OpenAI has announced GPT-6 Cyber, a model it says is much better than its predecessors at finding software vulnerabilities, validating their impact and helping developers write fixes. It is not publicly available.
Headline Results
- Firefox: the model found 81 previously unknown high-severity vulnerabilities and helped develop patches. Mozilla has already shipped many of the fixes.
- Linux kernel: it identified 2,308 potential flaws and reproduced 1,724. It built local privilege escalation exploits for 948 distinct flaws that let an unprivileged user gain root.
- Benchmark: on ExploitGym, GPT-6 Cyber exploited 48.5% of vulnerabilities, against 32.1% for GPT-5.6 Cyber.
"Critical" Risk Rating
Under OpenAI's Preparedness Framework, GPT-6 Cyber is rated Critical for cybersecurity capability. Its predecessor was rated High.
Restricted Access
Access is limited to approved customers in OpenAI's Daybreak Red program, which covers exploit development and authorized security testing. OpenAI plans to widen access to all Daybreak Red customers soon. A separate Daybreak Blue program gives verified defenders, who investigate vulnerabilities and validate fixes, access with fewer restrictions.
OpenAI says it intends to extend the programs to organizations of all sizes, independent researchers and open-source maintainers.
Why It Matters
OpenAI said: "It is clear that we have a limited window to use frontier models to secure software." The argument is that defenders need to find and patch bugs before attackers get comparable capability.
Related AI-assisted findings reported recently include PHP2Shell flaws and an OpenSSH authentication bypass found with AI agents.
What Defenders Should Do
- Patch faster. Expect more vulnerability disclosures as AI-driven discovery scales. Keep Firefox and Linux kernels current.
- Prioritize local privilege escalation. Kernel LPE exploits shorten the path from a foothold to root, so harden multi-user hosts and containers.
- Shorten patch SLAs for browsers and kernels, and verify that update channels work.
Our earlier coverage of the 948-exploit research run covers the Linux findings in more depth.