OpenAI unveils GPT-6 Cyber, an AI model built to find software security flaws

Vulnerability-exploitation success rate hits 48.5%, up 16 percentage points from previous model

Model used in Firefox, Linux security research

Rolling out first to select Daybreak Red customers

An introductory image for OpenAI's new AI model GPT-6 Cyber [Provided by OpenAI]

OpenAI has unveiled GPT-6 Cyber, an AI model designed to detect software security vulnerabilities and verify whether they can be exploited in practice. The model identified 81 previously unknown high-severity security flaws in the Firefox web browser.

OpenAI announced Friday the release of GPT-6 Cyber, a cybersecurity-focused AI model with enhanced capabilities for discovering and verifying software vulnerabilities and supporting the development of security patches. A key feature is specialized training that keeps the model within task scopes and constraints approved by security researchers.

GPT-6 Cyber will initially be available via API and Codex to select approved Daybreak Red customers, with plans to expand access to all Daybreak Red customers in the future.

OpenAI highlighted the model's ability to identify vulnerabilities in large codebases and verify their real-world exploitability as key strengths, enabling it to generate patch candidates and analysis materials needed for future fixes. The company said the model is designed to help security teams find and remediate vulnerabilities before attackers can.

OpenAI researchers used GPT-6 Cyber to uncover 81 previously unknown high-severity security vulnerabilities in Firefox, the web browser developed by Mozilla. The team generated verification materials for each flaw and shared them with Mozilla, which then released fixes based on the findings.

GPT-6 Cyber achieving a 48.5% success rate on ExploitGym, a benchmark that evaluates a model's ability to exploit vulnerabilities [Provided by OpenAI]

In Linux kernel research, the model reproduced 1,724 vulnerabilities in total and developed working exploits for 948 of them. Following Linux community guidelines, OpenAI reported 304 critical findings to maintainers along with patch candidates, and work on fixes for additional vulnerabilities is ongoing.

GPT-6 Cyber also outperformed its predecessor on major cybersecurity benchmarks. On ExploitGym, which evaluates whether vulnerabilities can be exploited in practice, the model achieved a success rate of 48.5% — about 16 percentage points higher than the 32.1% recorded by GPT-5.6 Cyber. In an initial evaluation on RemoteExploitBench, which tests complex security tasks on servers simulating real-world environments, the model completed 95% of the assigned challenges.

OpenAI also strengthened the model's ability to stay within authorized task scopes. It received specialized training to adhere to approved targets and boundaries and to report results accurately, reducing the risk of a cybersecurity AI agent accessing unauthorized systems.

GPT-6 Cyber also improved over its predecessor on ExploitGym Honeypot, a benchmark that assesses whether the model attacks services outside its authorized scope. In that evaluation, GPT-6 Cyber without deployment safety prompts refrained from attacking out-of-scope services in 99.93% of cases, compared with 94.49% for GPT-5.6 Cyber.

In addition, OpenAI reinforced safeguards including monitoring to verify that the model's actions remain within the bounds of user-approved scope. The model is designed to block requests that could harm critical infrastructure or essential services while supporting approved security research and vulnerability verification.

chami@heraldcorp.com