[{"data":1,"prerenderedAt":29},["ShallowReactive",2],{"nr-en-openai-gpt-6-cyber-vulnerability-discovery":3},{"slug":4,"title":5,"dek":6,"date":7,"time":8,"publishedAt":9,"updated":10,"updatedAt":10,"dateFmt":11,"updatedFmt":10,"kind":12,"tier":13,"author":14,"authorName":15,"topics":16,"tracker":21,"trackerLabel":22,"headlineStat":23,"image":24,"ogImage":25,"imageAlt":5,"csv":10,"minutes":26,"words":27,"html":28},"openai-gpt-6-cyber-vulnerability-discovery","OpenAI unveils GPT-6 Cyber: AI for finding and fixing security vulnerabilities","OpenAI has introduced a model trained for cybersecurity that is meant to find vulnerabilities, develop exploits and suggest patches. The performance figures so far come exclusively from OpenAI itself.","2026-11-06","05:26","2026-11-06T05:26:00+01:00","","November 6, 2026","news","standard","ideal-syka","Ideal Syka",[17,18,19,20],"Cybersecurity","OpenAI","Security vulnerabilities","Dual use","\u002Ftools\u002Fki-evidenznetz","Linked evidence on AI security","81 vulnerabilities in Firefox according to OpenAI","\u002Fnewsroom\u002Fimg\u002Fopenai-gpt-6-cyber-vulnerability-discovery.webp","\u002Fog-nr\u002Fopenai-gpt-6-cyber-vulnerability-discovery.en.png",2,449,"\u003Cp>OpenAI has introduced GPT-6 Cyber, an AI model trained specifically to search for security vulnerabilities in software. According to OpenAI, it can find flaws, develop working attack paths and suggest patches. The Decoder reports this based on OpenAI's announcement.\u003C\u002Fp>\n\u003Ch2>Own benchmarks, no independent tests\u003C\u002Fh2>\n\u003Cp>On ExploitGym, a benchmark testing whether a model can exploit a given vulnerability in a remote system, GPT-6 Cyber scores 48.5 percent according to OpenAI, compared with 32.1 percent for its predecessor GPT-5.6 Cyber. On a new test for finding vulnerabilities in web applications without source code, OpenAI reports 40.3 percent, versus 32.0 percent for GPT-6 Astra. All benchmark figures come from OpenAI itself; according to The Decoder, no independent tests have been published so far.\u003C\u002Fp>\n\u003Ch2>Findings in Firefox and the Linux kernel\u003C\u002Fh2>\n\u003Cp>In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, according to OpenAI, even though the browser had already been tested with earlier AI models. Mozilla accepted the reports and has already shipped fixes. In the Linux kernel, the model reproduced 1,724 security vulnerabilities according to OpenAI and developed working exploits for 948 of them, more than five times the 166 managed by GPT-5.6 Sol under the same conditions. 304 critical findings were reported to Linux maintainers with suggested fixes.\u003C\u002Fp>\n\u003Cp>OpenAI says the run cost $1,213,430 in compute, or $1,279 per exploit. The Decoder compares this with bounties from programs such as Pwn2Own or TyphoonPWN, which have historically paid between $20,000 and $70,000 per comparable finding. OpenAI also claims the agents used at least ten novel attack techniques unknown even to external kernel security experts. How far that claim holds depends on how "own approaches" is defined.\u003C\u002Fp>\n\u003Ch2>Safeguards and access\u003C\u002Fh2>\n\u003Cp>OpenAI says the model was specifically trained to stay within its authorized scope. Without special safety instructions it avoided boundary violations in 99.93 percent of cases, versus 94.49 percent for its predecessor; with safety instructions, OpenAI reports 100 percent. OpenAI rates GPT-6 Cyber as "Critical" in the cybersecurity category of its Preparedness Framework.\u003C\u002Fp>\n\u003Cp>According to OpenAI, access is initially available via API and Codex to a selected group of Daybreak Red customers and will be expanded gradually. OpenAI acknowledges that misuse attempts increase as capabilities grow.\u003C\u002Fp>\n\u003Ch2>Assessment\u003C\u002Fh2>\n\u003Cp>For companies that operate software, such a model could speed up the search for vulnerabilities, but it could also lower the effort for attackers if it fell into the wrong hands. Key questions will be how independently the performance claims are verified and whether the staged access remains effectively controlled.\u003C\u002Fp>\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fthe-decoder.de\u002Fgpt-6-cyber-openai-trainiert-ki-modell-gezielt-fuer-die-jagd-nach-sicherheitsluecken\u002F\">The Decoder (DE)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fopenai.com\u002Findex\u002Fintroducing-gpt-6-cyber\">OpenAI\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fthe-decoder.com\u002Fopenais-gpt-6-cyber-can-both-break-into-systems-and-propose-how-to-fix-them\u002F\">The Decoder\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cem>Editorially owned by \u003Ca href=\"\u002Fen\u002Fautor\u002Fideal-syka\">Ideal Syka\u003C\u002Fa>. Sources and method: \u003Ca href=\"\u002Fen\u002Fredaktion\">Newsroom & method\u003C\u002Fa>. Tips and corrections: \u003Ca href=\"mailto:ai@i6eal.de\">ai@i6eal.de\u003C\u002Fa>.\u003C\u002Fem>\u003C\u002Fp>\n",1793952074062]