GPT-6 Cyber found Firefox flaws; Mozilla advisory supplies a partial independent fix trail

OpenAI's November 5 release says GPT-6 Cyber researchers identified 81 previously unknown high-severity vulnerabilities in Firefox and found evidence that 30 already-known issues deserved more serious classification. The latter 30 are not additional new discoveries. Mozilla's October 27 Firefox 159 advisory independently supplies a public remediation trail: it enumerates high-severity defects, credits OpenAI Codex Security researchers on specific CVEs and names the fixed release.

The available advisory does not map all 81 findings and 30 reclassifications to one complete public list, and individual flaws have different mechanisms and impacts. A browser use-after-free finding is not automatically a working sandbox escape, while a vendor-approved patch in Firefox 159 does not establish coverage in every ESR, Android or downstream build. These results represent authorized testing and disclosure, not evidence of exploitation against ordinary Firefox users.

The GLM-5.3 Firefox patch-gap demonstration used a different model, source and experimental chain. It is related by browser vulnerability research but not the same discovery campaign.

A checkable subset of the maintainer record makes this more than a model-provider success statistic. The Firefox 159 advisory credits Amy Burnett of OpenAI for CVE-2026-117881 (DOM Core/HTML use-after-free) and OpenAI Codex Security (kylebot) for CVE-2026-117930 (WebIDL bindings use-after-free) and CVE-2026-117931 (DOM Events use-after-free). Each entry has a Mozilla bug reference and identifies Firefox 159 as fixed. This sample is not presented as the complete 81-item inventory; it belongs to an advisory containing many researchers' findings. It also cannot establish every patch landed in every downstream release channel.

To reconcile the published count, the dataset would need a one-row-per-finding table identifying the original Mozilla bug, distinct vulnerability, whether it was new or a reassessment, reporter credit, affected component and confirmed fixed versions. Until then the 81 newly reported findings, 30 severity reclassifications and individual shipped CVEs remain three different measurements. The unrelated GLM-5.3 Firefox experiment remains linked by subject, not merged into OpenAI's disclosure campaign.