GPT-6 Cyber: OpenAI Unveils AI Powerhouse to Hunt and Fix Security Flaws
OpenAI unveils GPT-6 Cyber, a powerful AI model that finds high-severity flaws in Firefox and Linux to help security teams fix vulnerabilities.
OpenAI has officially entered the frontlines of digital defense with the launch of GPT-6 Cyber, a specialized cybersecurity model engineered to hunt for software weaknesses, test them, and provide the necessary patches to fix them. This new tool represents a significant leap in security research, offering enhanced reliability and a far greater capacity to identify vulnerabilities while adhering to strict researcher-defined boundaries.
Devastating Results: Firefox and Linux Under the Microscope
The capabilities of GPT-6 Cyber were put to the test against some of the world's most widely used software, and the results were startling. In a deep dive into the Firefox browser, the model discovered 81 previously unknown vulnerabilities, all of which were classified as "high severity" by Mozilla. Beyond finding new flaws, the AI also identified 30 existing issues that were far more dangerous than originally thought.
OpenAI didn't just find the holes; they provided Mozilla with reproducible tests and proposed patches, which the browser company began implementing immediately.
The model's performance on the Linux kernel was even more aggressive. GPT-6 Cyber successfully reproduced 1,724 vulnerabilities and developed working exploits for 948 of them. To put this in perspective, the previous GPT-5.6 Sol model managed to exploit only 166 vulnerabilities using the same system—meaning the new model is more than five times more effective.
By the Numbers: A Massive Leap in Performance
OpenAI provided several benchmarks to showcase the technical superiority of GPT-6 Cyber over its predecessors:
- ExploitGym Benchmark: GPT-6 Cyber scored 48.5%, a 51% relative improvement over GPT-5.6 Cyber's 32.1%.
- Web Penetration Testing: It achieved a recall score of 40.3%, surpassing GPT-6 Astra's 32%.
- RemoteExploitBench: The model completed 95% of its tasks. In contrast, GPT-6 Astra with Daybreak Blue refused every single task in this test.
The Safety Tightrope: Power vs. Misuse
With great power comes significant risk. Because GPT-6 Cyber is so adept at finding exploits, OpenAI has classified it as "Critical" under its Preparedness Framework, a step up from the "High" classification of GPT-5.6 Cyber.
The potential for misuse was highlighted during evaluations by Dragos, a global provider of operational technology cybersecurity. In a controlled mock power plant lab, GPT-6 Cyber found two unknown vulnerabilities in engineering software used for protective relay data. If exploited, these flaws could expose critical circuit-breaker trip logic and protection settings.
In response, OpenAI has implemented rigorous safeguards, including:
- Cyber-specific and threat monitoring.
- Sandboxing and human oversight.
- Additional protections specifically for critical infrastructure.
The company also noted a high success rate in keeping the AI within authorized limits, avoiding out-of-scope services in 100% of tests when a deployment prompt was used.
Rollout and the $1 Billion Grant
GPT-6 Cyber is not being released to the general public immediately. It is currently available via API and Codex to a selected group of approved Daybreak Red customers—a tier designed for authorized testing and advanced exploit development. Meanwhile, Daybreak Blue focuses on validating those vulnerabilities and creating fixes.
To ensure that these powerful tools don't only benefit the wealthiest corporations, OpenAI announced a massive USD 1 billion Daybreak grant programme. This initiative is aimed at supporting frontline cybersecurity defenders and organizations with limited resources, including essential service providers and government bodies. Additionally, a dedicated subgroup has been created for approved defenders of critical infrastructure to conduct authorized security testing.