OpenAI Launches GPT-6 Cyber Model to Identify Software Vulnerabilities and Develop Fixes

OpenAI has launched GPT-6 Cyber, a new cybersecurity model designed to identify software security weaknesses, develop ways to test them, and help security teams fix vulnerabilities. According to the company, the model identified 81 previously unknown high-severity vulnerabilities in the Firefox browser and developed working exploits for 948 vulnerabilities in the Linux kernel.

Mozilla classified the 81 Firefox vulnerabilities as high severity after OpenAI shared evidence, reproducible tests, and proposed patches. Mozilla began incorporating fixes shortly after receiving the reports. Additionally, the model identified 30 known Firefox issues that were more severe than previously reported. In Linux kernel testing, GPT-6 Cyber reproduced 1,724 vulnerabilities and created working exploits for 948 of them, which OpenAI noted was more than five times the 166 vulnerabilities exploited by its earlier GPT-5.6 Sol model.

The company disclosed 304 critical findings to maintainers along with candidate patches. On benchmarking tests, GPT-6 Cyber scored 48.5 per cent on the ExploitGym benchmark compared to 32.1 per cent for GPT-5.6 Cyber. On a new web penetration testing benchmark, it recorded a recall score of 40.3 per cent. Furthermore, in RemoteExploitBench, the model completed 95 per cent of the tasks.

OpenAI reported improvements in keeping the model within authorised testing limits, avoiding exploits outside the approved scope in 99.93 per cent of tests without a deployment prompt and 100 per cent with the prompt. The company has classified GPT-6 Cyber as 'Critical' under its Preparedness Framework, moving up from the 'High' classification given to its predecessor.

The capabilities also introduced potential misuse concerns. Dragos evaluated the model using cyber-permissive Daybreak Red models in a mock power plant laboratory. The model identified two previously unknown vulnerabilities in engineering software used to manage protective relay data, which could expose protection settings and circuit-breaker trip logic. OpenAI stated it refined its safeguards following the testing and introduced cyber-specific monitoring, threat monitoring, sandboxing, and human oversight.

GPT-6 Cyber is initially available through OpenAI's API and Codex to selected approved Daybreak Red customers, with access expected to expand gradually. Alongside the launch, OpenAI announced a USD 1 billion Daybreak grant programme for frontline cybersecurity defenders, organisations with limited resources, government bodies, and essential service providers, alongside a separate subgroup for approved critical infrastructure defenders.

"The release of advanced AI security models like GPT-6 Cyber marks a significant shift in how vulnerabilities are discovered and patched. While automated identification of software flaws can greatly enhance defensive capabilities for enterprises and critical infrastructure, it also highlights the urgent need for strict guardrails, human oversight, and robust security frameworks to prevent potential misuse. Businesses must proactively adapt their security strategies as AI tools become more powerful in handling complex technical systems." — Dr. Shishir Gupta, Founder & CEO, StartupLanes