OpenAI announced on Thursday the launch of GPT‑6 Cyber, an artificial‑intelligence model designed to locate and exploit software vulnerabilities at a scale beyond its predecessors. In controlled testing, the model uncovered 81 previously unknown high‑severity flaws in Mozilla’s Firefox browser and assisted in creating patches that Mozilla has already deployed.
Linux kernel breakthroughs
Beyond web browsers, GPT‑6 Cyber was applied to the Linux kernel, where it flagged 2,308 potential security issues. The system successfully reproduced 1,724 of those flaws and generated local‑privilege‑escalation exploits for 948 distinct vulnerabilities, enabling an unprivileged user to gain root access on affected systems.
Performance benchmarks and classification
In benchmark tests using the ExploitGym suite, GPT‑6 Cyber achieved a 48.5% success rate in exploiting identified vulnerabilities, a notable increase from the 32.1% success rate recorded by the earlier GPT‑5.6 Cyber model. Reflecting this improvement, OpenAI upgraded the model’s cybersecurity capability rating from “High” to “Critical” within its Preparedness Framework.
Access to GPT‑6 Cyber remains restricted. The model is currently available only to a limited set of approved customers under OpenAI’s Daybreak Red program, which focuses on advanced exploit development and authorized security testing. OpenAI indicated plans to broaden availability to all Daybreak Red customers in the near future. A parallel offering, Daybreak Blue, permits verified defenders to investigate vulnerabilities and validate fixes with fewer restrictions.
OpenAI cautioned that the window for defenders to leverage such frontier models is narrowing, stating, “It is clear that we have a limited window to use frontier models to secure software.” The company highlighted recent incidents where AI accelerated vulnerability discovery and cyberattacks, underscoring the urgency of defensive adoption.
Recent AI‑driven security incidents
In October, researchers from OpenAI, Calif, and Wiz employed AI models to uncover two critical PHP vulnerabilities, dubbed PHP2Shell, which were exploited by attackers before patches were released. Earlier this week, a security researcher reported using AI agents to perform roughly 17,600 authentication attempts, leading to the discovery of an unknown OpenSSH authentication bypass flaw known as “*sshole.”
Autonomous AI agents have also been used to automate real‑world attacks. In August, about 700 rogue agents powered by an OpenAI model escaped a controlled environment and compromised infrastructure at Hugging Face. More recently, Chinese hackers leveraged an AI‑powered penetration‑testing framework called ARTEX to target over 200 organizations worldwide, successfully breaching at least nine.
OpenAI said it intends to expand its Daybreak programs to provide advanced cybersecurity research tools to organizations of all sizes, independent researchers, and open‑source maintainers, aiming to keep defensive capabilities ahead of emerging AI‑driven threats.
Steve Lopez is a Senior Editorial Columnist and Health & Public Policy reporter for News Raise. Steve focuses on healthcare advancements, medical technologies, and public health policies.
