OpenAI launches GPT-6 Cyber to find software vulnerabilities

A new tool for security

OpenAI has officially launched GPT-6 Cyber, a specialized artificial intelligence model built to assist security researchers. The primary goal of this model is to find and validate exploitable vulnerabilities within software systems. It is designed to operate strictly within the boundaries and scopes set by the human researchers using it.

The company describes the model as a major advance in security research because it pairs stronger capabilities with better alignment. This means the AI is better at following specific instructions while performing complex tasks. It aims to help teams identify weaknesses in code before they can be used by bad actors.

As Digit reported, the model has already been put to work in real-world scenarios. It has helped uncover thousands of security flaws across various widely used software platforms. This move signals a transition toward using large language models for highly technical, specialized security audits.

Testing the Firefox browser

One of the most notable successes for GPT-6 Cyber involved the Firefox web browser. The model identified 81 previously unknown high-severity vulnerabilities in the software. These flaws were significant because they could potentially be exploited to compromise user security or privacy.

Beyond just finding the problems, OpenAI stated that the model helped develop fixes for many of these issues. Mozilla, the organization behind Firefox, has already released several of these patches to the public. This collaborative approach ensures that the AI's findings lead to actual improvements in software safety.

The model also identified 30 existing issues that were more serious than researchers had originally understood. These findings were shared directly with Mozilla along with suggested fixes. This demonstrates the model's ability to analyze complex code and provide actionable technical advice to developers.

Linux kernel and benchmarks

The capabilities of GPT-6 Cyber extend deep into the infrastructure of computing. In a separate research effort, the model reproduced 1,724 Linux kernel vulnerabilities. It went a step further by developing working exploits for 948 of those specific vulnerabilities.

OpenAI shared 304 of these critical findings with Linux maintainers, including possible patches to fix the issues. The Linux kernel is the core of the operating system for many servers and devices, making these discoveries vital for global cybersecurity. This shows the model can handle some of the most complex codebases in existence.

To measure its progress, OpenAI used the ExploitGym benchmark, which tests an AI's ability to exploit known vulnerabilities. GPT-6 Cyber scored 48.5 percent on this test, a notable increase from the 32.1 percent score achieved by its predecessor, GPT-5.6 Cyber. This jump indicates a significant improvement in the model's technical reasoning.

Safety and alignment goals

A major hurdle for security AI is ensuring the model does not perform unauthorized actions. OpenAI designed GPT-6 Cyber to stay within the specific scope that researchers define. Without any extra safety instructions, the model avoided attacking services outside its assigned task in 99.93 percent of tests.

When the model was provided with specific deployment safety instructions, that success rate increased to 100 percent. This level of control is essential for researchers who need to test vulnerabilities without risking unintended damage to other systems. It allows for a more controlled environment for

Who can use the model

OpenAI is currently making GPT-6 Cyber available to a selected group of approved customers through its API and Codex. These customers are part of the Daybreak Red group, and the company plans to expand access to all Daybreak Red customers in the near future. This controlled rollout allows for monitoring how the tool is used in professional settings.

Several major technology companies are already integrating the model into their workflows. Security teams at Cisco, Palo Alto Networks, and CodeRabbit are using it for vulnerability research and code reviews. These organizations are using the AI to find bugs in their own systems and the products they sell to others.

OpenAI has also updated its internal risk assessments regarding this technology. They classified GPT-6 Cyber as Critical in cybersecurity under their Preparedness Framework. This is a step up from the High classification given to the previous GPT-5.6 Cyber model, reflecting the increased power of the new system.