OpenAI releases GPT-6 Cyber tool for professional penetration testing

A new tool for offensive security

OpenAI recently introduced a specialized artificial intelligence model called GPT-6 Cyber. This tool is specifically engineered to perform hacking tasks, such as identifying software flaws and executing real cyberattacks. It represents a significant escalation in the capabilities of AI for cybersecurity operations.

The model was officially launched on November 5, 2026. Unlike standard consumer versions of ChatGPT, this software is not available to the general public. It is designed for professional use by security experts who need to test the defenses of complex digital systems.

As ARYnews.tv reported, OpenAI's internal safety team categorized the model as a Critical cybersecurity risk. This is the highest possible rating in their internal system, reflecting the model's ability to perform sophisticated and potentially dangerous actions.

Restricted access and safety guardrails

Because of its high risk level, OpenAI has implemented strict controls on who can use GPT-6 Cyber. Access is limited to a select group of approved security teams participating in the Daybreak Red program. These teams can only interact with the model through the API and Codex, which are the underlying frameworks for OpenAI's software.

The company uses several layers of protection to ensure the tool is used responsibly. These measures include IP allowlists, which restrict access to specific internet addresses, and constant monitoring of accounts to detect and block stolen credentials. These steps are necessary because of the model's high performance in offensive tasks.

OpenAI also programmed specific blocks into the system to prevent misuse against essential services. The model is prohibited from targeting power plants, water treatment facilities, or industrial control systems. These restrictions are intended to protect critical infrastructure from being compromised by AI-driven attacks.

Benchmark performance and results

The capabilities of GPT-6 Cyber were measured using the ExploitGym benchmark. In these tests, the AI attempted to exploit real software flaws remotely. The model succeeded in 48.5 percent of its assigned attacks, which is a notable increase from the 32.1 percent success rate of the previous GPT-5.6 Cyber model.

Despite its high success rate, OpenAI noted that the model stayed within its allowed safety limits in 99.93 percent of the tests. The company did not provide specific details regarding the small number of instances where the model failed to stay within those limits. This data underscores the ongoing challenge of balancing AI utility with safety.

The performance of the model demonstrates how quickly AI can navigate complex software environments. By automating the process of finding and exploiting vulnerabilities, the tool allows security professionals to test systems at a scale that was previously difficult to achieve manually.

Impact on web browsers and kernels

OpenAI researchers have already put the model to work on major pieces of software. They used GPT-6 Cyber to scan the Firefox web browser and identified 81 new high-severity flaws. This work led to 41 specific fixes being included in the latest Firefox 159 update, with Mozilla crediting OpenAI for the discovery.

The tool also performed extensive testing on the Linux kernel, which is the core part of the operating system for many servers and devices. The AI reproduced 1,724 vulnerabilities during this process. This is a massive amount of data for developers to process and address in a relatively short period.

From these findings, OpenAI submitted 304 critical findings and software patches to the Linux maintainers. This means that developers will be working to integrate these fixes into the operating system soon. Users can expect to see many updates as these security patches are rolled out to the public.

The future of automated patching

The deployment of GPT-6 Cyber signals a transition toward a more automated cycle of vulnerability discovery and repair. As AI becomes better at finding bugs, the window of time for hackers to exploit those flaws may shrink. This creates a faster pace for software development where updates must be released more frequently.

For the broader tech industry, this means that security testing will likely become more rigorous. Companies will need to defend against AI-driven tools that can scan their code for weaknesses with high precision. The tool serves as both a threat and a means for better defense, depending on who holds the keys.

Moving forward, the focus will likely shift to how these tools can be integrated into standard development workflows. If the model can find and patch flaws as efficiently as it currently does in test environments, it could fundamentally change how software is secured against cyber threats.