OpenAI is introducing GPT-6 Cyber, a restricted access model that the company calls its most capable and aligned cybersecurity model yet, “built to help security researchers identify and validate exploitable vulnerabilities, assess their impact, and harden potential patches before they’re released.”
OpenAI researchers said they used GPT-6 Cyber to find 81 previously unknown high-severity vulnerabilities in Firefox and develop working exploits for 948 Linux kernel vulnerabilities, including 588 previously unknown vulnerabilities. Mozilla has begun releasing fixes, and Linux findings are being reported with candidate patches for maintainer review.
In a sample of 166 exploits, OpenAI’s researchers identified 10 exploitation techniques that the company says appeared novel, meaning external kernel exploitation experts reportedly had not seen them before, and that could enable someone with local access to obtain root privileges.
Highlighting what it called stronger alignment and safeguards, OpenAI said that GPT-6 Cyber “was trained to stay within authorized scope, respect restrictions, and report results accurately.” In its ExploitGym Honeypot evaluation, the model went beyond the intended scope in only 0.07% of cases, compared with 5.51% for GPT-5.6 Cyber.
More bugs, new exploitation paths
Chris Hughes, VP of security strategy at Noma Security, believes the Firefox findings suggest a deeper reservoir of vulnerabilities in mature software than defenders may have anticipated.
“Mozilla says GPT-6 Cyber surfaced high-severity Firefox bugs after multiple generations of frontier models had already hardened that code,” Hughes told CSO. “If that holds up, the long tail of vulnerabilities in mature software is deeper than most of us assumed, which is the same ‘vulnpocalypse’ pressure many have been discussing this year.”
Beyond that, the 10 novel techniques might point to how AI models could not only unearth more vulnerabilities but also create new exploitation paths, according to Rob T. Lee, the new chief AI officer at industrial cybersecurity company Dragos, which recently partnered with OpenAI.
“That could mean a few things, but that’s interesting to me as it could reveal models can create new exploitation paths,” Lee told CSO. “Adding new TTPs and exploitation paths will make detection more complex.” (Rob T. Lee just joined Dragos, which is run by company founder and CEO Rob M. Lee.)
The promise of security at agent speed
During a press call to discuss GPT-6 Cyber, OpenAI’s representatives argued that models can help validate exploitability, investigate alternative attack paths, harden patches, and assist with patch deployment. They described the goal as security operating at “agent speed.”
OpenAI researcher Eric Wallace said the goal was to “validate the potential exploitability of vulnerabilities at scale” and prioritize the most consequential flaws. He also emphasized testing fixes against alternative routes of exploitation, noting that “one vulnerability might not be the only attack path.”
During the call, OpenAI cybersecurity research lead Clint Gibler touched on advance coordination the company engaged in regarding PHP vulnerabilities with researchers, maintainers, and security vendors. “We wanted to get ahead of that public patch and release, so that as many users and companies could be protected even before the patch was available,” he said. OpenAI worked with Cloudflare “to ensure that they could deploy WAF [web application firewall] rules, which would proactively protect as many websites as possible even before the bug was announced.”
Finding flaws is easier to measure than fixing them
OpenAI, however, provided no measurements showing how much its models accelerate enterprise patch deployment or reduce exposure.
Noma Security’s Hughes argued that defensive applications need more rigorous evaluation, telling CSO, “Detection engineering, incident response, hardening, and prioritization are harder to score because success depends on each organization’s environment, tooling, and risk tolerance.” He believes that sharing defender benchmarks would direct progress toward “the work that closes the remediation gap, not only toward finding more bugs.”
Hughes added: “The OpenAI Patch the Planet dashboard currently shows a less than 25% remediation rate thus far, and given the improved finding capability, this is likely to exacerbate that further, meaning more things found but unfixed and likely to be found by malicious actors with similar capabilities or effective harness engineering on sub-tier models. This highlights even further risk for organizations facing the rise of industrialized discovery via AI.”
Stronger safeguards, restricted access
OpenAI classifies GPT-6 Cyber as “Critical” in cybersecurity under its own Preparedness Framework.
“Going out of scope in 0.07% of cases versus 5.51% for the prior model is a real improvement,” Hughes noted. “At the scale these models operate, though, even a small fraction means actions against systems nobody authorized.”
OpenAI said that GPT-6 Cyber will initially be available through the API and Codex to a select group of approved Daybreak Red customers, the more permissive of two vetted access tiers in Daybreak, OpenAI’s trusted-access cyber program. (Daybreak Blue is the tier OpenAI recommends for most defenders.) OpenAI said it will progressively expand GPT-6 Cyber access to all Daybreak Red customers over the coming weeks, and is making GPT-5.6 Cyber available to that customer set as well.
OpenAI said in briefing materials prior to the press call, “We are working to responsibly expand access to frontier cyber capabilities to many more organizations and members of the security community. To start, we’re broadening access to an alpha of Daybreak Blue for Astra,” which is OpenAI’s GPT-6 general-purpose frontier model.
No Responses