OpenAI launches GPT-6 Cyber, which can find vulnerabilities, build exploits, and suggest patches

What happened

OpenAI has introduced GPT-6 Cyber, a model trained specifically to hunt for security vulnerabilities in software. According to OpenAI, it can find flaws, build working exploits, and suggest patches. It is initially available through the API and Codex to a select group of Daybreak Red customers, with access to expand gradually, while GPT-5.6 Cyber is being opened to all Daybreak Red users at the same time.

Key details

• On the ExploitGym benchmark it scores 48.5 percent versus 32.1 percent for its predecessor GPT-5.6 Cyber; on a new test for finding vulnerabilities in web apps without source-code access it hits 40.3 percent, versus 32.0 percent for GPT-6 Astra, the model without cyber training.
• On guardrails: without special safety instructions the model avoided boundary violations in 99.93 percent of cases, up from 94.49 percent for its predecessor; with safety instructions it stayed within bounds in 100 percent of tests. Training used, among other things, a honeypot inspired by the Hugging Face incident. OpenAI rates the model "Critical" in the cybersecurity category of its Preparedness Framework, the same rating as the base model GPT-6 Astra.
• Real-world results: in a targeted campaign against Firefox, the model found 81 previously unknown severe vulnerabilities and showed that 30 known issues were more severe than thought; Mozilla accepted the reports and shipped fixes. In the Linux kernel it reproduced 1,724 vulnerabilities and built working exploits for 948, more than five times the 166 achieved by GPT-5.6 Sol under the same conditions; 304 critical findings were reported to maintainers with suggested fixes.
• The kernel campaign used an automated system of scout and analyst agents: it scanned roughly 5,034 security-relevant locations (about seven percent of the codebase), filtered them to 2,308 candidates, and confirmed vulnerabilities in isolated VMs. The run cost $1,213,430 in compute, about $1,279 per exploit, while programs like Pwn2Own and TyphoonPWN have historically paid $20,000 to $70,000 per comparable finding. OpenAI says the agents used at least ten novel attack techniques previously unknown to external kernel security experts, but the article notes that how much this claim carries depends on how narrowly "own approaches" is defined; researchers still disagree on whether models make new discoveries or just recombine training data.

Why it matters

OpenAI frames this as a limited window of opportunity in which top-tier models could be used to secure software, and aims to expand the Daybreak program to organizations of all sizes, independent researchers, and open-source maintainers. At roughly $1,279 per exploit, far below traditional bounty levels, the economics of vulnerability discovery could shift considerably.

However, all benchmark numbers come from OpenAI itself, and no independent testing has been published. The article also notes that Epoch AI researchers just showed the open GLM model could have exploited known but still-unpatched Firefox vulnerabilities—meaning offensive capability is spreading beyond top closed models.

Who it affects

• Mozilla and Linux kernel maintainers, who have already received vulnerability reports and fixes produced by the model.
• Security researchers and defenders: GPT-5.6 Cyber and expanded alpha access to GPT-6 Astra are rolling out to more users; OpenAI points to its billion-dollar "Daybreak for Frontline Defenders" funding program and a new "Daybreak Red for Critical Infrastructure" subgroup for authorized testing.
• Operators of critical infrastructure—OpenAI specifically names power plants and water treatment facilities—as targets it is especially focused on protecting from abuse.
• Misuse is a stated concern: OpenAI acknowledges abuse attempts are rising as models grow more capable, with some actors trying to transfer model capabilities into their own systems. Countermeasures include checks that verify a model's actions match user permissions, targeted monitoring for newly disclosed vulnerabilities, automated safety checks via "Private Safety Processing," IP-based access restrictions for Daybreak Red, and the recommendation to run the model in isolated environments with human oversight.

OpenAI has introduced GPT-6 Cyber, an AI model trained specifically to hunt for security vulnerabilities in software.

OpenAI says the model can find flaws, build working exploits, and suggest patches. It's also supposed to stay within its assigned boundaries, something some OpenAI models have struggled with in recent months.

