AI vulnerability hunters, GPT-6 Cyber, Hy4 and RSA-1024

The week of 2 to 8 November 2026 made one thing hard to ignore: AI models are now good enough at security research that the labs building them treat them as controlled tools, not ordinary products. OpenAI released a model it says built working exploits for hundreds of Linux kernel flaws, and limited it to approved customers. Tencent went the other way and removed offensive security material from an open model's training data. Google DeepMind said its agents, guided by humans, found two new weaknesses in legacy 1024-bit RSA.

If you build or run software, this matters because the time between "a flaw exists" and "someone can exploit it" is shrinking. Your patching speed, key inventory and own use of AI for code review all need to keep up.

What happened

OpenAI releases GPT-6 Cyber to approved Daybreak Red customers (5 November)

On 5 November OpenAI announced GPT-6 Cyber, a version of its GPT-6 family tuned for authorised security work such as exploit development and red-teaming. According to Fortune's report of the launch, the company says the model found 81 previously unknown, high-severity vulnerabilities in Firefox. It also says the model developed working exploits for 948 Linux kernel vulnerabilities, 588 of them previously unknown, which could let a local attacker gain root privileges. Fortune notes that this is more than five times the Linux count from a July study using GPT-5.6 Sol.

The Next Web adds further figures from the announcement. In the Linux campaign the model reproduced 1,724 vulnerabilities and built working exploits for 948, and OpenAI says it disclosed 304 critical findings to maintainers with proposed patches. Mozilla has started releasing fixes for the Firefox flaws. On the ExploitGym benchmark the company reports 48.5% for GPT-6 Cyber against 32.1% for GPT-5.6 Cyber.

OpenAI rates the model "Critical" for cybersecurity under its Preparedness Framework, up from "High" for GPT-5.6 Cyber, according to The Next Web. That is the top level of the framework's scale. Access is the main control. The model is available, via the API and Codex, only to select approved customers in Daybreak Red, the tier of OpenAI's Daybreak programme for attack simulation and authorised testing. Defensive work sits in a separate tier, Daybreak Blue. OpenAI says access will expand to all Daybreak Red customers over the coming weeks.

The company also reports a scope test. In a honeypot version of ExploitGym, without its deployment safety prompt, GPT-6 Cyber stayed away from off-limits services in 99.93% of tests, against 94.49% for GPT-5.6 Cyber. With the prompt, it stayed in bounds every time. Not everyone is reassured. Chris Hughes of Noma Security told The Next Web: "Even a small fraction means actions against systems nobody authorized."

All of these figures are OpenAI's own claims, as reported by Fortune and The Next Web. No outside party has yet verified them.

Tencent releases Hy4 with offensive security data filtered out (4 November)

On 4 November, Reuters reported that Tencent had released Hy4, a new open-source model trained with limited cybersecurity data. Tencent says it filtered out training content on exploit development, reverse engineering and penetration testing to limit the model's "offensive" capabilities. Cybersecurity training was kept to defensive uses, such as finding software flaws and helping to fix them.

Tencent says its internal security specialists found no sign that Hy4 posed higher risks in helping users break into software or bypass protections. The company plans to release the model weights later, together with a report on its safety testing. No date was given. Tencent's statement read, in part: "We recognise the potential safety risks posed by advanced cyber and biological capabilities". No parameter count or benchmark figures were reported.

Google DeepMind's agents find two weaknesses in legacy 1024-bit RSA (6 November)

On 6 November Google DeepMind posted on X: "Guided by humans, our models uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems." Pushmeet Kohli, its VP of Science, wrote in his own post that the work could "bypass older digital signature protections and factor legacy 1024-bit RSA keys in bulk". He also wrote that the results "do not affect the security of modern encryption schemes such as RSA 2048". DeepMind's thread added that "we can no longer rely on historical hardness assumptions" and that cryptographic standards must be stress-tested continuously.

In plain terms, DeepMind describes two separate results, both aimed at legacy 1024-bit keys and neither yet peer reviewed:

Signature forgery. A faster way to forge digital signatures made with older RSA signing schemes, under conditions where an attacker can influence part of what gets signed.
Bulk factoring. A cheaper way to factor many legacy 1024-bit keys in one batch, so that each additional key costs less to break than the first.

DeepMind has not, in the posts quoted above, claimed that either result breaks RSA at 2048 bits or above. The exact size of the improvement is still to be checked by independent cryptographers.

How AI finds vulnerabilities

Headlines suggest a model "looks at code and sees the bug". The reality is more mechanical. Modern AI bug hunting is a loop of three activities run many thousands of times: reading code, testing it, and proving the result.

Reading code like a reviewer

A large language model reads source code much as a senior reviewer does. It follows where untrusted input enters, such as a network packet, a file being parsed or a system call argument, and tracks where that input goes. It looks for familiar danger patterns: a length that is checked after it is used, memory that is freed and then touched again, an integer that can wrap around.

