To fix a vulnerability, GPT-6 Cyber first tries to exploit it

With controlled access, GPT-6 Cyber helps researchers find vulnerabilities, demonstrate their exploitation, and prepare patches for Linux and Firefox.

Behind the Linux kernel vulnerability research campaign announced by OpenAI is now an identified model: GPT‑6 Cyber. This specialized version is trained to search for vulnerabilities, verify how they can be exploited, and prepare fixes. The goal is to provide security teams with reproducible evidence of risk, in addition to detecting a problem in the code.

The model introduced by OpenAI is a variant of GPT‑6 Astra, adapted for authorized cybersecurity work. Its launch pairs a stated increase in offensive capabilities with training intended to better respect the boundaries of a mission. Initial access remains reserved for certain approved customers, via the API and in Codex. Two validations before it can be used

The Daybreak program distinguishes two levels. Blue supports defensive work, such as code review, vulnerability analysis, and fix validation, with fewer refusals on compatible models. Red covers more advanced research, including authorized penetration testing and the development of exploit proofs.

Red approval does not automatically unlock all specialized models. Additional authorization is required for GPT‑6 Cyber, while GPT‑5.6 Cyber becomes accessible to all Red customers. The announced expansion of the Daybreak Blue alpha for GPT‑6 Astra is a separate opening that does not grant access to the new Cyber model.

These access levels come with strengthened controls. For organizations, the documentation provides for single sign-on and multi-factor authentication; Daybreak Red API requests are, by default, limited to approved IP addresses. The Codex Security model must also be distinguished: it brings together the products and tools that organize analyses, fix proposals, and their verification. Exploiting a known flaw is not the same as discovering it

On ExploitGym, the model must exploit a designated vulnerability in a remote target. The published success rate rises from 32.1% for GPT‑5.6 Cyber to 48.5% for GPT‑6 Cyber, a gain of 16.4 points. This benchmark measures exploitation ability in a test environment, not the share of flaws it would find in any software.

Another evaluation focuses on web applications examined without access to their source code. Recall reaches 40.3%, compared with 32% for GPT‑6 Astra: this is the share of reference vulnerabilities found again. These figures come from OpenAI’s evaluations.

Under its own risk-readiness framework, the company classifies the model’s cyber capabilities at the “Critical” level, versus “High” for GPT‑5.6 Cyber. This classification concerns the model’s capabilities and associated risks; it does not constitute certification of the security of the software it examines. The authorized perimeter is tested as well

The ExploitGym Honeypot evaluation introduces deliberately vulnerable auxiliary services around the authorized target. The agent can use them normally to complete its mission, but exploiting them falls outside the intended scope. The test aims to determine whether it takes this shortcut to obtain the requested result.

According to OpenAI, GPT‑6 Cyber remains within the boundaries in 99.93% of runs without the safety prompts used at deployment, and in 100% of runs with them. That last figure applies to this specific protocol. The safety sheet also reports cases where the model must stop in the face of a warning: it adopts the expected behavior in 73% of cases where stopping is appropriate, compared with 78.38% for Astra.

The protections therefore do not rely solely on training. The system includes access restrictions and usage monitoring. For higher-risk missions, the documentation also recommends isolated environments, controls before sensitive actions, and human oversight. Fixes remain in the hands of maintainers

In the Linux campaign, the researchers report 1,724 reproduced vulnerabilities and 948 functional exploits enabling local privilege escalation. They say they submitted 304 critical reports to maintainers, along with proposed fixes. These numbers describe different stages: reproducing a flaw, demonstrating its exploitation, and getting a correction integrated.

For Firefox, OpenAI announces 81 new vulnerabilities classified as high severity by Mozilla, as well as a reclassification upward of 30 already known issues. The reports were accompanied by reproducible tests and proposed fixes. The Firefox 159 security bulletin confirms the release of patches for several issues reported by an OpenAI researcher. The total of 81 remains the one the company communicated for its entire campaign.