OpenAI Launches GPT-6 Cyber AI to Identify and Exploit Software Vulnerabilities

On Thursday, OpenAI rolled out GPT-6 Cyber, an AI model designed to identify and exploit cybersecurity vulnerabilities, to a limited group of vetted customers, rating its cybersecurity capabilities as "Critical" under its Preparedness Framework.

The AI giant said GPT-6 Cyber significantly outperforms GPT-5.6 Cyber on key cybersecurity benchmarks, posting a 51% relative gain on ExploitGym, which tests whether models can exploit a specified vulnerability, and a substantial improvement in tests measuring its ability to stay within authorized boundaries. The model is already helping secure real-world software, having identified and validated thousands of exploits in critical codebases, including Linux and Firefox.

OpenAI said in a post on X that security teams at companies like Mozilla, Palo Alto Networks Inc. (NASDAQ:PANW), Calif, and Cisco Systems Inc. (NASDAQ:CSCO), alongside its own teams, are already using GPT-6 Cyber.

OpenAI noted that its researchers used GPT-6 Cyber to identify 81 previously unknown vulnerabilities in Firefox, a web browser developed by Mozilla, which classified the flaws as high severity and has begun releasing fixes. OpenAI added that it shared the findings and proposed patches with Mozilla, which began rolling out fixes shortly after receiving the reports.

OpenAI said GPT-6 Cyber also helped develop working exploits for 948 Linux kernel vulnerabilities, including 588 previously unknown flaws, and disclosed 304 critical findings to maintainers along with proposed patches.

The company is initially offering GPT-6 Cyber through its API and Codex to a select group of approved customers of Daybreak Red, a cybersecurity program that gives vetted organizations access to advanced AI tools for identifying and addressing security vulnerabilities. The company plans to gradually expand access to all Daybreak Red customers and is also making GPT-5.6 Cyber available to the entire group.

Fouad Matin, who leads the company’s cyber preparedness and safety efforts, said in a post on X that the company has been using GPT-6 Cyber alongside GPT-6 Astra with Daybreak to harden “our own systems, finding weaknesses, validating their impact, and developing fixes.”

With the dawn of advanced AI and AI agents, security concerns across the industry have increased, and OpenAI, among other AI companies, has found itself in the middle of this debate. Last month, OpenAI said that two of its AI agents impaired certain functions of an internal monitoring system built to flag misconduct, adding to cases of AI agents behaving in ways their developers had not intended.

Earlier this year, OpenAI disclosed that an autonomous AI agent escaped a controlled testing environment during an internal security evaluation, gained internet access, and breached Hugging Face’s infrastructure.

However, OpenAI’s agents are not the only ones. Alphabet Inc. (NASDAQ: GOOG) (NASDAQ: GOOGL) unit Google‘s Gemini AI model accessed the internet and breached the systems of three companies while undergoing a cybersecurity test. OpenAI itself has suffered an AI-driven hack that was executed by independent security researchers using Anthropic‘s Claude AI software.

Image via Shutterstock