Think of a building inspector who knows faults hide behind the fuse box or where an extension was added, and looks there first. A model does the same across millions of lines, flagging the places worth a closer look.

On its own, this produces many false alarms. A suspicion is not a bug.

Fuzzing: shaking the box

Fuzzing is an old technique: feed a program huge numbers of random or slightly mutated inputs and watch for crashes. It is like testing a vending machine by pressing every button combination, inserting bent coins and kicking it, until something breaks.

Classic fuzzers are blind. An AI agent can write a targeted fuzz harness, a small program that feeds inputs straight into the suspicious function, and craft inputs that pass a format's checks to reach deep code. The model provides the aim, the fuzzer the brute force.

Exploit validation: proving it is real

The third step separates research from noise. When the agent finds a crash, it tries to show the crash matters. Can it control which memory gets overwritten? Can it turn that into running its own code, or into gaining root, as with the Linux privilege escalations OpenAI described?

The work is trial and error, which suits agents. The agent writes an exploit attempt, runs it in a sandbox, reads the error, adjusts and tries again, thousands of times overnight. The harness around the model matters as much as the model. If you want to understand the moving parts, see how an agent harness wraps a model with tools and memory, and why each run belongs in a sandbox.

The key insight is that a working exploit is a self-checking answer. Either the exploit gives a root shell or it does not. That gives the agent a clear signal to learn from, much like a maths student who can check an answer by substitution. Tasks with cheap, reliable checks are exactly where AI agents improve fastest. Mathematics works the same way when a proof can be checked by a proof assistant such as Lean: the proof either compiles or it fails.

Why "Cyber" models are different from general models

General chat models refuse many security requests because they cannot tell a penetration tester from a criminal. A "Cyber" variant is trained to refuse less on authorised tasks and to stay within a defined scope. Safety then moves partly from the model to the door: identity checks, monitoring and logging. For more on layered controls, see guardrails and zero trust.

Dual use, staged access and filtered data

Every security capability is dual use. A tool that finds a flaw so you can patch it also finds it for someone who wants to break in. A locksmith's training is the same whether they let you into your own house or someone else's. This week showed three different answers to that problem.

Staged access (OpenAI). Release the strong model only to vetted users, then widen access while watching for misuse. The bet is that defenders get a head start. The weakness is reliance on vetting, and on no comparable model appearing elsewhere.

Filtered training data (Tencent). Remove offensive material before training, then release openly. The weakness is that skills are entangled: finding and exploiting a bug draw on the same understanding of code, so filtering may weaken defence too, and fine-tuning could restore some of what was removed.

Human-guided research with disclosure (DeepMind). Point agents at a narrow problem, keep humans in charge, and publish results that mainly affect deprecated settings.

These are trade-offs, and teams deploying AI internally face the same choice on a smaller scale. That is a question of AI governance, not just engineering.

What RSA key size and padding mean, in plain words

Key size: the number of combinations

RSA security rests on a simple fact: multiplying two large prime numbers is easy, but splitting the result back into those primes is very hard. The public key contains the product. The private key depends on the two primes.

Key size is the length of that product in bits: about 309 decimal digits for 1024 bits, 617 for 2048. Doubling the bits multiplies the difficulty enormously, just as each extra wheel on a combination lock multiplies the possibilities by ten.

Standards bodies have discouraged 1024-bit RSA for over a decade, and 2048 bits is the common minimum. But old keys linger in devices, legacy servers and DNS records. The batch result matters because it lowers the average cost per key when many keys are attacked at once.

Padding: the envelope around the message

Raw, or "textbook", RSA has mathematical structure that attackers can exploit. So before signing, the message hash is wrapped in padding, a fixed format that fills the block and makes the arithmetic safe. PKCS#1 v1.5 is an old and still widely used format. A newer one, PSS, adds randomness.

Picture sending a cheque in a sealed, printed envelope rather than a postcard. The envelope hides structure and makes tampering obvious. The forgery results this year show that the older envelope gives less protection than assumed when an attacker can influence part of what gets signed and can ask a system to sign many times. That is why systems that sign data on request, such as HSMs, blind-signature services and APIs, are the main concern.

The message is calm but firm. According to DeepMind, 2048-bit keys are not affected by these results. But each result shaves a margin off old assumptions, and AI is speeding up the shaving.

What it means in practice

Patch windows are shrinking. If models can weaponise kernel flaws at the scale OpenAI describes, the gap between disclosure and exploitation will narrow, and a monthly patch cycle may be too slow. The Next Web cites Chris Hughes as saying fewer than 25% of flaws in OpenAI's "Patch the Planet" effort had been fixed so far. Finding bugs is becoming cheaper than fixing them, and fixing is now the bottleneck.

Upstream maintainers will be flooded. Expect more machine-generated reports, and projects asking for working proofs and patches before they triage.

Legacy cryptography is a live risk again. Old keys in DNSSEC, DKIM email signing, embedded devices and internal certificate authorities are now worth an inventory, not a shrug.

