🔍 Read the full analysis: GPT-6 Cyber And The METR Report: The AI Story Behind The Numbers on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
OpenAI said GPT-6 Cyber powered a Linux security test that produced 948 working privilege-escalation exploits, including 588 it described as previously unknown. Separately, METR reported that Anthropic’s measured AI research progress accelerated after October 2025, while warning that much of its supporting evidence is not public. The figures point to faster vulnerability discovery and AI-assisted model development, but key claims remain difficult for outsiders to verify.
OpenAI named GPT-6 Cyber on November 5 as the model behind a Linux security test that, according to the company, generated 948 working privilege-escalation exploits. On the same day, independent evaluator METR reported that Anthropic’s measured AI progress accelerated after October 2025, linking much of the increase to AI assistance. Together, the developments point to growing AI capability in both vulnerability research and AI development, though much of the underlying evidence is not public.
OpenAI describes GPT-6 Cyber as a cyber-specialized version of GPT-6 Astra for authorized security work, including vulnerability discovery, exploit development and web-application testing. The company says access is limited to approved organizations in its Daybreak Red programme, which covers offensive security testing. The model carries OpenAI’s own “Critical” cybersecurity rating, its top tier; that is a company assessment, not an independent certification.
OpenAI’s account of the Linux test says agents examined about 2.8 million lines of kernel code, identified 2,308 candidate findings and reproduced 1,724 vulnerabilities in test environments. The run produced 948 working local privilege-escalation exploits, the company said, including 588 flaws it described as previously unknown. OpenAI reported an API cost of about $1.21 million, or roughly $1,279 per exploit. Those counts and the cost come from OpenAI; the source material does not provide a public, independent audit of the full run.
The source also reports that Mozilla advisories credited OpenAI with 50 high-impact Firefox fixes in October, but did not identify which model found each vulnerability. Separately, METR said its measure of Anthropic’s research progress grew 1.9 times faster after October 2025 than before. METR estimated that AI assistance accounts for about 80% of the acceleration, while acknowledging that much of the evidence it reviewed is confidential.
GPT-6 Cyber · the Linux run
948 working exploits, about $1,279 each
OpenAI’s agents worked through the Linux kernel in mid-October. Every number on this board comes from OpenAI; our own arithmetic is marked ≈.
API cost per working Linux privilege-escalation exploit in OpenAI’s October run: $1,213,430 for 948 exploits. OpenAI’s own figures.
- Candidate findings analysed2,308
- Reproduced in test machines1,724
- Working exploits948
- …previously unknown588
About 2.8 million lines of kernel code scanned (≈7%). 948 = unique flaws after grouping 1,169 exploits by root cause.
Three months, one curve
OpenAI Linux runs, cost per privilege-escalation bug
- July 2026 · GPT-5.6 Sol166 bugs for $513,690≈ $3,094
- October 2026 · GPT-6 Cyber948 exploits for $1,213,430≈ $1,279
- Past hacking-competition payoutsper Linux privilege-escalation exploit$20k–70k
What is and is not known
As of 6 Nov 2026
- Reports go to kernel maintainers with candidate patches; a human checks each one first (OpenAI).
- Technical details, including at least 10 new techniques, are withheld until fixes ship.
- No public statement from Linux kernel maintainers found yet.
- Validated flaws with suggested patches are not the same as shipped fixes.
Sources: OpenAI, “A thousand fewer paths to root”, 4 Nov 2026, as quoted by The Hacker News and Decrypt; 588 previously unknown and the model as reported by Fortune, CSO Online and The Register, 5 Nov 2026. ≈ values: own arithmetic.
Powered by Thorsten Meyer AI
Cheaper Exploits Shrink Patch Windows
The reported Linux results matter because they suggest that generating working exploits may be becoming less expensive. The source compares OpenAI’s October figure of about $1,279 per exploit with an earlier July run that reportedly cost about $3,100 per exploit. These are company-reported results from separate runs, not a controlled independent comparison. The source also cites historical hacking-competition awards of $20,000 to $70,000 for a single exploit; those prizes are not directly equivalent to the cost of an AI-generated exploit.
If the capability is reproducible beyond OpenAI’s tests, it could benefit security teams looking for weaknesses before attackers find them. The same methods could also be misused. A separate Epoch AI test cited by the source found that a downloadable model, GLM 5.3, could turn published Firefox fixes into working attacks for about $1,000 per Firefox version. That result adds to concerns that defensive findings can be repurposed, though the source does not establish how widely the technique is being used.
