OpenAI introduces GPT-6 Cyber for cybersecurity vulnerability detection

OpenAI has introduced GPT-6 Cyber, a model designed for cybersecurity research. According to OpenAI, the model is trained to find and validate exploitable vulnerabilities while staying within the scope set by researchers.

Performance and Benchmarks

OpenAI reports that GPT-6 Cyber shows significant improvements over GPT-5.6 Cyber across several metrics:

• ExploitGym: GPT-6 Cyber scored 48.5%, compared to 32.1% for GPT-5.6 Cyber.
• Scope Adherence: In alignment evaluations, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without a deployment prompt, and 100% of tests with one.
• Web Penetration Testing: GPT-6 Cyber achieved a 40.3% recall of vulnerabilities, while GPT-6 Astra achieved 32.0%.

OpenAI has classified the model as "Critical" in cybersecurity under its Preparedness Framework, an increase from the "High" classification given to GPT-5.6 Cyber.

Real-World Application

OpenAI states the model is already being used to secure various software systems. Reported impacts include:

• Firefox: Researchers used the model to identify 81 previously unknown high-severity vulnerabilities. Brian Grinstead, a Distinguished Engineer at Firefox, stated, "GPT-6 Cyber uncovered previously unknown high-severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users."
• Linux: OpenAI researchers used the model to develop working exploits for 948 privilege escalation vulnerabilities.
• Infrastructure: OpenAI reported using the model to find and fix weaknesses in its own infrastructure.

Security teams at Cisco, Calif, and CodeRabbit are also utilizing the model for code review and vulnerability research.

Safeguards and Critical Infrastructure

To prevent misuse, OpenAI has implemented several protections, including cyber-specific misalignment monitoring and Private Safety Processing (PSP), which reviews encrypted records for misuse without exposing prompts to OpenAI personnel.

OpenAI is also targeting the protection of critical infrastructure, such as power plants and water treatment facilities. The company has introduced a $1 billion Daybreak for Frontline Defenders grant program to subsidize access for resource-constrained teams.

In a controlled lab environment, Dragos, a provider of operational technology (xOT) cybersecurity, evaluated cyber-permissive Daybreak Red models. Rob T. Lee, Chief AI Officer at Dragos, stated, "On its own, it separated the OT assets from the IT noise, then found two zero-days in engineering software that manages protective relay data, exposing protection settings and breaker trip logic."

---

Sources

• openai.com: GPT‑6 Cyber: Advancing the frontier of aligned cybersecurity agents | OpenAI

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.