OpenAI has launched GPT-6 Cyber a specialized AI model that can find software bugs, test if they can be exploited and help security researchers fix them. The launch is a big step forward in AI-assisted cybersecurity as companies start to see how advanced models can strengthen digital infrastructure against sophisticated cyber threats.
It is specifically trained for authorised cybersecurity work (vulnerability research, exploit development, web application testing). OpenAI says GPT-6 Cyber can find weaknesses in complex software systems and help security teams validate threats before malicious actors do so.
Unlike a general-purpose AI assistant, GPT-6 Cyber is not available to anyone but approved cybersecurity professionals and organisations through a restricted access programme.
GPT-6 Cyber Identifies Hundreds of Security Vulnerabilities
OpenAI says its researchers have already used GPT-6 Cyber to find previously unknown vulnerabilities in widely used software.
In a security research campaign for Mozilla Firefox the model helped find 81 previously unknown vulnerabilities that Mozilla reported as high severity. It also helped researchers discover another 30 known issues were more serious than reported before.
The research team gave Mozilla the findings and patches it had proposed for several of the vulnerabilities. Mozilla started releasing fixes for some of them.
The model was also tested against Linux kernel vulnerabilities. OpenAI said GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 of them “more than five times as many exploits were developed using the same research setup as our previous GPT-5.6 Cyber model”.
These results show how AI could help security researchers investigate complex software, reproduce weaknesses and prepare potential fixes more quickly.
Major Improvement in Cybersecurity Benchmarks
OpenAI says GPT-6 Cyber performs much better than its predecessor GPT-5.6 Cyber in several cybersecurity evaluations.
On the ExploitGym benchmark (which measures how well a model can exploit a given vulnerability in a remote target), GPT-6 Cyber scored 48.5% compared to 32.1% for GPT-5.6 Cyber.
The model also scored 40.3% recall in a web penetration testing evaluation compared to 32% for GPT-6 Astra.
OpenAI has listed GPT-6 Cyber as Critical in cybersecurity under their Preparedness Framework that’s the company’s highest capability designation for cybersecurity and reflects the model’s ability to do increasingly complex security tasks.
However stronger cybersecurity capabilities also pose risks if the technology is used without proper authorisation or safeguards.
OpenAI Introduces Restrictions to Prevent Misuse
One of the major challenges with advanced cybersecurity AI is that models have to be kept within the boundaries of authorised testing.
A model that could find vulnerabilities and write working exploits could also be used to attack systems without permission.
OpenAI says GPT-6 Cyber has been trained specifically to follow security researchers’ instructions, respect testing boundaries and not do anything outside of an authorized scope.
In one evaluation the model avoided exploiting services outside the testing scope in 99.93% of cases without deployment safety prompts, and in all tested cases with those prompts.
The company has also put in additional monitoring and safeguards to catch harmful activity (access controls, account security requirements, IP allowlisting for API access etc.) as well as protections against high-risk assistance (critical infrastructure).
OpenAI recommends security teams use isolated testing environments, sandboxing and human oversight when doing high risk cybersecurity work.
GPT-6 Cyber Access Limited to Approved Security Professionals
OpenAI is initially making GPT-6 Cyber available through its API and Codex to a group of approved Daybreak Red customers.
Access is not available to the general public. Organisations wanting access need to meet security requirements and individuals applying for access need identity verification and professional suitability checks.
The company is gradually expanding access to more Daybreak Red customers. It’s also expanding access to Daybreak Blue — a separate programme that supports authorised defensive cybersecurity work (GPT-6 Astra).
OpenAI is also funding its Daybreak initiative to help security teams, independent researchers and open source maintainers use AI capabilities in advanced ways to enhance software security.
What GPT-6 Cyber Means for the Future of Cybersecurity
The launch signals the growing role of AI in finding and fixing software vulnerabilities.
Traditionally security researchers have had to inspect codebases manually, reproduce software errors and work out how weaknesses could be exploited. AI models at an advanced level would speed some of this up by analysing code, testing attack paths and suggesting patches.
But those same capabilities could also lower the technical barriers for malicious actors trying to find and exploit vulnerabilities.
This is a growing problem for businesses, governments and software developers security teams need to be able to spot weaknesses fast enough to stay ahead of potential attackers.
GPT-6 Cyber is OpenAI’s attempt to direct increasing amounts of power into authorized security research and cyber defence. How effective it will be ultimately will not only depend on how many vulnerabilities it can find but also how reliably organisations verify findings, deploy fixes and prevent misuse.
Comments