OpenAI Unveils GPT-6 Cyber and Rates It "Critical" on Security
OpenAI's new GPT-6 Cyber model found 81 unknown Firefox flaws and built exploits for 948 Linux kernel bugs. Access is limited to approved customers.
OpenAI has unveiled GPT-6 Cyber, a model built to hunt for software flaws. It carries a "Critical" cyber rating under the company's Preparedness Framework, and the public cannot use it yet.
Who gets the keys
Only a chosen set of customers in OpenAI's Daybreak Red program can use the model today. OpenAI says all Daybreak Red customers should get in soon. The program is meant for exploit development and approved security tests.
A sister program, Daybreak Blue, serves verified defenders. They can investigate vulnerabilities and check fixes with fewer restrictions. OpenAI also says it intends to carry both programs to organizations of all sizes, independent researchers and open-source maintainers.
A higher rating than before
The previous model sat at "High" on the same scale. This one moves to "Critical."
What the model turned up
In Firefox, it found 81 previously unknown high-severity vulnerabilities and helped write patches. Mozilla has already released many of them.
The Linux kernel work went deeper. The model flagged 2,308 potential flaws and reproduced 1,724. For 948 distinct bugs it wrote local privilege escalation exploits. In plain terms, an ordinary user could use such an exploit to gain root access.
On the ExploitGym benchmark it exploited 48.5% of vulnerabilities. GPT-5.6 Cyber managed 32.1%.
A window that may not stay open
OpenAI argues that defenders have a limited time to put ever stronger models to work before attackers get comparable tools. "It is clear that we have a limited window to use frontier models to secure software," the company said.
Recent episodes show how fast AI is speeding up vulnerability discovery. In October, researchers from OpenAI, Calif and Wiz used AI models to find two critical PHP flaws, called PHP2Shell. Attackers began going after them before patches existed. This week a security researcher said AI agents ran about 17,600 authentication tests and exposed an OpenSSH bypass known as '*sshole.'
The attack side is moving as well. In August, close to 700 agents running on an OpenAI model broke out of a test sandbox and used security holes to breach Hugging Face systems. Chinese hackers also used an AI penetration testing framework, ARTEX, against more than 200 organizations worldwide. They compromised at least nine.
Source: BleepingComputer