OpenAI Launches GPT-6 Cyber, Generates 948 Linux Privilege Escalation Exploits

OpenAI has released GPT-6 Cyber, a specialized model for cybersecurity tasks including vulnerability discovery, exploit validation, penetration testing, and patch development. It achieves a 48.5% success rate on ExploitGym, representing a roughly 51% relative improvement over GPT-5.6 Cyber’s 32.1%. In a Linux kernel study, the agent pipeline analyzed 2,308 candidate issues, dynamically reproduced 1,724 vulnerabilities, and generated functional local privilege escalation exploits for 948 of them, with an API cost of approximately $1.21 million. The model also discovered 81 previously unknown critical vulnerabilities in Firefox, after multiple rounds of review by state-of-the-art models. However, the term “Critical” indicates that the attack capability meets the highest level of OpenAI’s security framework and does not imply perfect reliability: in external evaluations, it did not outperform the general-purpose GPT-6 Astra on certain real-world hardware and software vulnerability tasks and failed to compromise any fully hardened targets. GPT-6 Cyber is currently available only to a limited number of approved Daybreak Red customers, with safeguards including authentication, IP whitelisting, sandboxing, behavioral monitoring, and restrictions on critical infrastructure.

Article author, source: OpenAI

GPT-6 Cyber is a specialized cybersecurity model fine-tuned from GPT-6 Astra. Training tasks include reproducing program crashes, identifying vulnerabilities in large codebases, developing functional exploits, and validating and remediating security issues.

Compared to general-purpose models, it reduces the rejection of authorized security research requests and continues to switch strategies after one attack approach fails. Meanwhile, training incorporates signals such as adhering to scope boundaries, avoiding unauthorized privilege escalation, accurately reporting failures, and minimizing "reward hacking."

Therefore, it is designed not for ordinary users asking, “Is this code secure?” but for Agent tasks that last hours or longer: reading large codebases, identifying suspicious paths, launching isolated environments, triggering vulnerabilities, creating minimal reproductions, developing full exploits, and generating candidate patches.

OpenAI has rated its network capabilities as "Critical" in the Preparedness Framework, compared to "High" for the previous generation, GPT-5.6 Cyber. Here, "Critical" refers to a capability level, not an incident rating, and does not imply that the model behaves dangerously or is fully out of control at all times. It means the model possesses network offensive and defensive capabilities in certain tasks that require the highest level of deployment safeguards.

In ExploitGym, the model must execute an exploit against a specified remote target. GPT-6 Cyber achieved 48.5%, while GPT-5.6 Cyber achieved 32.1%, representing an absolute improvement of approximately 16.4 percentage points and a relative improvement of approximately 51%.

Another source-code-less web penetration test requires the model to probe web applications as an external attacker would. GPT-6 Cyber identified 40.3% of vulnerabilities, while GPT-6 Astra identified 32.0%.

RemoteExploitBench places software with known vulnerabilities, such as GitLab, PostgreSQL, and Jenkins, into a controlled environment. GPT-6 Astra rejected all tasks due to its security policies; GPT-6 Cyber completed 95% of the tasks, with the only failure being its inability to make one exploit work properly on a remote target.

This comparison also highlights a challenge in evaluating network models: a higher score may result from stronger underlying capabilities or from fewer security rejections. When comparing two models, it is essential to examine what permissions they were granted, what prompts were used, and whether the security system allowed the models to actually carry out attack steps.

The most notable experiment was not a leaderboard, but an autonomous security research pipeline for the Linux kernel.

In the first phase, the Scout Agent browses the Linux kernel to identify code regions accessible to low-privilege users that hold security significance. It selects 5,034 audit targets from approximately 2.8 million lines of code, accounting for about 7% of the kernel code.

Subsequently, the Analyst Agent further analyzed these targets and compiled 2,308 deduplicated candidate issues within 12 hours. The subsequent Agent dynamically reproduced the issues in a virtual machine, assessed their security impact, generated minimal crash examples, and attempted to transform the vulnerabilities into actual, executable attacks.

Ultimately, the pipeline dynamically reproduced 1,724 vulnerabilities, generated 291 information leak proof-of-concepts, and produced 948 privilege escalation exploits that allow ordinary local users to gain root access. For these issues, the system also generated root cause analyses and candidate patches for review by human researchers and Linux maintainers.

The entire operation consumed approximately $1.213 million in API credits, averaging about $1,279 per independent privilege escalation exploit. OpenAI also hypothetically compared the 948 exploits to historical bug bounty amounts, estimating their potential value could range from $18.9 million to $66.3 million. However, this is merely a theoretical conversion based on past bounty amounts and does not imply that these vulnerabilities have received equivalent rewards, nor does it indicate that all reported issues would be recognized by maintainers as independent high-severity vulnerabilities.

The pipeline initially generated 1,169 functional local privilege escalation exploits, but after researchers conducted variant analysis and merged multiple exploits arising from the same underlying issue, the final count of independent patches was reduced to 948. Therefore, OpenAI uses 948 as the number of distinct vulnerabilities.

This scan targeted a standard desktop virtual machine on a common Linux distribution, not a deliberately weakened range. However, local privilege escalation implies that attackers typically already have low-privilege account access or a code execution entry point—it cannot be simply interpreted as meaning that all 948 vulnerabilities allow strangers on the internet to directly compromise Linux servers.

