OpenAI says its AI found 81 Firefox flaws: update your phone

If AI can find dozens of holes at a time in the programs we use every day, the person who has to move first is the phone owner, not the programmer, because a fix reaches our device only when we tap update ourselves.

That is the problem OpenAI is trying to solve with GPT-6 Cyber, an AI model trained specifically to hunt for flaws in software, The Decoder reported. OpenAI announced the model on Thursday, 5 November 2026, and said it found 81 previously unknown severe flaws in Firefox, Mozilla's browser.

A flaw an AI finds can be closed only when we tap update

A flaw is a weak spot in code that a criminal can use to get into our device. Think of a front door that does not lock properly. An update is the repairman who comes to fix it, but he can fix our door only if we let him into the house. Even when the maker has a fix, a device that has not updated still has the loose door.

BleepingComputer reported that Mozilla has released fixes for many of the flaws, and Brian Grinstead, a distinguished engineer at Firefox, told Help Net Security that the model helped get fixes to millions of users. But the figure of 81 comes from OpenAI itself, and outsiders have not tested it. Mozilla's security advisory 2026-118 for Firefox 159 credits OpenAI for 41 of the 167 flaws it fixed but does not mention GPT-6 Cyber, so the 81 cannot yet be matched to it. Anyone who uses Firefox should be on version 159 or later.

The good news is that the model is not open to the public. OpenAI offers it only to approved customers in its Daybreak Red programme, which is for authorised security testing, through the API and Codex. The point to remember is that The Decoder's article says the model can both break into systems and propose fixes. As tools like this get faster, the list of weak spots to close grows longer, and the riskiest stretch is the gap between the day a fix is made and the day our device updates.

Over 6 in 10 Thais see cyber threats as a national risk

The Suan Dusit Poll asked 1,183 people across the country between 3 and 6 November 2026 which risks Thailand could face. A total of 62.55% chose cyber threats, which the poll describes as including banking or mobile payment failures and data breaches, the top answer and just ahead of essential services going down at 62.05%. People could choose more than one answer, Nation Thailand reported.

The real numbers point the same way. Nation Thailand presented figures from the National Cyber Security Agency (NCSA) showing that cyber incidents from January to September rose from about 2,000 in 2023 to more than 3,000 in 2026.

Tonight, update your phone and browser first

If you use an iPhone, open Settings, tap General, then tap Software Update. If a new version is there, tap Download and Install. Then go to Automatic Updates and switch on installing by itself overnight while charging on Wi-Fi, following Apple's help page. If you use Android, follow the Android help page that we summarised in our SMS of Death story: look at the date in the Android security update field, and if it is older than the latest month, go to System and tap Software updates.

The browser is another step people forget. In Chrome on a computer, click More, then Help, then About Google Chrome. If a Relaunch button appears, click it. If there is no such button, you already have the latest version, according to Chrome's help page, and Chrome reopens your tabs for you. If you use Firefox, open the Help menu and choose About Firefox to check that you are on version 159 or later.

Switch on two-step login and delete apps you do not use

Two-step login (2-Step Verification) means that after you type your password you must confirm one more thing, such as a code or a prompt on your phone. Even if a criminal gets your password, they still cannot get in. Do it for your email first, because email is often the key used to reset the passwords of your other apps. If you use Gmail, go to myaccount.google.com, choose Security & sign-in, and tap Turn on 2-Step Verification, following Google's help page. Then switch on the extra sign-in check in your banking apps and LINE, wherever the app offers it, in each app's security settings.

Two more steps take little time. Delete apps you have not opened in a long while, because every app is code that someone has to update, and an app we do not use often does not get updated. And never install an app from a link someone sent you. The Bank of Thailand (BOT) advises against downloading apps from outside sources that the system maker controls and certifies, such as the App Store and Google Play, and against installing apps from links that people send. An update closes holes that are already known, but it cannot stop someone tricking you into installing something yourself. Do it tonight, 9 November, and check your parents' phones too.

Sources

• The Decoder: OpenAI's GPT-6 Cyber can both break into systems and propose how to fix them
• BleepingComputer: OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs
• Help Net Security: OpenAI's GPT-6 Cyber found 81 Firefox flaws
• Mozilla: Security Vulnerabilities fixed in Firefox 159 (MFSA 2026-118)
• Nation Thailand: Suan Dusit Poll on risks Thailand could face
• Nation Thailand: Thailand cyber incidents rise
• Apple Support: Update your iPhone or iPad
• Google Chrome Help: Update Google Chrome
• Google Account Help: Turn on 2-Step Verification
• Android Help: Check and update your Android version
• Bank of Thailand: progress on measures against financial fraud