OpenAI unveils GPT-6 Cyber for security research and defence

OpenAI has unveiled GPT-6 Cyber, a specialised AI tool marketed for cybersecurity research and defensive operations. The company says the model is designed to discover critical software bugs rapidly and to help developers fix dangerous code flaws, while operating strictly within assigned task limits during tests.

In OpenAI’s briefing, GPT-6 Cyber is positioned as a frontline defence aid for ethical researchers and security teams, aiming to identify bugs before they can be exploited by attackers, and to assist in hardening codebases used in critical infrastructure and consumer software alike.

The article highlights strong benchmark gains: on ExploitGym the model scored 48.5% on exploit generation, a 51% relative improvement over GPT-5.6 Cyber, and it achieved 40.3% recall in blind web application evaluations. It is also described as maintaining strict operational boundaries during autonomous testing, with honeypot experiments showing 99.93% of untuned runs remaining within scope and 100% compliance under active prompt instructions.

Real‑world testing is asserted as well: the Linux kernel audit reportedly reproduced 1,724 known bugs, with working privilege escalation exploits crafted for 948 of them, and Firefox source analysis reportedly surfaced 81 novel high‑risk flaws, with patches issued promptly by Mozilla engineers. Mozilla’s Brian Grinstead is quoted praising the model’s practical impact on hardening and patching.

In the domain of critical infrastructure, OpenAI collaborated with Dragos to assess industrial control environments, where the model reportedly separated OT from IT noise and uncovered two zero‑days in engineering software managing protection data. OpenAI subsequently announced Daybreak Red for Critical Infrastructure, a testing program for verified teams, alongside a $1 billion grant fund to aid utilities in safeguarding vital assets. The rollout is described as guarded, with Private Safety Processing and strict IP checks guiding access for verified defenders and trusted partners.