OpenAI has released GPT-6 Cyber, a model designed to hunt for security flaws, build working exploits, and suggest fixes.
The company states the system operates within strict boundaries. It achieved a 99.93 percent success rate in avoiding boundary violations without special safety instructions, compared to 94.49 percent for its predecessor. With safety instructions enabled, the model stayed within bounds in 100 percent of tests. OpenAI rates GPT-6 Cyber as “Critical” in its cybersecurity category, matching the rating given to GPT-6 Astra.
Performance metrics and benchmarks
On ExploitGym, a benchmark for exploiting remote vulnerabilities, GPT-6 Cyber scores 48.5 percent. Its predecessor, GPT-5.6 Cyber, scored 32.1 percent. For finding vulnerabilities in web applications without source code access, OpenAI reports a hit rate of 40.3 percent against GPT-6 Astra’s 32.0 percent.
Full results are available in the system card. All benchmark numbers come from OpenAI itself. No independent testing of the model has been published so far.
Real-world findings in Firefox and Linux
GPT-6 Cyber has already produced results in real-world security research. In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox. The browser had already been tested with earlier AI models. The model also showed that 30 already-known issues were more severe than previously thought. Mozilla accepted the reports and has already shipped fixes.
In the Linux kernel, GPT-6 Cyber reproduced 1,724 security vulnerabilities and developed working exploits for 948 of them. This is more than five times the 166 that GPT-5.6 Sol managed under the same conditions. 304 critical findings were reported to Linux maintainers along with suggested fixes.
For the Linux kernel campaign, OpenAI built a dedicated automated system of scout and analyst agents. They first scanned roughly 5,034 security-relevant locations in the kernel. This represents about seven percent of the total codebase. The system then filtered those down to 2,308 candidates and confirmed 1,724 vulnerabilities in isolated virtual machines. From there, the system developed the 948 working exploits that OpenAI had already reported. The entire run cost $1,213,430 in compute. This works out to $1,279 per exploit. Programs like Pwn2Own and TyphoonPWN have historically paid between $20,000 and $70,000 per comparable finding as a bounty.
The agents used at least ten novel attack techniques that were previously unknown even to external kernel security experts. OpenAI says the models replicated known attack patterns but also found their own approaches. How much weight that claim carries depends on how narrowly you define “own approaches.” Researchers still disagree about whether AI models can actually make new discoveries or just recombine what they’ve seen during training.
Access and safety measures
GPT-6 Cyber is initially available through the API and Codex for a select group of Daybreak Red customers. Access will be expanded gradually to all Daybreak Red customers. GPT-5.6 Cyber is being opened up to all Daybreak Red users at the same time. Alpha access to Daybreak Blue for GPT-6 Astra will be extended to more organizations and individual security researchers.
OpenAI acknowledges that as models grow more capable, abuse attempts are rising too. Some actors and groups have tried to transfer model capabilities into their own systems.
OpenAI lists several countermeasures. These include checks that verify whether a model’s actions match the user’s permissions. There is also targeted monitoring for newly disclosed vulnerabilities. Automated safety checks run through what it calls Private Safety Processing. IP-based access restrictions apply for Daybreak Red. The company recommends running the model in isolated environments with human oversight.
OpenAI is paying special attention to protecting critical infrastructure like power plants and water treatment facilities. To make access easier for defenders, the company points to its billion-dollar “Daybreak for Frontline Defenders” funding program. A new subgroup called “Daybreak Red for Critical Infrastructure” exists for authorized testing.
OpenAI talks about a limited window of opportunity in which top-tier models could be used to secure software. The goal is to expand the Daybreak program to organizations of all sizes, independent researchers, and open-source maintainers. Whether that will actually work is another question. Researchers from Epoch AI just showed that the open GLM model could have exploited known but still-unpatched Firefox vulnerabilities.
What it means
For organisations relying on software security, the immediate impact is a new source of findings. The model can identify flaws and generate code to demonstrate them, potentially reducing the time to discovery. However, the cost per exploit remains significantly lower than traditional bounties, suggesting a shift in how research is funded or conducted. Security teams must weigh the value of these automated reports against the risk of false positives or the potential for malicious actors to access similar capabilities.
