OpenAI Launches GPT-6 Cyber to Detect and Patch Software Vulnerabilities

OpenAI has launched GPT-6 Cyber, a new model designed to identify and fix software security weaknesses. It successfully detected 81 Firefox vulnerabilities and exploited 948 Linux kernel issues, marking a major leap in security research capability.

OpenAI Launches GPT-6 Cyber for Cybersecurity

OpenAI has launched GPT-6 Cyber, a new cybersecurity model designed to identify software security weaknesses, develop ways to test them, and help security teams fix vulnerabilities. The company said the model identified 81 previously unknown high-severity vulnerabilities in the Firefox browser and developed working exploits for 948 vulnerabilities in the Linux kernel, highlighting its ability to detect and assess software security risks. OpenAI said, “We’re introducing GPT‑6 Cyber, a major leap in security research: more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set”.

According to OpenAI, Mozilla classified the 81 Firefox vulnerabilities as high severity. OpenAI shared evidence, reproducible tests, and proposed patches with Mozilla, which began incorporating fixes shortly after receiving the reports. The model also identified 30 known Firefox issues that were more severe than previously reported.

Performance and Technical Benchmarks

In its Linux kernel testing, GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 of them. OpenAI said this was more than five times the 166 vulnerabilities exploited by its earlier GPT-5.6 Sol model using the same testing system. The company also disclosed 304 critical findings to maintainers along with candidate patches, while work on other fixes was in progress.

The model scored 48.5 per cent on the ExploitGym benchmark, compared with 32.1 per cent for GPT-5.6 Cyber. OpenAI described this as a 51 per cent relative improvement over the earlier model. On a new web penetration testing benchmark, GPT-6 Cyber recorded a recall score of 40.3 per cent, compared with 32 per cent for GPT-6 Astra. In another test, RemoteExploitBench, GPT-6 Cyber completed 95 per cent of the tasks, while GPT-6 Astra with Daybreak Blue refused all the tasks. OpenAI said the only task GPT-6 Cyber failed to complete involved an exploit it could not get to work remotely.

Enhanced Safety and Authorization

OpenAI also highlighted improvements in keeping the model within authorised testing limits. It avoided exploiting services outside the approved scope in 99.93 per cent of tests without a deployment prompt and 100 per cent with the prompt. Its predecessor, GPT-5.6 Cyber, recorded 94.49 per cent without prompts. The company has classified GPT-6 Cyber as "Critical" for cybersecurity capabilities under its Preparedness Framework, compared with the "High" classification given to GPT-5.6 Cyber.

Addressing Security Concerns

However, the model's capabilities also raise concerns about potential misuse. Dragos, the global provider for extended operational technology (xOT) cybersecurity, ran evaluations using cyber-permissive Daybreak Red models in a controlled lab environment. In testing conducted in a mock power plant laboratory, GPT-6 Cyber identified two previously unknown vulnerabilities in engineering software used to manage protective relay data. These weaknesses could expose protection settings and circuit-breaker trip logic. OpenAI said it refined the model's safeguards following the testing.

The company said it has introduced cyber-specific monitoring, threat monitoring, sandboxing, human oversight, and additional protections for critical infrastructure.

Deployment and Availability

OpenAI is making GPT-6 Cyber initially available through its API and Codex to selected approved Daybreak Red customers, with access expected to expand gradually. Daybreak Red is designed for advanced exploit development and authorised testing, while Daybreak Blue focuses on validating vulnerabilities and developing fixes. The company also announced a USD 1 billion Daybreak grant programme for frontline cybersecurity defenders and organisations with limited resources, including government bodies and essential service providers. It has also created a separate subgroup for approved critical infrastructure defenders to conduct authorised security testing. (ANI)

(Except for the headline, this story has not been edited by Asianetnews Editorial staff and is published from a syndicated feed.)