🔍 Read the full analysis: GPT-6 Cyber And METR: How To Read The $1,279 Exploit And Lab Speed on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
OpenAI says GPT-6 Cyber generated 948 working Linux privilege-escalation exploits in an October test, including 588 flaws it says were previously unknown, at about $1,279 per exploit. METR separately estimates that Anthropic’s model-performance progress accelerated after October 2025, while warning that much of its supporting evidence is not public. The figures point to growing security and oversight challenges, but key claims rely on company data or restricted evidence.
OpenAI on November 5 named GPT-6 Cyber as the model behind an October test that it says produced 948 working Linux privilege-escalation exploits, about $1,279 in API costs per exploit. The same day, independent evaluator METR reported that Anthropic’s measured model progress accelerated after October 2025, though it said much of the evidence informing its assessment is not public.
OpenAI’s figures describe a pipeline that scanned about 2.8 million lines of Linux kernel code, or roughly 7% of the project, and assessed 2,308 candidate findings. The company says it reproduced 1,724 vulnerabilities in test machines and generated 948 working local exploits after grouping findings by root cause. It says 588 of the 948 were previously unknown. These are OpenAI’s reported results; the source material does not identify a public independent validation of the Linux totals, and no Linux maintainer comment is cited.
OpenAI describes GPT-6 Cyber as a specialized version of GPT-6 Astra for authorized security work, including vulnerability discovery and exploit testing. Access is restricted to organisations OpenAI approves for its Daybreak Red programme, which covers offensive security testing. The company’s system card assigns the model its top cybersecurity risk tier, “Critical”; that rating is OpenAI’s own assessment, not an external certification.
METR’s report concerns a separate development at Anthropic. It says its main measure of model capabilities grew 1.9 times faster after October 2025 than before. METR estimates that AI assistance to Anthropic’s researchers may account for about 80% of the acceleration. That figure is an estimate, not a directly observed share, and METR cautions that Anthropic redacted a majority of the evidence it found most informative.
GPT-6 Cyber · the Linux run
948 working exploits, about $1,279 each
OpenAI’s agents worked through the Linux kernel in mid-October. Every number on this board comes from OpenAI; our own arithmetic is marked ≈.
API cost per working Linux privilege-escalation exploit in OpenAI’s October run: $1,213,430 for 948 exploits. OpenAI’s own figures.
- Candidate findings analysed2,308
- Reproduced in test machines1,724
- Working exploits948
- …previously unknown588
About 2.8 million lines of kernel code scanned (≈7%). 948 = unique flaws after grouping 1,169 exploits by root cause.
Three months, one curve
OpenAI Linux runs, cost per privilege-escalation bug
- July 2026 · GPT-5.6 Sol166 bugs for $513,690≈ $3,094
- October 2026 · GPT-6 Cyber948 exploits for $1,213,430≈ $1,279
- Past hacking-competition payoutsper Linux privilege-escalation exploit$20k–70k
What is and is not known
As of 6 Nov 2026
- Reports go to kernel maintainers with candidate patches; a human checks each one first (OpenAI).
- Technical details, including at least 10 new techniques, are withheld until fixes ship.
- No public statement from Linux kernel maintainers found yet.
- Validated flaws with suggested patches are not the same as shipped fixes.
Sources: OpenAI, “A thousand fewer paths to root”, 4 Nov 2026, as quoted by The Hacker News and Decrypt; 588 previously unknown and the model as reported by Fortune, CSO Online and The Register, 5 Nov 2026. ≈ values: own arithmetic.
Powered by Thorsten Meyer AI
Cheaper Exploit Discovery Narrows Patch Time
If OpenAI’s reported results hold up, the cost of generating working exploits has fallen sharply compared with its earlier run. The source says a July effort generated 166 Linux privilege-escalation bugs for $513,690, or about $3,100 each; the October figures imply about $1,279 per exploit. Those are company-reported costs and outputs, not a general market price or a measure of how often attackers will succeed.
The security concern is that faster discovery can benefit both defenders and people seeking to abuse flaws. A shorter interval between vulnerability discovery and a usable exploit may leave organisations less time to patch affected systems. The immediate practical implication for users is to install security updates promptly; for organisations, the reports underscore the value of monitoring, patch management and controlled security testing.
