The problem
How it works
Brian Grinstead of Mozilla talks with OpenAI’s Clint Gibler about how Firefox’s security team combines its own experience with AI agents built on GPT-6 Cyber. The agents help decide which leads to investigate first, test whether a suspected vulnerability is real, search for other code with the same bug pattern, and help engineers prepare fixes. He also describes the model showing that some bugs the team already knew about were more serious than first thought, which changed what was fixed first.
Results and limitations
Marked reported: the video says Mozilla saw about an eightfold rise in bugs found and fixed across its security work from 2025 to 2026. This is the vendor’s and customer’s own figure, and it covers the whole workflow, not the model alone.
Before you try it
GPT-6 Cyber is not generally available: OpenAI’s system card says only approved Daybreak Red organisations get it, after identity and eligibility checks, with single sign-on, multi-factor authentication and IP allowlisting. Use tools like this only on code you own or are authorised to test, keep a person confirming each finding and reviewing each patch, and plan for the extra triage and release work that more findings bring. Results depend on your setup and were not independently reproduced by Top 200 Repos.
Tools and repositories
No ranked repository is involved. This use case still stands on its own source.
- Tools
- GPT-6 Cyber · Codex or the OpenAI API
- Prerequisites
- Approval for OpenAI’s Daybreak Red program and authorisation to test the code.
Try it yourself: Triage a suspected vulnerability before fixing it
Fill the fields to adapt the prompt. Empty fields stay as visible [placeholders].
Here is a suspected vulnerability in [Project]: [Finding]. Using only the code in [Code path], tell me whether it can be reached from [Entry point], write a minimal test that reproduces it without touching any outside system, rate its severity with your reasoning, and list other places in the code with the same pattern. Do not write the fix yet.Run the reproducing test yourself before trusting the severity rating.
Sources
- How Mozilla uses GPT-6 Cyber to find and fix Firefox vulnerabilities (opens in a new tab)
Vendor post · youtube.com · Published 13 Nov 2026 · Source checked 13 Nov 2026, 19:26 UTC
What this source supports
- Mozilla combines its security engineering with AI agents to strengthen Firefox
- Covers prioritising investigations, testing and verifying vulnerabilities, finding related bug patterns and helping engineers develop fixes
- GPT-6 Cyber showed some known bugs could be more serious than first understood
- About an 8x increase in bug discovery and fixes from 2025 to 2026 across the workflow
- GPT-6 Cyber System Card (opens in a new tab)
Vendor post · deploymentsafety.openai.com · Published 5 Nov 2026 · Source checked 13 Nov 2026, 19:32 UTC
What this source supports
- GPT-6 Cyber is a cyber-specialised model for authorised security work such as vulnerability discovery
- Access is restricted to approved Daybreak Red users with identity verification, SSO, MFA and API IP allowlisting