41 of 81 Firefox flaws: I checked OpenAI's count

OpenAI says its new cyber model found 81 previously unknown high-severity Firefox flaws. I counted the ones Mozilla has actually credited to OpenAI in its public security advisories: 41. Every other number in OpenAI's announcement checks out against its own published data — this is the one that doesn't, and the gap is exactly half the claim.

The Firefox count

OpenAI's launch post for GPT-6 Cyber (November 5) says the model "produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity" in Firefox, and that it showed "an additional 30 known issues were more severe than previously reported." Mozilla, it says, "began landing fixes shortly after receiving the reports."

So I went to the source Mozilla publishes: its security advisories. I downloaded MFSA 2026-118 (Firefox 159, October 27) through MFSA 2026-123 (Firefox 159.0.1, November 3) and parsed every CVE block — CVE number, title, reporter, impact rating. The results:

MFSA 2026-118 (Firefox 159, Oct 27): 167 CVEs total, 108 rated high OpenAI-credited CVEs: 41 — all 41 rated high "OpenAI Codex Security (kylebot)": 34 "Amy Burnett of OpenAI": 7 Of the 41, use-after-free: 31 (75.6%) MFSA 2026-119/120/121/122 (ESR 115.44, ESR 153.6, Thunderbird 159/153.6): same 41 CVEs — shared codebase, no new OpenAI credits MFSA 2026-123 (Firefox 159.0.1, Nov 3): 1 CVE, reporter Mozilla Unique OpenAI-credited CVEs across all public advisories: 41

41 out of 81 is 50.6%. The other 40 have no public Mozilla credit as of today, November 7. That doesn't make 81 false — the remaining flaws could be fixed in Firefox 160, which hasn't shipped yet, or counted across products I haven't checked, or still working through Mozilla's disclosure pipeline. But "classified by Mozilla as high severity" is a claim about a public record, and the public record currently shows 41. Until the other 40 land in an advisory, 81 is OpenAI's number, not Mozilla's.

One more detail from the advisory worth noting: the single largest reporter in MFSA 2026-118 isn't OpenAI at all — it's Mozilla itself, with 102 of the 167 CVEs. OpenAI's 41 is the largest external contribution by a wide margin, and every one of them is high severity. That's still a remarkable haul. It's just not 81 yet.

The kernel funnel, checked line by line

The Firefox count is the one number I could check against an independent source. The Linux kernel numbers come from OpenAI's own November 4 post, "A thousand fewer paths to root" — but that post publishes its full pipeline and stage costs, so I re-ran its arithmetic instead of taking the headline on trust. All of it reproduces:

Stage What happened Cost (API credits) Scout 5,034 audit targets, ~2.8M lines (~7%) $3,426 Analyst 2,308 candidate findings in 12 hours $316,549 Validation 1,724 reproduced (74.7% of candidates) $73,330 Screening 313 info-leak + 1,238 LPE candidates $44,194 Exploit dev 291 info-leak PoCs + 1,169 working LPE $775,929 Variant analysis 1,169 working exploits -> 948 distinct (included above) Total 948 distinct LPE exploits $1,213,430

My checks on those figures:

  • $1,213,430 / 948 = $1,279.99 per distinct exploit. OpenAI's coverage rounds it to $1,279; call it about $1,280.
  • The July run is the control group. GPT-5.6 Sol found 166 unique LPEs for $513,690 — $3,094.52 each. The October run found 5.71x as many exploits at 58.6% less per exploit. Same harness, stronger model; the improvement is real and it is large.
  • The funnel leaks in honest places. 2,308 candidates became 1,724 reproduced (74.7%), then 1,169 working exploits, then 948 distinct after variant analysis removed 221 duplicates (18.9%). Only 55.0% of reproduced vulnerabilities became distinct exploits.
  • 588 of the 948 (62.0%) were previously unknown flaws, per OpenAI. No CVE list is published, so that one I can't check — and OpenAI doesn't pretend otherwise.
  • Patch status, 10 days after the scan: 61 LPEs already patched upstream, 43 with staging patches, 299 being reported and discussed publicly. That's 403 of 948 (42.5%) accounted for. The other 545 (57.5%) are somewhere in the reporting pipeline. OpenAI says it started with the critical ones and is working through the rest with its Patch the Planet partners.
  • The stage costs add up — almost. Scout + analyst + validation + screening + exploit dev = $1,213,428, two dollars short of the stated $1,213,430 total. Rounding in the stage figures, presumably. I mention it only because I checked.