METR’s findings add a longer-term concern: if AI tools help researchers improve AI systems faster, capability gains may compound. But the report does not establish that every lab is progressing at the same rate, nor does its estimate prove that AI accounts for a specific share of all industry progress.
Products Worth Considering
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
Apple MacBook Air 15-inch with M5 chip, 24GB RAM, 512GB SSD, Midnight
As an affiliate, we earn on qualifying purchases.
Two Reports, Different Evidence
The OpenAI and METR developments are related by their focus on AI capability, but they are separate reports about different organisations. OpenAI’s October exercise tested vulnerability discovery and exploit generation against Linux; METR examined Anthropic’s model-performance trends over time. The evidence and methods should not be treated as interchangeable.
OpenAI also reported finding Firefox vulnerabilities. The source material says Mozilla’s public advisories credited OpenAI with 50 high-impact Firefox fixes in October, while a separate OpenAI claim cited 81 previously unknown high-severity flaws. The advisories do not specify which model found each flaw, so they do not independently establish that GPT-6 Cyber found all 81.
The cost comparison has limits. The reported July and October runs differ in timing and reported output, and the available material does not detail enough about their methods to establish that they were directly comparable. The figure of $1,279 per exploit is calculated from OpenAI’s stated API bill and exploit count, not a full accounting of research, infrastructure or validation costs.
“a majority of the evidence we found most informative”
— METR, on its access to Anthropic evidence
Independent Checks Remain Limited
The Linux exploit totals, the number of newly identified flaws and the associated API bill are presented as OpenAI’s figures. The source material does not provide public confirmation from Linux maintainers or a detailed external audit of the run. It also does not show how many reported findings have been fixed, which remain exploitable, or whether the vulnerabilities affect widely used systems in practice.
For Firefox, Mozilla’s advisories provide evidence of credited fixes but do not link each flaw to a particular model. The relationship between the 50 high-impact fixes in the advisories and OpenAI’s claim of 81 previously unknown high-severity flaws is not fully explained in the material. The exploit-cost comparison also leaves open whether the July and October runs used comparable methods and accounting.
METR’s conclusion is qualified by limited access to Anthropic’s underlying evidence. Its 1.9-times figure refers to its own measure of model progress, and the estimate that AI contributed about 80% of acceleration is an interpretation of that evidence. The material does not establish that the estimate applies to other companies or future periods.
Watch for Patches and Public Evidence
OpenAI says GPT-6 Cyber access is limited to approved Daybreak Red organisations, with access expected to extend to eligible customers over the coming weeks. The company’s reported findings will be easier to assess as affected-project maintainers publish advisories, fixes or technical details that can be checked independently.
Readers should watch for updates from Linux maintainers and Mozilla that clarify which vulnerabilities were confirmed, patched and attributed. Further detail about the October test’s methods and the accounting behind its cost figure would also help put the per-exploit comparison in context.
METR’s assessment may be updated as it gains access to more evidence or publishes further measurements. Until then, its conclusions should be read alongside its stated limitations. For users and organisations, the near-term response is practical: apply software security updates, track vendor notices and avoid treating company-reported exploit counts as independently verified totals.
Key Questions
What is the $1,279 figure?
It is an approximate cost per working Linux exploit, calculated from OpenAI’s reported $1,213,430 API bill divided by 948 exploits. It does not establish the full cost of the research or independent verification.
Did GPT-6 Cyber find all 81 reported Firefox flaws?
The source material does not establish that. Mozilla advisories reportedly credited OpenAI with 50 high-impact Firefox fixes in October, but they do not identify which model found each vulnerability or reconcile that count with OpenAI’s claim of 81 previously unknown high-severity flaws.
Who can use GPT-6 Cyber?
OpenAI says access is restricted to organisations it approves for its Daybreak Red programme, intended for offensive security testing. The material says access is being extended to approved organisations over the coming weeks.
What did METR conclude about Anthropic?
METR reported that its main measure of model progress grew 1.9 times faster after October 2025 than before. It estimated AI assistance may explain about 80% of that acceleration, while stressing that much of the underlying evidence is not public.
Are the exploit and speed figures independently verified?
The material presents OpenAI’s exploit totals and costs as company-reported figures, without a cited independent audit. METR is an external evaluator, but it says Anthropic redacted much of the evidence it considered most informative, limiting public verification of its assessment.
Source: ThorstenMeyerAI.com
