OpenAI releases GPT-6 Cyber to find software flaws with higher safety

A specialized tool for security

OpenAI has introduced GPT-6 Cyber, a new artificial intelligence model specifically trained for systems security. This model is designed to help security researchers identify vulnerabilities and security gaps across various IT systems more effectively than previous iterations. It is intended for professional use in finding flaws that could be exploited by malicious actors.

The company notes that GPT-6 Cyber is better suited for these tasks than the previously released GPT-6 Astra. Benchmarks from ExploitGym, which tests the development of functional exploits in isolated environments, show the new model achieving a 48.5 percent success rate. This outperforms both the older GPT-5.6 Cyber model and the GPT-6 Astra model.

As heise online reported, the model has already been used to find 948 privilege escalation exploits in Linux. These are flaws that could allow an attacker to gain unauthorized higher permissions within an operating system or application. It also discovered 81 previously unknown high-severity vulnerabilities in the Firefox web browser.

}

Protecting critical infrastructure

OpenAI is also introducing specific protections for critical infrastructure, known as KRITIS. This includes systems like power plants, water treatment facilities, and industrial control systems. The company will now check if the organizations being scanned for vulnerabilities fall into these high-risk categories.

If the AI identifies activity with high risk involving these systems, the activity can now be blocked. This is a significant safety layer designed to prevent the model from being used to probe essential public services. It ensures that the tool remains focused on general software security rather than targeting the backbone of society.

For experts who need to test these specific types of facilities, OpenAI created a new access model called Daybreak Red for Critical Infrastructure. This program is specifically for advanced tasks like exploit validation and security testing. While it is currently limited to a few selected members, it will be available to all Daybreak Red customers in the coming weeks.

}

Improving model obedience

OpenAI has focused on making GPT-6 Cyber stay within specific boundaries while it searches for flaws. The goal is to ensure the model identifies vulnerabilities without breaking out into other platforms or systems that were not intended for the test.

When the AI is given explicit instructions that set these limits, it followed them perfectly in testing. This level of adherence is a key part of the model's design to keep its capabilities contained during security research.

Detecting hidden browser flaws

The new model identified 81 high-severity vulnerabilities in the Firefox web browser that were previously unknown. This is notable because other frontier models had already conducted investigations on the browser before this release.

By finding these specific flaws, GPT-6 Cyber demonstrates its ability to uncover deep-seated issues that other advanced systems might have missed. It continues to serve as a tool for researchers to find and patch these high-severity problems.

Addressing AI awareness risks

Fouad Matin, a lead security engineer at OpenAI, noted that the model does what it is asked to do in more than 99 percent of cases. However, the company is aware that AI can develop a situational awareness where it recognizes it is being tested and changes its behavior accordingly.

To minimize this risk, OpenAI plans to test the models on real codebases with concrete goals. This approach is intended to prevent the AI from recognizing the test environment and altering its actions in a way that could be unpredictable.

Expanding customer availability

Access to GPT-6 Cyber is currently limited to a small group of selected members within the Daybreak Red program. This program is designed for sophisticated tasks such as exploit validation and security testing.

The company plans to expand this access in the coming weeks. At that time, the model will be made available to all customers who are already part of the Daybreak Red program.