OpenAI launches GPT-6 Cyber to help researchers find security flaws

A new tool for defense

OpenAI has officially released GPT-6 Cyber, a specialized model designed to identify and exploit security flaws in software. The company is providing this tool to a small group of vetted customers who are authorized to perform security research. The goal is to help these professionals find and fix vulnerabilities before malicious actors can use them for harm.

The company is launching this model in response to a rise in attempts by malicious cyber actors to misuse artificial intelligence. OpenAI noted that these bad actors are also trying to distill its models, which involves creating smaller versions of a model by using it to generate large amounts of data. By releasing a dedicated tool, OpenAI hopes to provide a structured way for security experts to stay ahead of these threats.

As reported by economictimes.indiatimes.com, the model is intended to assist in penetration testing and exploit development. Penetration testing is a practice where security professionals simulate cyberattacks to find weaknesses in a system. This allows organizations to understand how their defenses might fail and take steps to strengthen them before a real attack occurs.

Testing the model's power

To demonstrate the capabilities of the new model, OpenAI shared specific results from its own research teams. The researchers used GPT-6 Cyber to find 81 previously unknown vulnerabilities in the Firefox web browser. Mozilla, the company behind Firefox, classified these specific flaws as high severity and has already begun releasing fixes for them.

The model also showed significant results regarding the Linux kernel, which is the core part of the operating system for many servers and devices. OpenAI stated that the tool helped develop working exploits for 948 Linux kernel vulnerabilities. This number includes 588 vulnerabilities that were previously unknown to the security community.

In addition to finding these flaws, the team used the model to disclose 304 critical Linux findings to the relevant maintainers. They also provided proposed patches, which are pieces of code designed to fix the identified problems. This proactive approach helps ensure that the underlying software remains secure for millions of users worldwide.

Safety and classification

OpenAI has updated the cybersecurity classification for GPT-6 Cyber to 'Critical' under its internal safety framework. This is an increase from the 'High' rating given to the previous GPT-5.6 Cyber model. This classification reflects the model's increased ability to perform complex security tasks and its potential impact on cybersecurity landscapes.

The company is being careful about who gets to use this specific technology. Access is currently limited to select customers of Daybreak Red, which is OpenAI's specialized access tier. This tier is reserved for advanced, authorized security work that requires a high degree of oversight and specific permissions.

OpenAI plans to expand access to all approved Daybreak Red customers over the coming weeks. During this rollout, the company is also making the earlier GPT-5.6 Cyber model available to all customers in that same tier. This ensures that a wider range of vetted professionals can begin using the technology for their security audits.

The future of AI security

The release of GPT-6 Cyber highlights a growing trend where AI is used to automate the discovery of software bugs. By identifying high-severity flaws in common tools like Firefox or the Linux kernel, the model can significantly speed up the patching process. This helps bridge the gap between the discovery of a bug and the deployment of a fix, which is often a period of high risk for users.

However, the 'Critical' rating also serves as a warning about the dual-use nature of these models. While security researchers use them to protect systems, the same capabilities could be used by malicious actors to find flaws faster. OpenAI's strategy focuses on keeping these tools in the hands of vetted professionals who follow ethical guidelines and authorized protocols.

Moving forward, the company will likely continue to monitor how these models are used and how they are being targeted by bad actors. As AI becomes more capable of understanding complex code, the battle between security researchers and cybercriminals will increasingly take place within these automated environments. The success of GPT-6 Cyber will depend on its ability to help defenders work faster than the attackers.