For organizations, the immediate practical pressure is on vulnerability triage and patching: a shorter time between discovering a flaw and producing an exploit can leave less time to update affected systems. For individual users, the source’s practical advice is to install security updates promptly. METR’s findings matter for a different reason: if AI is helping researchers build more capable AI, progress could feed back into itself. The estimate is METR’s interpretation of its data, not a directly observed share of all Anthropic research work.
Products Worth Considering
Apple iPad mini (A17 Pro), 128GB, Wi-Fi 6E, Space Gray
FLEXISPOT 60 x 30-Inch Bamboo Electric Standing Desk with White Frame
Apple MacBook Air 15-inch with M5 chip, 16GB memory, 512GB SSD, and Liquid Retina display (Midnight)
As an affiliate, we earn on qualifying purchases.
Two Reports, Different Evidence
The developments are related by their focus on AI capability, but they are not the same kind of evidence. OpenAI’s Linux and Firefox figures describe security work attributed to its systems. METR’s report examines the pace of progress inside Anthropic using data from an eleven-week review, according to the source article. OpenAI’s figures are company disclosures; METR is an external evaluator, but its analysis also depends on evidence that it says is partly withheld.
OpenAI’s Daybreak programme separates defensive work, described as Blue, from offensive testing, described as Red. GPT-6 Cyber is restricted to Red organizations approved by OpenAI. The stated controls include organizational security requirements and identity checks for individual researchers. The source says access is expected to extend to approved Red customers over the coming weeks, but that rollout timing is attributed to reporting by other outlets.
The source also describes an earlier OpenAI Linux run in July that reportedly produced 166 privilege-escalation bugs for $513,690. Comparing it with the October run suggests a lower reported cost per exploit, but differences in the tests and methods could affect the comparison. No Linux maintainer had commented publicly at the time covered by the source material.
“A majority of the evidence we found most informative”
— METR, discussing evidence reviewed for its report
Key Results Remain Hard to Verify
The most prominent exploit counts come from OpenAI’s description of its own test. The source material does not provide an outside audit of the Linux findings, a public list of all 948 exploits, or independent confirmation that 588 were previously unknown. It also does not establish how the reported findings were handled after discovery or whether all affected issues have been fixed.
Mozilla’s public advisories reportedly credit OpenAI with 50 high-impact Firefox fixes in October, but do not connect individual fixes to GPT-6 Cyber or another model. The source says no Linux maintainer had commented publicly at the time of writing. It remains unclear whether the Linux maintainers have independently reviewed the company’s full accounting.
METR’s acceleration estimate has a separate limitation: the evaluator says much of the evidence it considered most informative is redacted. Its estimate that AI accounts for about 80% of the faster pace should be treated as an analytical judgment, not a directly verified measure. The source also does not specify enough detail to determine how comparable the July and October OpenAI runs were.
Access and Independent Checks Ahead
OpenAI said GPT-6 Cyber is available to approved Daybreak Red organizations, with broader access for eligible customers expected over the coming weeks, according to reporting cited in the source. Further detail on how the company validates findings, reports vulnerabilities to maintainers and tracks fixes would help outside observers assess the security impact of the Linux campaign.
Security teams and maintainers will need to review reported flaws and keep users informed about patches. The source offers no confirmed schedule for public Linux maintainer responses or for independent verification of the exploit count. For users, the next step is practical rather than technical: install available operating-system and browser security updates promptly.
METR’s report leaves open whether future assessments will include more public evidence or whether Anthropic will permit additional disclosure. Until then, its estimate is useful as an attributed evaluation of research trends, but readers cannot fully reproduce the analysis from public information. Both stories will be clearer as more technical details, fixes and third-party assessments become available.
Key Questions
What is GPT-6 Cyber?
GPT-6 Cyber is OpenAI’s cyber-specialized version of GPT-6 Astra, described by the company as intended for authorized security work such as finding vulnerabilities and testing applications. Access is restricted to organizations approved for its Daybreak Red programme.
Did OpenAI independently verify the 948 Linux exploits?
The source material attributes the figure to OpenAI’s account of its test. It does not cite a public independent audit confirming the total or the claim that 588 findings were previously unknown.
What did METR conclude about Anthropic?
METR reported that its measure of Anthropic’s research progress grew 1.9 times faster after October 2025 than before. It estimated that AI assistance accounts for about 80% of the acceleration, while noting that much of the most informative evidence was not made public.
What does the reported cost per exploit mean?
OpenAI’s reported October API bill was about $1.21 million for 948 working exploits, or roughly $1,279 each. This is a company-reported average for that run, not a general price for producing exploits or a verified comparison across equivalent tests.
What should computer users do now?
The source recommends installing security updates promptly. It does not identify a newly confirmed threat to ordinary users from this test, but faster exploit development could reduce the time available to patch vulnerable software.
Source: ThorstenMeyerAI.com
