Thought Leadership
OpenAI says the model identified 81 critical vulnerabilities in Firefox and helped develop 948 Linux exploits. Initial access is limited to selected Daybreak customers.
OpenAI has introduced GPT-6 Cyber, an AI model designed specifically for security research. It aims to help security researchers identify vulnerabilities, understand potential attack paths, and develop fixes. At the same time, the model has been specifically trained to respect the rules and operational boundaries defined by researchers. Initial access is being granted to selected customers through the Daybreak Red program, including customers in Europe.
More Exploits, Fewer Boundary Violations
In the ExploitGym benchmark, which measures a model’s ability to exploit a given vulnerability, GPT-6 Cyber scored 48.5 percent, compared with 32.1 percent for its predecessor, GPT-5.6 Cyber, according to OpenAI. In a separate test measuring whether the model stays within the scope of an assigned task, GPT-6 Cyber refrained from attacking services outside the authorized environment in 99.93 percent of cases. GPT-5.6 Cyber achieved 94.49 percent. These figures have not been independently verified.
OpenAI has also implemented safeguards designed to detect unauthorized behavior and block assistance with high-risk activities.
81 Critical Vulnerabilities Found in Firefox
In practical testing, OpenAI researchers used GPT-6 Cyber to identify 81 previously unknown vulnerabilities in the Firefox browser. Mozilla classified the flaws as critical. The codebase had already been examined using several generations of leading AI models. OpenAI provided Mozilla with reproducible tests and proposed patches. Mozilla has since begun releasing security updates to address the vulnerabilities.
The model also helped identify 948 vulnerabilities in the Linux kernel and develop working exploits for them. Of these, 588 were previously unknown flaws. OpenAI had already detailed the automated pipeline behind this work on November 4. The run cost approximately USD 1.2 million. According to OpenAI, the company provided maintainers with detailed reports and patch proposals.
Security Sprint and Higher Bug Bounties
OpenAI is also preparing another internal security sprint. External researchers and partners will work alongside OpenAI teams to test the company’s defenses using its AI models. The company has increased rewards in its bug bounty program and introduced bonuses for particularly high-quality reports. According to Reuters, employees had spent years warning about weaknesses in OpenAI’s operational security. Other providers are also making specialized models available for cyber defense. Google is initially restricting access to Gemini 4 Carbon to selected defenders, while Anthropic is providing selected organizations with access to its Mythos models through Project Glasswing.
(Editorial Team)
