- Published on
OpenAI's strongest cybersecurity AI model: GPT-6 Cyber debuts, performance improved by 51%, discovers 81 new vulnerab...
- Authors
- Name
- DeepHorus
OpenAI released its cybersecurity-specific model GPT-6 Cyber on November 5, saying that it significantly improves over the previous generation GPT-5.6 Cyber in discovering, validating, and fixing software vulnerabilities. The company disclosed that the model scored 48.5% on the ExploitGym test, a relative improvement of about 51% over GPT-5.6 Cyber's 32.1%. OpenAI sees this progress as an important signal that frontier models are entering a critical window for "using AI to protect software."
The ExploitGym benchmark primarily tests whether a model can exploit specified remote vulnerabilities, so its score is regarded as an important indicator for measuring the real-world capabilities of cybersecurity models. GPT-6 Cyber's increase from 32.1% to 48.5% shows that it has made notable progress in the vulnerability exploit validation stage. OpenAI also emphasized that improvements in model capability come with higher risks of misuse and require strict safety measures.
In safety testing, when no deployment safety prompt was used, GPT-6 Cyber avoided attacking services outside the authorized scope in 99.93% of tests; with the prompt enabled, this proportion reached 100%. OpenAI said that the model is initially available only to approved Daybreak Red customers. Supporting mechanisms include abuse monitoring, credential protection, sandboxing, human oversight, and interception of high-risk behavior targeting critical infrastructure.
In terms of practical results, OpenAI researchers used GPT-6 Cyber to reproduce 1,724 Linux kernel vulnerabilities and developed working privilege-escalation exploits for 948 of them. The model also found 81 previously unknown high-severity vulnerabilities in Firefox. OpenAI has submitted evidence, reproducible tests, and candidate patches to Mozilla, and Mozilla has begun releasing fixes.
Under OpenAI's "Preparedness Framework," GPT-6 Cyber's cybersecurity risk level is classified as Critical, higher than the previous generation's High. The company has not relaxed restrictions because of the capability improvements; instead, it emphasizes controlled release and continuous monitoring. For behavior related to critical infrastructure, OpenAI has set up a dedicated interception mechanism to reduce the possibility of model misuse.
OpenAI said that in the future it will expand the coverage of the Daybreak program to help various organizations, independent researchers, and open-source maintainers conduct vulnerability research, code review, and patch development. The company believes that frontier models are entering a critical window for "using AI to protect software." As the scope of access expands, how to strike a balance between improving defense efficiency and controlling misuse risks will become a focus of industry attention.
