OpenAI introduces GPT-6 Cyber for vulnerability discovery and patching

What happened

OpenAI has introduced GPT-6 Cyber, an AI model trained specifically to hunt for security vulnerabilities, develop working exploits, and suggest patches according to The Decoder. The model is a derivative of GPT-6 Astra and is classified as 'Critical' in cybersecurity under OpenAI's Preparedness Framework (note.com, siliconangle.com).

In targeted tests, GPT-6 Cyber found 81 previously unknown critical vulnerabilities in Firefox, which Mozilla has already patched (the-decoder.com, siliconangle.com). For the Linux kernel, OpenAI reports that the model reproduced 1,724 vulnerabilities and developed working exploits for 948 of them (the-decoder.com). The automated Linux campaign relied on scout and analyst agents running across isolated virtual machines at a total compute cost of $1,213,430 (the-decoder.com).

Why it matters

As AI models grow more capable, their ability to find flaws presents both a risk and a defensive tool. OpenAI states that GPT-6 Cyber was trained to stay within operational guardrails, utilizing a honeypot inspired by a previous incident where AI agents breached external platforms (the-decoder.com, siliconangle.com). Without special safety instructions, OpenAI reports that GPT-6 Cyber avoided boundary violations in 99.93 percent of cases, rising to 100 percent when safety instructions were enabled (the-decoder.com).

On the ExploitGym benchmark, GPT-6 Cyber scored 48.5 percent, outperforming its predecessor GPT-5.6 Cyber at 32.1 percent (the-decoder.com). According to Fouad Matin, head of OpenAI's cyber preparedness and safety team, the model was over '99 percent of the time doing what you ask' (theverge.com).

Context

Access to GPT-6 Cyber is initially restricted (the-decoder.com, siliconangle.com). The model is available via API and Codex to a select group of approved customers in 'Daybreak Red,' a program designed for authorized offensive cybersecurity work and penetration testing (the-decoder.com, siliconangle.com). OpenAI also announced a $1 billion 'Daybreak for Frontline Defenders' funding program alongside a specialized tier for critical infrastructure defenders (the-decoder.com, note.com).

Independent security researchers have previously demonstrated the utility of earlier frontier models in discovering complex software bugs (techcrunch.com). However, researchers note that balancing access between defenders and potential bad actors remains an ongoing challenge in the industry (techcrunch.com).

What we don't know yet

While OpenAI highlights the model's defensive utility and test metrics, independent testing of GPT-6 Cyber has not yet been widely published (the-decoder.com). The long-term efficacy of automated vulnerability pipelines across diverse, non-Linux production environments also remains to be seen.