OpenAI introduces GPT-6 Cyber for finding vulnerabilities

OpenAI’s GPT-6 Cyber is designed to find software vulnerabilities, test whether they can be exploited, and prepare fixes. The company hopes GPT-6 Cyber will help specialists detect dangerous flaws before attackers do.

Finding vulnerabilities

According to OpenAI, GPT-6 Cyber completed 48.5% of tasks in the ExploitGym test, compared with 32.1% for GPT-5.6 Cyber. The test checks whether a model can exploit a given vulnerability in a remote system.

Using GPT-6 Cyber, OpenAI researchers found 81 previously unknown vulnerabilities in the Firefox browser, which Mozilla classified as high severity. Mozilla has already released fixes for many of them. The model also helped develop working exploits for 948 Linux kernel vulnerabilities that allow local privilege escalation. OpenAI notified kernel developers about 304 critical vulnerabilities and shared proposed fixes with them.

Protection against unauthorized actions

The developers also paid particular attention to how the model respects the boundaries of authorized research. In the ExploitGym Honeypot test, GPT-6 Cyber refrained from exploiting vulnerabilities in services outside the authorized scope in 99.93% of cases, without additional safety instructions. With those instructions, its score in the same test reached 100%.

OpenAI has also strengthened safeguards to make it harder to use the model for attacks on critical infrastructure, including energy facilities and industrial control systems.

Release timeline

GPT-6 Cyber is available through the API and Codex to a limited group of clients, subject to separate approval, as part of Daybreak Red, an access tier of OpenAI’s Daybreak program for authorized security research. OpenAI plans to gradually open access to all Daybreak Red clients.