OpenAI has introduced GPT-6 Cyber, an AI model trained specifically to search for security vulnerabilities in software. According to OpenAI, it can find flaws, develop working attack paths and suggest patches. The Decoder reports this based on OpenAI's announcement.
Own benchmarks, no independent tests
On ExploitGym, a benchmark testing whether a model can exploit a given vulnerability in a remote system, GPT-6 Cyber scores 48.5 percent according to OpenAI, compared with 32.1 percent for its predecessor GPT-5.6 Cyber. On a new test for finding vulnerabilities in web applications without source code, OpenAI reports 40.3 percent, versus 32.0 percent for GPT-6 Astra. All benchmark figures come from OpenAI itself; according to The Decoder, no independent tests have been published so far.
Findings in Firefox and the Linux kernel
In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, according to OpenAI, even though the browser had already been tested with earlier AI models. Mozilla accepted the reports and has already shipped fixes. In the Linux kernel, the model reproduced 1,724 security vulnerabilities according to OpenAI and developed working exploits for 948 of them, more than five times the 166 managed by GPT-5.6 Sol under the same conditions. 304 critical findings were reported to Linux maintainers with suggested fixes.
OpenAI says the run cost $1,213,430 in compute, or $1,279 per exploit. The Decoder compares this with bounties from programs such as Pwn2Own or TyphoonPWN, which have historically paid between $20,000 and $70,000 per comparable finding. OpenAI also claims the agents used at least ten novel attack techniques unknown even to external kernel security experts. How far that claim holds depends on how "own approaches" is defined.
Safeguards and access
OpenAI says the model was specifically trained to stay within its authorized scope. Without special safety instructions it avoided boundary violations in 99.93 percent of cases, versus 94.49 percent for its predecessor; with safety instructions, OpenAI reports 100 percent. OpenAI rates GPT-6 Cyber as "Critical" in the cybersecurity category of its Preparedness Framework.
According to OpenAI, access is initially available via API and Codex to a selected group of Daybreak Red customers and will be expanded gradually. OpenAI acknowledges that misuse attempts increase as capabilities grow.
Assessment
For companies that operate software, such a model could speed up the search for vulnerabilities, but it could also lower the effort for attackers if it fell into the wrong hands. Key questions will be how independently the performance claims are verified and whether the staged access remains effectively controlled.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