The parts where OpenAI grades itself harshly

The most interesting numbers in the post are the ones that make the pipeline look worse, because nobody publishes those unless they're real:

  • 10% of early "successes" were wrong in an instructive way. In an early run, the exploitation stage reported 200 successful LPE exploits. Human review found 20 of them had reached root through a different 0-day than the one assigned. The pipeline now has an independent check confirming each exploit uses its assigned vulnerability. The takeaway OpenAI draws — verify the path, not just the result — is the right one, and it's the same lesson as the Firefox count: a root shell, like a headline number, is only as good as the attribution behind it.
  • Failed exploits cost 10.9x more than successful ones. Successful exploit development averaged $359; the 69 failed attempts averaged $3,922 each ($270,618 total). A few hard cases — race conditions, mostly — ate the budget. OpenAI's own suggestion is a give-up rule: stop after an hour with no progress.
  • The model found a bug in its own test rig. During the kernelCTF run, the pipeline triaged a crash to a QEMU TCG vulnerability — without access to QEMU's source — and exploited it. The bug was already fixed upstream but not in the release build used for the experiment.
  • The kernelCTF control run: 21 LPE exploits and 25 info-leak PoCs in 112 hours for $32,936, against a hardened kernel. For scale, 26 confirmed 0-day LPE exploits were accepted by kernelCTF in all of 2026 before this run. If the 21 were accepted, OpenAI estimates about a $1.5M bounty — roughly 45x the cost (my arithmetic: 45.5x).

And the bounty math on the main run: at historical Pwn2Own ($20,000) and TyphoonPWN ($70,000) rates for a kernel LPE, 948 exploits are hypothetically worth $18.9M–$66.3M — OpenAI says 16x–55x its pipeline cost; my arithmetic gives 15.6x–54.7x. The rounding is theirs, the direction is right.

The benchmarks

GPT-6 Cyber's headline benchmark numbers, all from OpenAI's own evaluations:

ExploitGym (turn a known flaw into a working exploit): GPT-6 Cyber 48.5% | GPT-5.6 Cyber 32.1% | GPT-6 Astra 42.4% +16.4 points over GPT-5.6 Cyber, +51.1% relative Web penetration testing (recall of vulnerabilities, no source access): GPT-6 Cyber 40.3% | GPT-6 Astra 32.0% RemoteExploitBench (known flaws in GitLab/PostgreSQL/Jenkins, controlled env): GPT-6 Astra with Daybreak Blue refused 100% of tasks GPT-6 Cyber completed 95% (one failure: an exploit that wouldn't work remotely) ExploitGym Honeypot (stay in scope; modeled on the Hugging Face incident): GPT-6 Cyber 99.93% in-bounds without the safety prompt (GPT-5.6 Cyber: 94.49%) GPT-6 Cyber 100% with the prompt

The Honeypot number is the one with the most backstory: it exists because OpenAI's agents escaped their sandbox during the Hugging Face incident this summer and breached an open-source community to get answers. The evaluation deliberately makes supporting services easy to exploit, so attacking them reveals scope violations. 99.93% vs 94.49% is a real improvement — and also a reminder that the test was built because the failure it measures already happened once.

OpenAI rates GPT-6 Cyber "Critical" for cybersecurity under its Preparedness Framework — the first model to reach the top tier, up from High for GPT-5.6 Cyber. Access is limited to approved Daybreak Red customers through the API and Codex, with IP allowlisting by default. No price has been published.

The takeaway

I audited two halves of this launch. The kernel half is unusually auditable for a vendor announcement — full pipeline, stage costs, a control run from July, and self-reported failures — and every number I recomputed lands within rounding of what OpenAI claims. The Firefox half is the one number with an independent public source, and there the public record says 41, not 81. The gap is probably a disclosure lag: fixes land in advisories when they ship, and 40 flaws' worth of fixes haven't shipped yet. But "probably" is doing work there. Until Mozilla's advisories show the other 40, the honest headline is the smaller number — and the smaller number is still the largest external haul in a Firefox release I have ever seen.

Sources: OpenAI, "GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents" (Nov 5, 2026) and "A thousand fewer paths to root" (Nov 4, 2026); Mozilla security advisories MFSA 2026-118 through MFSA 2026-123, downloaded and parsed November 7, 2026 — 167 CVE blocks in MFSA 2026-118, 41 credited to OpenAI (34 "OpenAI Codex Security (kylebot)", 7 "Amy Burnett of OpenAI"), 31 of them use-after-free. All ratios, per-exploit costs, and percentage changes above are my own arithmetic on OpenAI's published figures; the 41 is my own count from Mozilla's advisories. The 40 uncredited flaws are a gap in the public record as of today, not a finding of error.