OpenAI Launches GPT-6 Cyber, a 'Critical'-Rated AI Model for Vulnerability Research
OpenAI has announced GPT-6 Cyber, a new AI model designed for security research that finds, exploits and helps fix software vulnerabilities, and that the company classifies as "Critical" under its own Preparedness Framework (cyberscoop.com, csoonline.com) — a step up from the "High" rating given to GPT-5.6 Cyber (thenextweb.com). The model is being rolled out in restricted form through OpenAI's Daybreak Red program for verified security researchers, national labs and trusted partners, rather than released publicly. OpenAI reports significant gains on internal benchmarks, including a 48.5% score on ExploitGym exploit generation and 40.3% recall on a blind web application penetration-testing benchmark, alongside improved adherence to assigned test scope (staying within bounds in 99.93% of untuned runs and 100% with active safety prompts). In real-world testing, the model reproduced 1,724 known Linux kernel bugs and built working exploits for 948 of them, leading OpenAI to report 304 critical findings to Linux maintainers, and it uncovered 81 previously unknown high-severity flaws in Firefox that Mozilla has patched.
Detalhes técnicos
OpenAI also used GPT-6 Cyber with other internal models to develop and validate a critical remote-code-execution vulnerability in Brotli, a widely used open-source compression library, which was reported and patched (cyberscoop.com). In partnership with industrial cybersecurity firm Dragos, OpenAI tested a cyber-permissive "Daybreak Red" variant of the model against a mock power plant range; without prior guidance, the model separated OT assets from IT noise and found two zero-day flaws in engineering software managing protective relay data, exposing protection settings and breaker trip logic. Dragos's Chief AI Officer, Rob T. Lee, noted that such results suggest "the skill floor is dropping for the reconnaissance and vulnerability research needed before an attack" (thenextweb.com).
Remediação
OpenAI has paired the release with layered safeguards: Private Safety Processing reviews model activity without exposing user prompt data, API access requires strict IP checks to curb stolen-credential abuse, and the company added detection controls — evaluated with Dragos — intended to block high-risk assistance targeting industrial control systems, essential services and election systems. OpenAI launched "Daybreak Red for Critical Infrastructure" to give vetted defenders safe access to the more permissive testing capability, and established a $1 billion grant fund to help public utilities improve their security posture. Access to GPT-6 Cyber itself remains restricted to vetted security researchers and partner organizations rather than general availability.
Linha do tempo
-
OpenAI Launches GPT-6 Cyber, a 'Critical'-Rated AI Model for Vulnerability Research
ler a análise desta fonte ocultar
OpenAI has announced GPT-6 Cyber, a new AI model designed for security research that finds, exploits and helps fix software vulnerabilities, and that the company classifies as "Critical" under its own Preparedness Framework (cyberscoop.com, csoonline.com) — a step up from the "High" rating given to GPT-5.6 Cyber (thenextweb.com). The model is being rolled out in restricted form through OpenAI's Daybreak Red program for verified security researchers, national labs and trusted partners, rather than released publicly. OpenAI reports significant gains on internal benchmarks, including a 48.5% score on ExploitGym exploit generation and 40.3% recall on a blind web application penetration-testing benchmark, alongside improved adherence to assigned test scope (staying within bounds in 99.93% of untuned runs and 100% with active safety prompts). In real-world testing, the model reproduced 1,724 known Linux kernel bugs and built working exploits for 948 of them, leading OpenAI to report 304 critical findings to Linux maintainers, and it uncovered 81 previously unknown high-severity flaws in Firefox that Mozilla has patched.
Technical Details
OpenAI also used GPT-6 Cyber with other internal models to develop and validate a critical remote-code-execution vulnerability in Brotli, a widely used open-source compression library, which was reported and patched (cyberscoop.com). In partnership with industrial cybersecurity firm Dragos, OpenAI tested a cyber-permissive "Daybreak Red" variant of the model against a mock power plant range; without prior guidance, the model separated OT assets from IT noise and found two zero-day flaws in engineering software managing protective relay data, exposing protection settings and breaker trip logic. Dragos's Chief AI Officer, Rob T. Lee, noted that such results suggest "the skill floor is dropping for the reconnaissance and vulnerability research needed before an attack" (thenextweb.com).
Remediation
OpenAI has paired the release with layered safeguards: Private Safety Processing reviews model activity without exposing user prompt data, API access requires strict IP checks to curb stolen-credential abuse, and the company added detection controls — evaluated with Dragos — intended to block high-risk assistance targeting industrial control systems, essential services and election systems. OpenAI launched "Daybreak Red for Critical Infrastructure" to give vetted defenders safe access to the more permissive testing capability, and established a $1 billion grant fund to help public utilities improve their security posture. Access to GPT-6 Cyber itself remains restricted to vetted security researchers and partner organizations rather than general availability.