The firm says it trained GPT-6 Cyber to respect its operational guardrails, using, among other things, a honeypot inspired by the Hugging Face incident. Without any special safety instructions, GPT-6 Cyber avoided boundary violations in 99.93 percent of cases, up from 94.49 percent for its predecessor. With safety instructions enabled, the model stayed within bounds in 100 percent of tests. Overall, OpenAI rates GPT-6 Cyber as "Critical" in the cybersecurity category of its own Preparedness Framework, the same rating it gave to GPT-6 Astra, the "base" model.

On ExploitGym, a benchmark that tests whether a model can exploit a given vulnerability in a remote system, GPT-6 Cyber scores 48.5 percent according to OpenAI, compared to 32.1 percent for its predecessor GPT-5.6 Cyber. On a new test for finding vulnerabilities in web apps without access to source code, OpenAI reports a hit rate of 40.3 percent, versus 32.0 percent for GPT-6 Astra, the standard model without cyber training.

ExploitGym results: GPT-6 Cyber leads with 48.5 percent, followed by GPT-6 Astra (Daybreak Blue) at 42.4 percent. GPT-6 Astra with safeguards enabled scores 0.0 percent. | Image: OpenAI

Full results are available in the system card. All benchmark numbers come from OpenAI itself. No independent testing of the model has been published so far.

GPT-6 Cyber already found real vulnerabilities in Firefox and the Linux kernel

GPT-6 Cyber has already produced results in real-world security research, according to OpenAI. In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, even though the browser had already been tested with earlier AI models. The model also showed that 30 already-known issues were more severe than previously thought. Mozilla accepted the reports and has already shipped fixes.

In the Linux kernel, GPT-6 Cyber reproduced 1,724 security vulnerabilities and developed working exploits for 948 of them, more than five times the 166 that GPT-5.6 Sol managed under the same conditions, according to OpenAI. 304 critical findings were reported to Linux maintainers along with suggested fixes, the company says.

For the Linux kernel campaign, OpenAI built a dedicated automated system of scout and analyst agents. They first scanned roughly 5,034 security-relevant locations in the kernel, about seven percent of the total codebase, then filtered those down to 2,308 candidates and confirmed 1,724 vulnerabilities in isolated virtual machines. From there, the system developed the 948 working exploits that OpenAI had already reported. The entire run cost $1,213,430 in compute, according to OpenAI, which works out to $1,279 per exploit. For comparison, programs like Pwn2Own and TyphoonPWN have historically paid between $20,000 and $70,000 per comparable finding as a bounty.

The agents used at least ten novel attack techniques that were previously unknown even to external kernel security experts, OpenAI says. In OpenAI's telling, the models replicated known attack patterns but also found their own approaches. How much weight that claim carries depends on how narrowly you define "own approaches." Researchers still disagree about whether AI models can actually make new discoveries or just recombine what they've seen during training.

OpenAI limits access to selected customers for now

GPT-6 Cyber is initially available through the API and Codex for a select group of Daybreak Red customers, according to OpenAI. Access will be expanded gradually to all Daybreak Red customers. GPT-5.6 Cyber is being opened up to all Daybreak Red users at the same time, and alpha access to Daybreak Blue for GPT-6 Astra will be extended to more organizations and individual security researchers.

OpenAI acknowledges that as models grow more capable, abuse attempts are rising too. Some actors and groups have tried to transfer model capabilities into their own systems.

OpenAI lists several countermeasures: checks that verify whether a model's actions match the user's permissions, targeted monitoring for newly disclosed vulnerabilities, automated safety checks through what it calls Private Safety Processing, IP-based access restrictions for Daybreak Red, and the recommendation to run the model in isolated environments with human oversight.

OpenAI is paying special attention to protecting critical infrastructure like power plants and water treatment facilities. To make access easier for defenders, the company points to its billion-dollar "Daybreak for Frontline Defenders" funding program and a new subgroup called "Daybreak Red for Critical Infrastructure" for authorized testing.

OpenAI talks about a limited window of opportunity in which top-tier models could be used to secure software. The goal is to expand the Daybreak program to organizations of all sizes, independent researchers, and open-source maintainers. Whether that will actually work is another question. Researchers from Epoch AI just showed that the open GLM model could have exploited known but still-unpatched Firefox vulnerabilities.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now

The original belongs to The Decoder and its authors and is reproduced here for reading. To have it removed, write to support@aisa.one.