GPT-6 Cyber finds 588 unknown Linux kernel flaws as OpenAI quadruples bug bounties

GPT-6 Cyber is OpenAI's agent model built for offensive and defensive security work. OpenAI rates it 'Critical' on cybersecurity capability. It found 948 Linux kernel exploits, 588 of which were previously unknown. Greg Brockman says it is already helping defend the Linux kernel, Firefox and other security-critical projects.

The main safety claim is scope discipline. OpenAI says it trained the model to stay within the rules of engagement an operator specifies. The Register framed the launch as 'this one stays within rules of engagement.' Alongside the model, OpenAI made Daybreak Red available to approved customers in AWS GovCloud (US-East), and says inference data there is not used for training.

OpenAI also raised its bug bounties sharply:

- A critical bug in ChatGPT, Codex or the API Platform now pays up to $30,000, or $51,577 with bonuses, up from $6,500.

- Exceptional findings can earn up to $172K.

The launch is part of a busy cyber week. Mistral demoed Large 4 patching a Django CVE, and the Frontier Model Forum proposed a shared jailbreak rating framework.

The skeptics are loud. Developers are frustrated by gated access; HN user TuxSH asked what the point is of delaying Daybreak Blue availability 'when high-impact CVEs are being dropped several times a week.' Others note that the rules-of-engagement guardrails have not been independently verified. A popular r/OpenAI thread aimed at Linux kernel maintainers points to the human cost: open-source maintainers must now triage a flood of AI-found bugs.