OpenAI launches GPT-6 Cyber to find software vulnerabilities

A tool for proactive defense

OpenAI has introduced GPT-6 Cyber, a specialized AI model built to assist security researchers in finding and fixing software vulnerabilities. The company designed this model to help identify flaws and test how they might be exploited before malicious actors can use them. By identifying these weaknesses early, the tool aims to help developers create patches more quickly.

The model is part of a broader effort to counter the increasing misuse of artificial intelligence in cyberattacks. OpenAI has classified GPT-6 Cyber as "Critical" within its internal safety framework for cybersecurity. This classification highlights the model's power to interact with sensitive security infrastructure and the importance of its controlled deployment.

Currently, access to the model is limited to a specific group of vetted Daybreak Red customers. These users can access the tool through the API and Codex, though OpenAI plans to make it more broadly available in the future. The goal is to provide security research tools to a wide range of organizations, from large enterprises to independent software maintainers.

Real-world security impacts

The model has already been put to work on significant real-world software systems. According to the announcement, GPT-6 Cyber was used to find 81 previously unknown high-severity vulnerabilities in the Mozilla Firefox web browser. OpenAI shared these findings with Mozilla, which subsequently released patches to address many of the discovered issues.

In addition to browser flaws, the model was used to develop 948 privilege escalation exploits in Linux. Privilege escalation refers to a type of attack where a user gains higher-level permissions than they were originally granted. These findings help security teams understand how systems could be compromised and what specific paths an attacker might take.

Several organizations are already utilizing the technology for their internal security operations. Companies such as Calif, Cisco, and CodeRabbit are using GPT-6 Cyber for code reviews and vulnerability research. These teams use the model to scan their own software for bugs and ensure that their systems remain resilient against potential threats.

Benchmarks and performance

OpenAI reports that GPT-6 Cyber shows significant improvements over its predecessor in independent testing. On the ExploitGym test, which measures a model's ability to exploit specific vulnerabilities, GPT-6 Cyber achieved a score of 48.5%. This is a notable increase from the 32.1% score recorded by the previous GPT-5.6 Cyber model.

Beyond raw performance, the company emphasized the model's ability to stay within specific safety boundaries. In alignment evaluations, the model remained within authorized task limits in 99.93% of tests that did not include deployment prompts. When deployment prompts were included, the model stayed within its boundaries 100% of the time.

These results are intended to demonstrate that the model can perform complex security tasks without deviating into unauthorized actions. OpenAI researchers have also used the model to reinforce their own infrastructure. During red-teaming exercises, which involve simulated attacks to find weaknesses, the model helped lead to new software patches and tighter security controls.

Safety and oversight measures

Because the model is capable of uncovering significant security vulnerabilities, OpenAI has introduced several layers of protection. The company stated that as models become more capable, they are seeing more attempts to use them for harmful purposes. To mitigate this, they have implemented strengthened safeguards alongside the release of GPT-6 Cyber.

These safeguards include misalignment monitoring to ensure the AI follows its intended instructions. The company also uses IP allowlisting, which restricts access to the model to specific, trusted internet addresses. Additionally, they have put protections in place against high-risk cyber assistance to prevent the tool from being used for malicious activities.

The release is part of the Daybreak initiative, which provides subsidized access for frontline defenders. This initiative is designed to support security operations for a variety of users. By providing these tools to those defending systems, OpenAI hopes to balance the capabilities of the AI with the need for a secure internet environment.

The broader AI landscape

The launch of GPT-6 Cyber arrives during a period of significant transition for OpenAI and the wider technology sector. Earlier this month, the company lowered its target for its current funding round by $10bn. This move occurred as technology stocks experienced a downturn and investors expressed growing concerns over the high costs of AI spending.

Despite these financial pressures, OpenAI continues to develop specialized models that address specific industrial needs. The move toward specialized tools like GPT-6 Cyber suggests a focus on practical applications for security and infrastructure. This strategy aims to provide tangible value to enterprise clients who require high-level security and reliability.

As the technology matures, the focus will likely shift toward how these tools are integrated into standard development workflows. Security teams will need to balance the speed of AI-driven discovery with the need for human oversight. The success of GPT-6 Cyber will depend on its ability to help defenders stay ahead of increasingly sophisticated automated threats.