OpenAI Launches GPT-6 Cyber AI Model to Detect Software Vulnerabilities and Fix Security Flaws

OpenAI has introduced GPT-6 Cyber, a specialised AI model designed to identify software vulnerabilities, test security weaknesses, develop exploits and help cybersecurity teams implement effective fixes.

OpenAI Introduces GPT-6 Cyber for Advanced Cybersecurity

OpenAI has announced GPT-6 Cyber, a specialised artificial intelligence model developed to strengthen cybersecurity research and software protection. The new model can identify previously unknown security vulnerabilities, evaluate potential attack methods and assist researchers in developing solutions.

According to OpenAI, GPT-6 Cyber represents a significant improvement in AI-powered security research, with stronger vulnerability detection capabilities and better compliance with authorised testing restrictions.

The company highlighted its performance in testing the Firefox browser and Linux kernel, where the model discovered numerous security issues and developed working exploits to demonstrate their potential impact.

GPT-6 Cyber Discovers 81 Firefox Vulnerabilities

One of the major achievements highlighted by OpenAI involves the Firefox browser.

The company said GPT-6 Cyber identified 81 previously unknown high-severity vulnerabilities in Firefox. Mozilla classified these findings as high severity after reviewing the reported issues.

OpenAI shared supporting evidence, reproducible tests and suggested patches with Mozilla. The browser developer subsequently began incorporating fixes into its software.

In addition to discovering new vulnerabilities, GPT-6 Cyber identified 30 previously known Firefox security issues that were more serious than initially reported.

Linux Kernel Testing Shows Major Improvement

OpenAI also evaluated GPT-6 Cyber using Linux kernel security testing. During these assessments, the model successfully reproduced 1,724 vulnerabilities and developed working exploits for 948 of them.

The company also submitted 304 critical findings to Linux maintainers, along with proposed patches, while additional remediation work continued.

OpenAI compared these results with its earlier GPT-5.6 Sol model, which exploited 166 vulnerabilities using the same testing system. The latest model demonstrated a substantial improvement in identifying and validating security weaknesses.

GPT-6 Cyber Performance on Cybersecurity Benchmarks

OpenAI reported significant improvements across multiple cybersecurity benchmarks. On the ExploitGym benchmark, GPT-6 Cyber achieved a score of 48.5%, compared with 32.1% for GPT-5.6 Cyber. This represents a 51% relative improvement over its predecessor.

The model also recorded a 40.3% recall score on a new web penetration testing benchmark, outperforming GPT-6 Astra, which achieved 32%.

Another evaluation, RemoteExploitBench, showed that GPT-6 Cyber completed 95% of the assigned tasks. In comparison, GPT-6 Astra with Daybreak Blue refused all the tasks.

According to OpenAI, the only task the new model could not complete involved an exploit that failed to work remotely.

Improved Safeguards for Authorised Security Testing

Alongside stronger technical capabilities, OpenAI has focused on improving the model's ability to follow authorised testing boundaries.

The company said GPT-6 Cyber avoided exploiting services outside the approved testing scope in 99.93% of evaluations without a deployment prompt. With the prompt, the figure increased to 100%.

Its predecessor, GPT-5.6 Cyber, achieved 94.49% without prompts.

Under OpenAI's Preparedness Framework, GPT-6 Cyber has received a "Critical" classification for cybersecurity capabilities, compared with the "High" rating assigned to GPT-5.6 Cyber.

Critical Infrastructure Security Raises Concerns

OpenAI also discussed evaluations conducted by Dragos, a cybersecurity provider specialising in operational technology environments.

During controlled testing inside a simulated power plant laboratory, GPT-6 Cyber identified two previously unknown vulnerabilities in engineering software used to manage protective relay data.

These weaknesses could potentially expose protection settings and circuit-breaker trip logic, creating risks for critical infrastructure systems.

Following the assessment, OpenAI said it strengthened the model's safeguards. Its security measures include specialised monitoring, sandboxing, human oversight and additional protections for critical infrastructure environments.

GPT-6 Cyber Availability and Daybreak Access

OpenAI is initially providing GPT-6 Cyber through its API and Codex to selected, approved Daybreak Red customers. The company plans to expand access gradually.

The Daybreak programme includes two specialised models:

• Daybreak Red: Designed for advanced exploit development and authorised security testing.

• Daybreak Blue: Focuses on validating vulnerabilities and developing security fixes.

Access is intended for approved cybersecurity researchers and organisations conducting legitimate security assessments.

OpenAI Announces $1 Billion Cybersecurity Grant Programme

Alongside the model launch, OpenAI announced a $1 billion Daybreak grant programme to support frontline cybersecurity defenders.

The initiative aims to assist organisations with limited resources, including government institutions and essential service providers.

OpenAI has also established a dedicated subgroup for approved critical infrastructure defenders. This will allow eligible organisations to conduct authorised security testing and strengthen protection against emerging cyber threats.

Conclusion

OpenAI's GPT-6 Cyber represents a major development in AI-powered cybersecurity research, with improved vulnerability detection, exploit testing and security remediation capabilities. Its performance across Firefox and Linux kernel assessments highlights its potential to support security professionals. However, its powerful capabilities also make safeguards, responsible access and human oversight essential for protecting critical systems.