28
OpenAI has launched GPT-6 Cyber, a specialised artificial intelligence model designed to help security researchers identify software
vulnerabilities, test whether they can be exploited and develop fixes.
OpenAI has classified GPT-6 Cyber as “Critical” for cybersecurity under its Preparedness Framework. This is one level above the “High” classification given to GPT-5.6 Cyber. The classification refers specifically to its cybersecurity capabilities and is not a general product-safety rating.
Announced on November 5, GPT-6 Cyber is initially available through the API and Codex to selected customers under OpenAI’s Daybreak Red programme. OpenAI plans to expand access to all Daybreak Red customers, although it has not announced a specific date.
The company said GPT-6 Cyber scored 48.5% on the ExploitGym benchmark, compared with 32.1% for GPT-5.6 Cyber. The benchmark measures a model’s ability to exploit a specified vulnerability in a remote target.
In a separate web penetration-testing evaluation, OpenAI said GPT-6 Cyber achieved 40.3% vulnerability recall, compared with 32% for GPT-6 Astra.
OpenAI also reported results from research involving widely used software. The company said GPT-6 Cyber identified 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity. OpenAI provided reproducible tests and proposed patches, and Mozilla has begun releasing fixes.
In research involving the Linux kernel, OpenAI said its pipeline identified 2,308 candidate findings, reproduced 1,724 vulnerabilities and developed 948 working local privilege-escalation exploits. It also disclosed 304 critical findings to maintainers along with candidate patches.
OpenAI clarified that the 948 exploits do not represent 948 newly discovered vulnerabilities.The launch has also prompted additional safeguards, including cyber-specific monitoring, credential protections and default IP allowlisting for Daybreak Red API access.
OpenAI said the model stayed within assigned testing boundaries in 99.93% of evaluations without deployment safety prompts, and in 100% of evaluations when such prompts were enabled. The launch highlights the growing role of AI in vulnerability research, while also underscoring the need for authorised testing, responsible access and human oversight.
OpenAI has classified GPT-6 Cyber as “Critical” for cybersecurity under its Preparedness Framework. This is one level above the “High” classification given to GPT-5.6 Cyber. The classification refers specifically to its cybersecurity capabilities and is not a general product-safety rating.
Announced on November 5, GPT-6 Cyber is initially available through the API and Codex to selected customers under OpenAI’s Daybreak Red programme. OpenAI plans to expand access to all Daybreak Red customers, although it has not announced a specific date.
The company said GPT-6 Cyber scored 48.5% on the ExploitGym benchmark, compared with 32.1% for GPT-5.6 Cyber. The benchmark measures a model’s ability to exploit a specified vulnerability in a remote target.
In a separate web penetration-testing evaluation, OpenAI said GPT-6 Cyber achieved 40.3% vulnerability recall, compared with 32% for GPT-6 Astra.
OpenAI also reported results from research involving widely used software. The company said GPT-6 Cyber identified 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity. OpenAI provided reproducible tests and proposed patches, and Mozilla has begun releasing fixes.
In research involving the Linux kernel, OpenAI said its pipeline identified 2,308 candidate findings, reproduced 1,724 vulnerabilities and developed 948 working local privilege-escalation exploits. It also disclosed 304 critical findings to maintainers along with candidate patches.
OpenAI clarified that the 948 exploits do not represent 948 newly discovered vulnerabilities.The launch has also prompted additional safeguards, including cyber-specific monitoring, credential protections and default IP allowlisting for Daybreak Red API access.
OpenAI said the model stayed within assigned testing boundaries in 99.93% of evaluations without deployment safety prompts, and in 100% of evaluations when such prompts were enabled. The launch highlights the growing role of AI in vulnerability research, while also underscoring the need for authorised testing, responsible access and human oversight.
