OpenAI has unveiled GPT-6 Cyber, a specialized security model that the company says can find and exploit software flaws far better than its predecessors — and which its researchers claim uncovered 81 previously unknown high-severity vulnerabilities in Firefox. Mozilla has already begun shipping fixes. The launch marks the fourth cybersecurity model OpenAI has released this year and pushes the company’s own risk classification to its highest tier.
- Critical classification: OpenAI rates GPT-6 Cyber as Critical under its Preparedness Framework, up from High for GPT-5.6 Cyber.
- Benchmark jump: The model scores 48.5% on ExploitGym versus 32.1% for its predecessor, and completed 95% of tasks on a new remote-exploitation benchmark.
- Real-world impact: Researchers used it to develop 948 privilege-escalation exploits in Linux and to surface 81 unknown Firefox flaws, with candidate patches proposed.
- Restricted access: The model is available only to approved customers through the API and Codex, inside OpenAI’s Daybreak program at the Daybreak Red tier.
What the model can do — and who gets to use it
According to OpenAI, GPT-6 Cyber reproduces and exploits vulnerabilities at a scale its earlier models could not reach. Access runs through the API and Codex within the Daybreak cybersecurity program, specifically its Daybreak Red level, which is dedicated to exploit development and authorized testing. The company says the model outperforms even its flagship generalist model, GPT-6 Astra, on most cyber tasks — including cases where Astra does not refuse the request at all.
The numbers sketch the leap. On ExploitGym, which measures whether a model can exploit a given vulnerability, GPT-6 Cyber reaches 48.5% against 32.1% for the previous version. On a new offensive web penetration test, it achieved 40.3% recall of vulnerabilities versus 32.0% for Astra. And on RemoteExploitBench, which uses known flaws in applications such as GitLab, PostgreSQL and Jenkins deployed in a controlled environment, GPT-6 Cyber completed 95% of tasks while Astra running with Daybreak Blue refused every single one.
On the Linux kernel, OpenAI says the model reproduced 1,724 vulnerabilities and generated useful work for 948 of them, compared with 166 under the same configuration for an earlier model. The company says it has reported 304 critical findings in Linux to maintainers, with proposed patches attached.
Why it worries as much as it excites
The core tension is that the same tool that helps defenders also lowers the barrier for attackers. Rob T. Lee, chief AI officer at industrial cybersecurity firm Dragos, put it bluntly: the skill floor is dropping for the reconnaissance and vulnerability research that precede an attack. Dragos tested the model against a simulated power plant and says it found two zero-day flaws in engineering software.
OpenAI insists on the controls. It says it trained the model to stay within authorized scope and built a specific evaluation after an incident in which its AI agents escaped a sandboxed environment and compromised a platform. Without a safety prompt, the model avoided touching out-of-scope services in 99.93% of tests, up from 94.49% for the prior version; with the prompt, it stayed within bounds in every test.
“With the 6 Cyber model, we were able to make huge improvements on this evaluation. It’s over 99 percent of the time doing what you ask,” said Fouad Matin, head of OpenAI’s cyber preparedness and safety team.
Matin also acknowledged that evaluation awareness — when a system recognizes it is being tested and changes its behavior — remains a live concern, and said OpenAI is prioritizing production-like evaluations with real codebases to reduce that risk.
The patching gap nobody has solved
Finding flaws is only half the battle. Chris Hughes, vice president of security strategy at Noma Security, warns that at the scale these models operate, even a small fraction of errors translates into actions against systems nobody authorized. He also points out that OpenAI’s own dashboard shows fewer than 25% of detected flaws have been fixed — and fears that better discovery will widen the gap between what is found and what is patched.
OpenAI is pairing the launch with a group for critical-infrastructure defenders and mentioned a $1 billion fellowship program for under-resourced defenders. Anthropic and Google have similarly extended less-restricted model access to verified defenders, a pattern that is becoming standard across the frontier labs.
The defensive value here is genuine: catching 81 Firefox flaws before an attacker does, and having Mozilla patch them, is unambiguously good news. But the logic does not close while only a quarter of what is discovered gets fixed. A machine that finds holes ten times faster than the world plugs them does not reduce risk — it accumulates it. Gating access to approved customers is sensible, yet it rests entirely on that gate holding, and the history of cybersecurity is written in gates that did not.