OpenAI’s GPT-6 Cyber Targets Vulnerabilities, Exploits and Patches

OpenAI has introduced GPT-6 Cyber as an AI model trained specifically for security work: finding vulnerabilities, developing working exploits and suggesting patches. The model is described as operating within assigned boundaries, with OpenAI reporting improved guardrail performance compared with its predecessor. For readers, the key takeaway is that OpenAI is positioning the model as both an offensive testing tool and a defensive remediation aid.

According to OpenAI, GPT-6 Cyber found 81 previously unknown severe vulnerabilities in Firefox, which Mozilla has already patched. In Linux kernel testing, OpenAI says the model reproduced 1,724 vulnerabilities and developed working exploits for 948 of them, more than five times the number attributed to GPT-5.6 Sol under the same conditions. OpenAI also reports a 48.5 percent score on ExploitGym, versus 32.1 percent for GPT-5.6 Cyber. The important caveat: the benchmark figures cited in the article come from OpenAI, and no independent testing has been published so far.

GPT-6 Cyber is initially available through the API and Codex for selected Daybreak Red customers, with broader Daybreak Red access planned gradually. OpenAI lists safeguards including permission checks, targeted monitoring for newly disclosed vulnerabilities, automated safety checks, IP-based restrictions and recommendations to run the model in isolated environments with human oversight. Security teams should watch how these controls perform in practice, because the same capabilities that help defenders can also raise abuse concerns.

The article frames GPT-6 Cyber as part of a limited window in which advanced AI could be used to secure software before similar capabilities spread more widely. OpenAI points to programs for frontline defenders and critical infrastructure, including power plants and water treatment facilities. The practical implication is clear: organizations should prepare for faster vulnerability discovery cycles and consider how AI-assisted testing, patch review and human oversight fit into their security workflows.