OpenAI Introduces GPT-6 Cyber With Improved Vulnerability Detection and Exploit Development

OpenAI announced GPT-6 Cyber on Thursday as its latest AI model to help security researchers identify software vulnerabilities, develop working exploits, and create fixes. According to the San Francisco-based company, it delivers significant improvements over GPT-5.6 Cyber on cybersecurity benchmarks, including a 51 percent relative improvement on ExploitGym. The AI model is also claimed to be capable of following authorised testing boundaries more reliably. OpenAI says GPT-6 Cyber has already helped uncover vulnerabilities in widely used software.

GPT-6 Cyber Features

In a newsroom post, OpenAI said GPT-6 Cyber is a major improvement over its predecessor, GPT-5.6 Cyber, for tasks involving software analysis, vulnerability discovery, and exploit development. The company claims that the model outperforms GPT-6 Astra on most cybersecurity tasks, even when the latter does not refuse a request. OpenAI has classified GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from the High classification assigned to GPT-5.6 Cyber.

One of the key improvements is said to be its performance on ExploitGym, a benchmark that evaluates a model's ability to exploit a specified vulnerability in a remote target. GPT-6 Cyber scored 48.5 percent on the benchmark, compared with 32.1 percent for GPT-5.6 Cyber.

OpenAI says it has also focused on improving the model's ability to stay within the boundaries of authorised security research. Cybersecurity agents can pose risks if they attempt to exploit unrelated services or ignore the restrictions set by researchers. To address this, GPT-6 Cyber has undergone specialised training to follow task limitations, respect rules of engagement, and accurately report its findings.

In an alignment evaluation called ExploitGym Honeypot, GPT-6 Cyber avoided exploiting services outside the assigned scope in 99.93 percent of tests without deployment safety prompts. This compares with 94.49 percent for GPT-5.6 Cyber. With the deployment prompts enabled, GPT-6 Cyber stayed within the authorised scope in 100 percent of the tests, according to OpenAI.

The company says the model is already being used for vulnerability research and code review. Its researchers used GPT-6 Cyber to identify 81 previously unknown high-severity vulnerabilities in Firefox, along with an additional 30 known issues that were found to be more severe than previously reported. In Linux, GPT-6 Cyber is claimed to have reproduced 1,724 vulnerabilities and developed working exploits for 948 of them.

To reduce the risk of misuse, OpenAI has also introduced additional safeguards. These include cybersecurity-specific monitoring to check whether model actions match the user's authorisation, targeted monitoring for emerging threats, and automated checks through its Private Safety Processing system. The company has also rolled out protection against stolen credentials and requires IP allowlisting for Daybreak Red API access by default, with limited exceptions.

GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. OpenAI plans to expand access to all Daybreak Red customers in the near future.