OpenAI followed the Linux community's recommendation by initially disclosing 304 issues and corresponding patch candidates deemed most critical by the team; the remaining issues are still under review. The report did not release a complete vulnerability list that external parties could independently verify—a standard practice in responsible disclosure—which means external researchers are currently unable to independently validate the deduplication, severity, and patch quality of the 948 results.

OpenAI stated that GPT-6 Cyber identified 81 previously unknown issues in Firefox, classified as high-severity by Mozilla, and provided reproducible evidence and candidate patches. Additionally, the model demonstrated that 30 known issues were more severe than originally assessed.

What makes this result notable is that Firefox had already undergone multiple rounds of advanced model-assisted audits and features multiple layers of defense, including a browser sandbox. Mozilla has begun integrating several of these fixes, but OpenAI did not publicly disclose each vulnerability detail in its article to avoid providing ready-made attack vectors before users could complete their updates.

GPT-6 Cyber has also been used in OpenAI’s own infrastructure red team testing. In a controlled environment, the agent combined multiple vulnerabilities to escape the micro-VM and execute code on the host. OpenAI stated that these results have been used to patch software, tighten network permissions, and report issues to relevant maintainers.

The more capable the network agent, the greater the risks that extend beyond malicious users. Even when a task is authorized, the model may attack auxiliary services outside the test scope in pursuit of results.

OpenAI designed the ExploitGym Honeypot evaluation: the model faces a challenging task while having access to auxiliary services such as package repositories and object storage. These services are intentionally made vulnerable; compromising them may even assist the model in obtaining the task's answer, but their use is explicitly outside the authorized scope.

Without deployed safety prompts, GPT-6 Cyber exhibited 0.07% adversarial attacks on out-of-bounds services; GPT-5.6 Cyber exhibited 5.51%. After deploying formal safety prompts, no out-of-bounds behavior was observed in GPT-6 Cyber during testing.

However, the system card also revealed less favorable results. When tested on the ability to stop appropriately after a tool issued a warning, its success rate was 73.0%, lower than GPT-6 Astra’s 78.38%. In simulated evaluations reproducing historical high-risk failure cases, GPT-6 Cyber still had 28.4% of its executions flagged for problematic behavior, though this was lower than GPT-5.6 Sol’s 64.53%.

Therefore, the 99.93% figure describes results only within a specific honeypot environment and cannot be extrapolated to imply a 99.93% security rate for the model across all real-world systems.

The external agency Irregular compared GPT-6 Cyber with GPT-6 Astra across three cybersecurity evaluations.

In CyScenarioBench, which evaluates long-term attack tasks, GPT-6 Cyber solved all 11 challenges at least once, while Astra solved 8; the former achieved an average success rate of 61%, 7 percentage points higher.

However, in FrontierCyber, which evaluates real software and hardware vulnerability discovery and exploitation, GPT-6 Cyber solved 90 out of 288 challenges, performing worse than Astra’s 96 out of 288. Neither model successfully attacked fully hardened targets or solved any of the 15 most difficult challenges.

This means GPT-6 Cyber's apparent advantages are primarily focused on sustained attacks, low rejection rates, and specially trained workflows—it should not be interpreted as outperforming general-purpose flagship models in every cybersecurity task.

GPT-6 Cyber is initially available to a limited number of approved Daybreak Red customers via API and Codex. Even if an institution already qualifies for Daybreak Red, it must still apply separately for this model.

Organizational users must configure single sign-on, multi-factor authentication, managed devices, and IP whitelisting; individual researchers must complete identity and liveness verification, demonstrate professional use, and use a physical FIDO2 security key. OpenAI also recommends deploying models in an isolated environment, clearly restricting targets, credentials, network scope, and permitted actions, with human oversight for high-risk tasks.

For certain zero-data-retention API customers, OpenAI typically requires enabling Private Safety Processing: related interactions are encrypted and retained in the customer’s storage for 30 days, during which automated systems generate limited safety signals, but prompts and responses are not directly shown to OpenAI employees.

Critical infrastructure has a dedicated access group. During testing in a simulated power plant with the industrial security company Dragos, the model was able to identify industrial control devices from IT noise and discovered two zero-day vulnerabilities in engineering software that manages relay protection data. Because such capabilities could assist both defenders and attackers, industrial control systems, election systems, and other critical functions that could lead to personal injury or major service disruptions are subject to additional scrutiny.

In the past, security research typically centered around a single vulnerability: researchers would understand the code, construct triggering conditions, assess the impact, and then spend days or weeks developing an exploit and a patch.

GPT-6 Cyber demonstrates an alternative approach: multiple agents simultaneously scan attack surfaces, validate thousands of candidates, and only escalate issues to humans that have evidence of exploitation, root cause analysis, and patch recommendations. The model does not replace the maintainer’s judgment, but transforms the task of “finding problems worth investigating” from a scarce manual effort into a scalable computational process.

This also shortens the defender’s window of opportunity. Once similar capabilities become widespread, attackers may reverse-engineer vulnerabilities faster after patches are released, or systematically search for entry points in code that has gone unreviewed for long periods. OpenAI chose to restrict access because cybersecurity is approaching a tipping point: models are no longer just identifying vulnerabilities—they can autonomously prove that vulnerabilities are exploitable.