An AI model that can hack? OpenAI's new GPT-6 Cyber can find and exploit security flaws

OpenAI has released a new, reliable AI model for cybersecurity research called GPT-6 Cyber. The model comes with advanced cybersecurity capabilities that can identify, exploit, and fix software vulnerabilities while respecting the limits set by security researchers. GPT-6 Cyber comes as a major upgrade over GPT-5.6 Cyber to identify security weaknesses in software and test whether those vulnerabilities can actually be exploited by hackers.

According to OpenAI’s blog post, GPT-6 Cyber scored 48.5% on ExploitGym, compared with 32.1% for GPT-5.6 Cyber, highlighting a 51% improvement in exploit-specific vulnerabilities. OpenAI says GPT-6 Cyber is already being used to identify and validate thousands of software exploits in critical projects, including Linux and Mozilla Firefox.

Must read: ChatGPT Images 2.6 is here: OpenAI wants to fix one of AI image editing’s biggest frustrations

GPT-6 cyber performance and capabilities 

The company revealed that researchers used GPT-6 Cyber to identify 81 security flaws in Mozilla Firefox that were previously unknown. Mozilla classified them as high-severity vulnerabilities and has started releasing software updates to fix them. The model helped researchers develop working exploits for 948 Linux kernel vulnerabilities, and 588 of these vulnerabilities were previously unknown.

Due to its advanced capabilities, OpenAI has upgraded GPT-6 Cyber's cybersecurity risk rating from 'High' to 'Critical' under its safety framework. The model was also evaluated on RemoteExploitBench against enterprise targets including GitLab, PostgreSQL, and Jenkins; GPT-6 Cyber completed 95% of assigned tasks.

Must read: Can people at OpenAI, Google and Microsoft read your AI chats? What you should know about privacy

The model achieved a 40.3% vulnerability recall rate during black-box testing without prior access to source code, outperforming general-purpose models like GPT-6 Astra. In ExploitGym Honeypot, GPT-6 Cyber stayed strictly within bounds 99.93% of the time without deployment safety prompts, up from 94.49% for GPT-5.6 Cyber.

To prevent misuse, OpenAI has upgraded safeguards for GPT-6 Cyber with continuous misalignment monitoring, IP allowlisting for high-risk tools (Daybreak Red), and targeted oversight for critical infrastructure.

Access to GPT-6 Cyber is initially being rolled out to select cybersecurity partners, enterprise security teams, and trusted defenders through OpenAI's Codex and API platforms.