.
The price is the news here. OpenAI’s research report puts the whole run at $1,213,430, and divided by 948 that is about $1,280 an exploit. OpenAI’s own comparison is that hacking competitions have paid $20,000 to $70,000 for one Linux exploit of this kind. In September we argued that small businesses were protected mostly by the cost of a specialist’s time. This is the first itemized invoice we have seen for that time, and the same work is also getting bugs fixed.
What is GPT-6 Cyber, and can a small business use it?
GPT-6 Cyber is a version of OpenAI’s model tuned for security research: finding flaws, proving they can be exploited and drafting fixes. OpenAI’s announcement rates it Critical for cybersecurity under its own Preparedness Framework, up from High for GPT-5.6 Cyber. On ExploitGym, a test of whether a model can exploit a named flaw, it scored 48.5 percent against 32.1 percent for its predecessor.
You cannot just sign up for it. It starts with a select group of approved Daybreak Red customers through the API and Codex, with requests restricted by default to approved networks. Organizations can apply to Daybreak, but this tier is built for authorized security testing. OpenAI’s pricing page, read November 5, lists it at $20 per million input tokens and $100 per million output tokens, against $12.50 and $75 for GPT-5.6 Cyber and $4 and $20 for GPT-5.6 Sol. That is five times Sol’s rate for a tool a plumbing company has no reason to run. Google is doing much the same thing with Gemini 4 Carbon, defenders first.
OpenAI’s headline safety claim is that the model stayed in bounds: in a test with deliberately tempting side targets, it avoided out-of-scope services 99.93 percent of the time without its deployment prompt and 100 percent with it. The Register reports that OpenAI would not say what happened in the other 0.07 percent. All of these are the company’s own numbers.
What did $1.2 million of GPT-6 Cyber actually buy?
OpenAI published the funnel, and it is more instructive than the total. Agents picked 5,034 places to audit, about 7 percent of the kernel. They produced 2,308 candidate flaws in 12 hours and then reproduced 1,724 of them, or 74.7 percent, inside isolated machines. After variant analysis, that yielded 948 distinct flaws with working exploits and patches. Only 3.1 percent of candidates turned out to rest on incorrect analysis by the model. A person reviewed the results before anything went to maintainers.
Three figures tell you where this is heading.
- Three months, more than five times the yield. GPT-5.6 Sol managed 166 exploits with the same setup in July. Three months of kernel hardening later, GPT-6 Cyber reached 948.
- Others are finding the same bugs. In the 10 days the scan ran, OpenAI saw more than 100 of these flaws patched or queued for patching by other contributors, with about 300 more under public discussion.
- Less attack surface cuts the count hard. On a stripped-down kernel configuration, the pipeline produced 21 exploits for $32,936, or about $1,568 each. OpenAI does not present this as a controlled comparison and the two scans differ in scope, but 948 against 21 is a ratio of 45 to 1. Features you do not run are paths nobody can use.
Are the GPT-6 Cyber flaws fixed yet?
Some are, and the coverage is running ahead of the facts. CyberScoop’s report says all of the flaws were reported and patched. OpenAI’s own wording is narrower. It says Mozilla has released fixes for many of the Firefox flaws. For Linux, it says it has disclosed 304 critical findings to maintainers with candidate patches and is still working through the others. That is about one finding reported for every three exploits built, if those 304 all come from the 948, which OpenAI does not state.
Firefox is the part anyone can check, so we did. We went through Mozilla’s security advisories on November 5 and counted the high-severity flaws crediting OpenAI. Firefox 159, released October 27, carries 41 of them, out of 108 high-severity fixes in that one release. Firefox 158, released October 13, carries 9. Going back through July adds 8 more across earlier releases, for 58 in all. OpenAI claims 81.
That gap does not make OpenAI’s number wrong. Mozilla’s credits do not name a model, the July entries probably predate GPT-6 Cyber, and some fixes may sit in grouped entries or may not have shipped. It does mean the public record today supports “many” rather than “all,” which is the word OpenAI chose. Brian Grinstead, a Firefox distinguished engineer quoted in OpenAI’s announcement, says the model “helped us ship fixes to millions of users.” The advisories bear that out: if you update Firefox, you already have most of this work.
Linux is slower, and candidate patches are only candidates. A 1Password study we covered earlier found 53.9 percent of AI security patches failed, which is why a person reviews these before maintainers accept them.
What does a local Linux exploit mean for a small business?
Local is the word most coverage skips. A local privilege escalation does not break in from the internet. It starts with somebody who already has a limited account on the machine and hands them root, the master account. OpenAI’s report gives the practical translation: for a well-resourced attacker, a low-privileged account on a system missing its latest patches should be treated as the same thing as root.
That moves the risk to three places a small business actually has.
Shared web hosting. This is the one we would worry about first. On a budget plan your site sits on one server with other customers’ sites, and every account shares one Linux kernel. Picture a three-van plumbing company on such a plan. Its own site is fine, but a neighbor’s is running old software. A flaw like PHP2Shell, the bug we covered in October, can let a web request run code on a server as a limited user. A kernel exploit is the second step that turns that limited user into root, and root can read the plumber’s site, customer form submissions included.