Your own AI use needs a scope. If your team uses GPT-6 or any other frontier model for code review or testing, the agent can act on systems. Scope limits, logs and approval steps are what stop an over-eager agent from scanning production. The same care you apply to prompt injection defence applies here, because a malicious file in a repository can try to steer a reviewing agent.

Defenders can use this too. General models and coding agents already do useful first-pass security review on pull requests, especially with fuzzing and static analysis. The shift toward agentic AI cuts both ways.

What to do now

Measure your patch latency. Record the days from vendor fix to deployment for your kernel, browser and main dependencies. Set a target for critical fixes, measured in days rather than weeks, and track it.
Inventory RSA keys under 2048 bits. Search certificates, SSH host keys, DKIM selectors, DNSSEC keys, code-signing keys, HSM partitions and device firmware. Replace any 1024-bit keys and schedule retirement dates for all of them.
Prefer PSS or elliptic-curve signatures for new systems. Where you must keep PKCS#1 v1.5, make sure no service signs attacker-influenced data on demand without rate limits and logging.
Plan the post-quantum move at the same time. While retiring 1024-bit RSA, map every place you use RSA so the later migration is planned.
Add AI review to your pull request pipeline. Let a coding agent flag risky patterns and explain each one; a human confirms. Treat its output as a lead, not a verdict.
Pair AI review with fuzzing for parsers. Any code that parses files or network input should have fuzz targets. Let an agent draft the harnesses, and run them continuously in CI.
Set guardrails for internal security agents. Give each agent an explicit scope (hosts, repositories, actions), run it in an isolated environment, log every tool call, and require approval for anything that touches production. Red teaming your own agents before rollout is cheap insurance.
Evaluate before you trust. Test whether a model finds known bugs from your own history, and repeat when you change models. A small evaluation set beats vendor benchmarks.

Risks and open questions

The numbers are vendor claims. OpenAI's Firefox and Linux figures, its scope-adherence rates and its benchmark scores come from the company and have not been independently verified. Mozilla's fixes confirm that some flaws were real, but not the full counts.

The DeepMind work is not peer reviewed. The size of the improvement has so far been stated only by DeepMind itself. Cryptographers will scrutinise both papers over the coming weeks, and estimates of this kind often move.

Tencent's claims await evidence. The weights and safety report are not yet public. Until they are, outsiders cannot check how well the filtering worked, or whether it also reduced defensive skill.

Staged access has a shelf life. Restricting one model buys time only until similar capability appears elsewhere.

Scope adherence is not perfect. At 99.93%, an agent running thousands of actions will still make some out-of-scope moves unless the environment blocks them.

What to watch next: independent analysis of the DeepMind papers, Tencent's safety report, how fast Linux and Firefox fixes ship, and whether other labs publish comparable cyber evaluations in their model cards.

Frequently asked questions

Can anyone use GPT-6 Cyber?

No. OpenAI says GPT-6 Cyber is available only to select approved customers in its Daybreak Red programme, through the API and Codex. The company says access will expand to all Daybreak Red customers over the coming weeks. Defensive work such as code review is served through the separate Daybreak Blue tier.

Is my 2048-bit RSA key broken?

No. Google DeepMind and Pushmeet Kohli both stated that the results do not affect RSA 2048 or larger keys. The weaknesses concern legacy 1024-bit RSA, and the signature attack applies mainly where an attacker can make a system sign data they partly control. Still, plan to retire RSA over time as part of a post-quantum migration.

What does a "Critical" Preparedness rating mean?

OpenAI's Preparedness Framework grades models on risk areas such as cybersecurity. "Critical" is the highest level on its scale and signals that the company believes the model's capability could cause severe harm if misused. GPT-5.6 Cyber was rated "High". The rating is why OpenAI restricts access rather than releasing the model generally.

Does filtering training data really make a model safe?

It reduces some risk but is not a guarantee. Offensive and defensive skills overlap, and others may fine-tune an open model to restore what was removed. Tencent's forthcoming safety report should show how it measured the effect.

Should I let an AI agent test my own systems?

Yes, if you control the environment. Give it a written scope, isolate it from production, log every action and require human approval for anything risky. Start with code review and fuzzing in CI.

Summary

OpenAI limited GPT-6 Cyber, which it says found 81 previously unknown high-severity Firefox flaws and built exploits for 948 Linux kernel vulnerabilities, to approved Daybreak Red customers. Tencent released Hy4 without offensive security training data, with weights and a safety report to follow. Google DeepMind's human-guided agents found two weaknesses in legacy 1024-bit RSA, with 2048-bit keys unaffected. AI is making both finding and exploiting flaws faster. For engineering teams, the response is practical: shorten patch cycles, retire 1024-bit keys, add AI review and fuzzing to your pipeline, and put hard limits around any security agent you run.

GPT-6 Cyber, Tencent Hy4 and DeepMind's RSA work on AI bug hunting