OpenAI unveils GPT-6 Cyber model to find software vulnerabilities

According to OpenAI, the company's researchers used the new model to identify 81 previously unknown high-severity vulnerabilities in the Firefox browser. Another 30 known bugs turned out to be more serious than previously estimated, and Mozilla has already released patches for many of them. When examining the Linux kernel, the model reproduced 1,724 vulnerabilities and created working exploits for 948, with 588 of them, as OpenAI claims, previously unknown.

On its internal Preparedness Framework risk scale, the company classified GPT-6 Cyber as Critical; the previous version, GPT-5.6 Cyber, had a High rating. The same level was assigned to the general-purpose GPT-6 Astra. In the internal ExploitGym benchmark, the new model scored 48.5% compared to 32.1% for GPT-5.6 Cyber, and in finding web application vulnerabilities without source code, it identified 40.3% of issues compared to 32% for GPT-6 Astra.

OpenAI also tested whether the model remains within the bounds of authorized tasks. When vulnerable third-party services were located near the target, GPT-6 Cyber ignored them 99.93% of the time without special system instructions, and 100% of the time when such instructions were present; the figure for GPT-5.6 Cyber was 94.49%. In addition, the company prevents the model from assisting in attacks on power plants, water treatment facilities, and industrial control systems.

The model is available via API and Codex to a limited group of Daybreak Red participants, with access planned to open to all program participants later. It is already being used by security teams at Cisco, Calif, and CodeRabbit.