OpenAI Unveils GPT-6 Cyber for Authorized Vulnerability Research
Summary
OpenAI says GPT-6 Cyber improved exploit-task performance, reproduced Linux kernel vulnerabilities and identified Firefox flaws; it adds scope safeguards. Access is limited to approved Daybreak Red customers, while Mozilla patches roll out.
Key points
- On ExploitGym, GPT-6 Cyber scored 48.5% on exploiting flaws in remote targets, versus 32.1% for GPT-5.6 Cyber.
- OpenAI researchers say GPT-6 Cyber reproduced 1,724 Linux kernel vulnerabilities and built functional privilege-escalation exploits for 948; GPT-5.6 Sol produced 166 using the same tooling.
- OpenAI says it reported 304 critical issues to maintainers with proposed fixes.
- The model documented 81 Firefox flaws that Mozilla deemed high severity; Mozilla has begun rolling out patches.
- In an alignment test without deployment safety prompts, the model avoided off-limits decoy services in 99.93% of cases; with the prompts, it never targeted them.
- New safeguards monitor whether actions match a user's permissions and are intended to prevent assistance with compromising industrial controls and other safety-critical systems.
- Access is currently limited to select approved Daybreak Red customers through the API and Codex; OpenAI plans a gradual expansion.
Article Details
- Event Type
- OpenAI announced GPT-6 Cyber, a cybersecurity model for vulnerability research and authorized exploit testing.
- Impact
- OpenAI says GPT-6 Cyber scored 48.5% on ExploitGym, compared with 32.1% for GPT-5.6 Cyber. In OpenAI-reported testing, it reproduced 1,724 Linux kernel vulnerabilities and built privilege-escalation exploits for 948; OpenAI says it reported 304 critical issues to maintainers. The model also documented 81 new high-severity Firefox flaws, and Mozilla has begun rolling out patches. OpenAI describes safeguards intended to keep testing within authorized scope and limit assistance to efforts against industrial controls and other safety-critical systems. Access is currently limited to select approved Daybreak Red customers.
People
Vendors
DragosOpenAI refined these safeguards using feedback from industrial cybersecurity firm Dragos, which tested Daybreak Red models in a controlled lab.MozillaIn Firefox, the model documented 81 new flaws that Mozilla deemed high severity, backing each with evidence and reproducible tests.OpenAIOpenAI on Thursday unveiled GPT-6 Cyber, a security model the company says is far more capable than its predecessor and more disciplined about respecting the limits researchers set for it.
Products
Daybreak RedOpenAI refined these safeguards using feedback from industrial cybersecurity firm Dragos, which tested Daybreak Red models in a controlled lab.GPT-5.6 CyberOn ExploitGym, which checks whether an AI can exploit a given flaw in a remote target, the new model achieved 48.5%, up from 32.1% for GPT-5.6 Cyber.GPT-5.6 SolOpenAI researchers pointed the model at the Linux kernel, where it reproduced 1,724 vulnerabilities and built functional privilege escalation exploits for 948. GPT-5.6 Sol, tested with the same tooling, produced 166.GPT-6 CyberOpenAI on Thursday unveiled GPT-6 Cyber, a security model the company says is far more capable than its predecessor and more disciplined about respecting the limits researchers set for it.Linux kernelOpenAI researchers pointed the model at the Linux kernel, where it reproduced 1,724 vulnerabilities and built functional privilege escalation exploits for 948. GPT-5.6 Sol, tested with the same tooling, produced 166.Mozilla FirefoxIn Firefox, the model documented 81 new flaws that Mozilla deemed high severity, backing each with evidence and reproducible tests.
Tools
Industries
Critical infrastructureA dedicated Daybreak Red group for approved critical infrastructure defenders will permit sanctioned testing of critical systems.CybersecurityOpenAI rated GPT-6 Cyber as Critical for cybersecurity under its Preparedness Framework, above the High designation given to GPT-5.6 Cyber.