That route is not theoretical. In September, cPanel warned that a low-privilege website user could reach root through a LiteSpeed web server flaw, bypassing CageFS, the common tool for keeping hosting accounts apart, and that the attacker could then access or alter other hosted sites. That was a web server bug rather than a kernel bug. SecurityAffairs counted three such root-level escapes on cPanel shared servers since May.
The Linux box in the back office. A file server, a phone system or a network drive with an old account on it. Think of the login you made for a bookkeeper in 2023 or the password a vendor’s technician still has.
Android phones. Android runs on the Linux kernel, and OpenAI mentions it for that reason. Its test ran on a desktop distribution, though, and it does not say how many flaws carry over. Treat this as a reason to install phone updates, not as a finding about phones.
Does GPT-6 Cyber put my office router at risk?
Not directly, and this is where the alarm can outrun the evidence. A router or camera is rarely a machine where staff hold limited accounts for a local exploit to start from, so an attacker would need another flaw first. Old kernels there are a real problem on their own, though. A June preprint studied 306 small-office routers and IP cameras from D-Link, TP-Link, Linksys, NETGEAR and TRENDnet, and found 11 of 40 chip-maker kernels had already reached end of life, with shipped firmware rarely moving past them.
The same paper is a useful brake. Inspecting the source code rather than matching version numbers found 99.8 percent fewer flaws on average, with 22 to 43 per vendor instead of thousands. It is a preprint and it does not prove those flaws can be exploited in shipped devices, but the lesson travels: a scary-looking version number is not evidence by itself. Replace a router its maker no longer updates, on your normal schedule. We looked at a related case with cheap TV boxes last month.
Three checks worth making this week
Update Firefox and Thunderbird. In Firefox, open the menu, then Help, then About Firefox, and restart when it asks. As of November 5 the current releases on Mozilla’s advisory page are Firefox 159.0.1 and Firefox ESR 153.6, with Thunderbird at 159 and 153.6. It takes about a minute, and it delivers most of the Firefox work described above.
Email your web host three questions. When was this server’s kernel last patched? Was it rebooted or live-patched afterward? If another account on my server is compromised, what stops it from reaching mine? The second question matters because the traditional kernel fix only takes hold after a restart, unless the host uses a live-patching service such as Ubuntu Livepatch, TuxCare’s KernelCare or Red Hat’s kpatch. If your plan offers a terminal, uname -r shows the kernel version, but do not judge by the number alone: Red Hat explains that distributions often put fixes into older-numbered versions. If the answers are vague, price out a plan that gives your site its own server or container, and keep a backup somewhere your host does not control.
Count the logins. This one is free, and it goes straight at the condition all 948 exploits need. List every account on your hosting control panel, your network drive and any Linux machine you own. Delete former employees and finished vendors, give the survivors their own passwords and turn on two-factor sign-in where it exists. Credentials left lying around are already how AI models got into real companies in testing.
The hopeful version of this story is an accurate one. You will never run GPT-6 Cyber, and you do not need to. A $1.2 million scan of the Linux kernel reaches you as a free update, as long as someone installs it. OpenAI also says a $1 billion grant program will subsidize access for resource-constrained defenders, and open-source maintainers are among the people it says it wants to reach. Your part is small: install the update, ask your host the question and close the old account. For the wider picture, our AI cybersecurity playbook for small business owners is the place to start.
Frequently Asked Questions
Can a small business buy GPT-6 Cyber?
Not in any practical sense. OpenAI is offering GPT-6 Cyber through the API and Codex to a select group of approved Daybreak Red customers, with wider Daybreak Red access to follow. OpenAI’s pricing page listed it at $20 per million input tokens and $100 per million output tokens on November 5, 2026. Small businesses get the benefit indirectly, through patches to software they already use.
How much did OpenAI’s 948 Linux exploits cost?
OpenAI reports a total of $1,213,430 in API credits for its mid-October run, which works out to about $1,280 per exploit. OpenAI compares that with historical competition bounties of $20,000 to $70,000 for one Linux exploit of this type. It describes its reported costs as an upper bound, because the work focused on measuring capability rather than on cost.
Have the GPT-6 Cyber vulnerabilities been fixed?
Partly. OpenAI says Mozilla has released fixes for many of the 81 Firefox flaws, and we counted 41 high-severity fixes crediting OpenAI in Firefox 159 alone. For Linux, OpenAI says it has disclosed 304 critical findings to maintainers with candidate patches and is still working through the rest, so some fixes have not yet reached ordinary machines.
Do these Linux exploits let a hacker in from the internet?
Not by themselves. All 948 are local privilege escalations, which start from a limited account already on the machine and turn it into full control. An attacker would need another way in first, such as a stolen password or a flaw in a website. That is why shared web hosting and forgotten accounts matter more here than an office router.
When did your web host last tell you it had patched and restarted the server your site runs on? Have you ever asked? Tell us what they said.
