OpenAI has unveiled its latest innovation in the field of cybersecurity, the GPT-6 Cyber model, which has demonstrated unprecedented advanced capabilities in identifying software vulnerabilities and developing exploits. According to the announcement, the model successfully discovered 81 previously unknown high-risk security vulnerabilities in the Firefox browser, in addition to developing successful exploits for 948 different vulnerabilities in the Linux kernel.
In performance benchmarks, the new model significantly outperformed its predecessor; it achieved a 48.5% success rate in exploiting vulnerabilities within the ExploitGym environment, compared to 32.1% for the GPT-5.6 Cyber model. The model was also able to identify 2,308 potential vulnerabilities in the Linux kernel, with the ability to successfully reproduce 1,724 of them and develop Local Privilege Escalation exploits that allow unauthorized users to gain root access.
Why does this development represent a turning point?
The emergence of GPT-6 Cyber underscores the accelerating pace of the cyber arms race between defenders and attackers. While these tools provide immense capabilities for security researchers to patch vulnerabilities quickly, they also grant attackers a means to automate complex attacks and discover weaknesses in record time. OpenAI warned that the time window available for defenders to use advanced models to secure software before these capabilities become available to attackers is constantly shrinking.
Availability and Limitations
The model is not currently available to the public; access is limited to a select group of clients within the Daybreak Red program, which specializes in advanced exploit development and authorized security testing, while the Daybreak Blue program allows defenders to verify and fix vulnerabilities with less stringent controls. Based on these capabilities, OpenAI has raised the model's classification within its preparedness framework to the "Critical" level, after it was previously classified as "High".
This announcement comes in the context of increasing reliance on artificial intelligence in cyberattacks, such as the discovery of PHP2Shell vulnerabilities, the use of AI agents to discover vulnerabilities in OpenSSH, and the use of frameworks like ARTEX by hacking groups to execute automated attacks against hundreds of organizations around the world.