OpenAI releases GPT-6 Cyber, a security-specialised model rated Critical for cyber capability, under restricted Daybreak access
OpenAI has unveiled GPT-6 Cyber, an AI model specialised in cybersecurity that identifies vulnerabilities, builds working exploits and proposes fixes, with access restricted to vetted professionals and organisations through the Daybreak programme. The company classified the model as Critical in cybersecurity capability under its own risk framework, one tier above the High rating given to GPT-5.6 Cyber. On open-source research, the model reproduced 1,724 vulnerabilities in Linux and produced functional exploits for 948 of them — more than five times the 166 cases exploited by GPT-5.6 Sol with the same method — and 304 critical findings were reported upstream with candidate patches. In Firefox, it surfaced 81 previously unknown issues rated high severity by Mozilla and showed that 30 known bugs were more serious than believed; the browser team has begun shipping updates. The article names no CVEs, no indicators and no threat actor, and reports no abuse in the wild, so the immediate operational impact is the prospect of faster exploit development rather than a live threat.
Detalhes técnicos
On ExploitGym, which measures exploitation of specific vulnerabilities on remote systems, GPT-6 Cyber scored 48.5%, a 51% relative improvement over GPT-5.6 Cyber's 32.1%. On black-box web application vulnerability discovery without source access, it found 40.3% of vulnerabilities versus 32% for GPT-6 Astra. Scope-respect testing showed the model avoided touching out-of-scope services in 99.93% of trials without extra safety instructions, and 100% with deployment instructions.
Remediação
Access runs through three Daybreak tracks — Daybreak Blue (defence, vulnerability validation, patch verification), Daybreak Red (advanced penetration testing and exploit development) and Daybreak Red for Critical Infrastructure (approved defenders testing energy and water systems). Initial availability is via the API and Codex for a selected set of approved Daybreak Red customers. OpenAI announced a US$1 billion subsidy programme for under-resourced teams, including government bodies and essential service providers, and applies suspicious-activity monitoring, restrictions on compromised credentials and blocks on assistance with unauthorised attacks against critical systems, while recommending isolated environments and human oversight for high-risk operations. Defenders of Linux and Firefox estates should prioritise current vendor updates, since upstream fixes from this research are being released progressively.
Linha do tempo
-
OpenAI releases GPT-6 Cyber, a security-specialised model rated Critical for cyber capability, under restricted Daybreak access
ler a análise desta fonte ocultar
OpenAI has unveiled GPT-6 Cyber, an AI model specialised in cybersecurity that identifies vulnerabilities, builds working exploits and proposes fixes, with access restricted to vetted professionals and organisations through the Daybreak programme. The company classified the model as Critical in cybersecurity capability under its own risk framework, one tier above the High rating given to GPT-5.6 Cyber. On open-source research, the model reproduced 1,724 vulnerabilities in Linux and produced functional exploits for 948 of them — more than five times the 166 cases exploited by GPT-5.6 Sol with the same method — and 304 critical findings were reported upstream with candidate patches. In Firefox, it surfaced 81 previously unknown issues rated high severity by Mozilla and showed that 30 known bugs were more serious than believed; the browser team has begun shipping updates. The article names no CVEs, no indicators and no threat actor, and reports no abuse in the wild, so the immediate operational impact is the prospect of faster exploit development rather than a live threat.
Technical Details
On ExploitGym, which measures exploitation of specific vulnerabilities on remote systems, GPT-6 Cyber scored 48.5%, a 51% relative improvement over GPT-5.6 Cyber's 32.1%. On black-box web application vulnerability discovery without source access, it found 40.3% of vulnerabilities versus 32% for GPT-6 Astra. Scope-respect testing showed the model avoided touching out-of-scope services in 99.93% of trials without extra safety instructions, and 100% with deployment instructions.
Remediation
Access runs through three Daybreak tracks — Daybreak Blue (defence, vulnerability validation, patch verification), Daybreak Red (advanced penetration testing and exploit development) and Daybreak Red for Critical Infrastructure (approved defenders testing energy and water systems). Initial availability is via the API and Codex for a selected set of approved Daybreak Red customers. OpenAI announced a US$1 billion subsidy programme for under-resourced teams, including government bodies and essential service providers, and applies suspicious-activity monitoring, restrictions on compromised credentials and blocks on assistance with unauthorised attacks against critical systems, while recommending isolated environments and human oversight for high-risk operations. Defenders of Linux and Firefox estates should prioritise current vendor updates, since upstream fixes from this research are being released progressively.