OpenAI introduces GPT-6 Cyber to protect software

OpenAI has introduced GPT-6 Cyber, a model designed to find vulnerabilities, check whether they can be exploited, and help fix them without going beyond the authorized scope. The company says it has already used the model to detect flaws in projects such as Firefox and the Linux kernel.

The model brings greater capacity for offensive cybersecurity tasks, along with specific training to follow the rules of each assignment. That combination is at the center of the announcement: an AI that can attack a system in a controlled environment without starting to explore other services nobody asked it to touch.

More capacity to find and exploit flaws

In ExploitGym, a test that measures whether the model can exploit a specific vulnerability in a remote target, GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber. That is a relative improvement of 51% and roughly 16 more percentage points on the metric.

It also outperformed GPT-6 Astra in a test for finding vulnerabilities in web applications. Without access to the source code, GPT-6 Cyber identified 40.3% of the flaws, compared with 32% for Astra.

OpenAI also created RemoteExploitBench, a benchmark containing known vulnerabilities in applications such as GitLab, PostgreSQL, and Jenkins. In that controlled environment, GPT-6 Cyber completed 95% of the remote exploitation tasks evaluated. The only failure occurred because it could not get an exploit working remotely.

That level of capability has two sides. It can help a security team show that a flaw is real and fix it, but it also increases the risk if it is provided without safeguards to someone who wants to attack systems they do not own.

The model follows boundaries more effectively

One of the most important tests does not measure how much the model can attack, but how well it holds back. In the ExploitGym Honeypot evaluation, the model receives an exploitation task alongside auxiliary services that are easy to attack, such as a package registry or an object store. Those services are outside the permitted scope and act as a trap.

Without additional deployment instructions, GPT-6 Cyber avoided attacking those services in 99.93% of tests, compared with 94.49% for GPT-5.6 Cyber. With those security instructions, it respected the boundaries in 100% of the cases evaluated.

This matters to you because a useful security AI must do more than find flaws. It must also know which systems it can test, which it cannot, what actions are authorized, and how to report its findings without overstating them.

Results in Firefox and Linux

OpenAI says its researchers used GPT-6 Cyber in campaigns involving real software, always disclosing findings to maintainers and working in controlled settings.

• In Firefox, it produced evidence and reproducible tests for 81 new vulnerabilities that Mozilla classified as high severity. It also indicated that another 30 known flaws could be more serious than previously considered.
• In the Linux kernel, it reproduced 1,724 vulnerabilities and developed functional exploits for 948. OpenAI's published comparison indicates that GPT-5.6 Sol had exploited 166 using the same research system.
• Of the Linux findings, OpenAI notified maintainers of 304 critical vulnerabilities along with possible patches, while continuing to work on the rest.

The company also says it used the model to investigate flaws in its own infrastructure and identify vulnerability chains capable of escaping isolated virtual machines and executing code on host computers. According to OpenAI, those issues were fixed with patches and network restrictions.

Limited access and stronger controls

GPT-6 Cyber is initially available through the API and Codex to a small group of approved Daybreak Red customers, OpenAI's platform for advanced security research. Access will gradually expand to more customers.

OpenAI also announced several measures to limit dangerous uses:

• Dedicated monitoring to detect actions that do not match the user's authorization.
• Controls targeting emerging threats, such as attempts to create exploits against live PHP servers.
• Network restrictions and credential monitoring for access to Daybreak Red.
• Additional blocks for activities involving critical systems and industrial infrastructure.

The company says it is working with Dragos to test these protections in operational technology laboratories, such as industrial networks and control systems. The goal is to allow authorized testing without enabling actions that could cause physical harm, serious disruptions, or risks to human life.

OpenAI classifies GPT-6 Cyber as Critical in cybersecurity within its preparedness framework, above the High category assigned to GPT-5.6 Cyber. The next step will be to expand access without losing control over what the model can do. In security, finding more flaws is only an advantage if the AI also knows where its permission ends.