OpenAI has introduced GPT-6 Cyber, a model designed to help security researchers find software vulnerabilities, test whether they can be exploited, and propose fixes. Initially, it is available only to a selected group of approved customers in the Daybreak Red program.
The company announced the model on November 5. It says researchers have already used it to investigate Firefox and the Linux kernel. The results suggest how AI could help security teams examine large codebases, although people still need to review findings and proposed patches.
What the model can do
GPT-6 Cyber is trained to investigate software, reproduce weaknesses and develop working exploits: programs or scripts that demonstrate how a vulnerability can be used. This helps researchers assess the practical impact of a problem. The model can also propose candidate patches.
On ExploitGym, a test of exploiting a specified vulnerability on a remote target, GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber. These are OpenAI's results under particular test conditions, not a guarantee of the same performance on every system.
The company also tested whether an agent would stay within the boundaries of its assignment. In one evaluation, other easily exploitable services were placed alongside the authorized target. OpenAI says the model avoided attacking out-of-scope services in 99.93% of tests without a deployment prompt and 100% with it. Those results describe a test environment; they do not remove the need for human oversight.
Firefox and Linux findings
In its Firefox research, the model produced evidence and reproducible tests for 81 previously unknown vulnerabilities that Mozilla classified as high severity. It also showed that 30 known issues were more serious than previously assessed. OpenAI says it shared reports and proposed patches with Mozilla, which began releasing fixes.
For the Linux kernel, GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 of them. The latter is a count of exploits, not a count of newly discovered bugs. Under the same setup, GPT-5.6 Sol produced 166 exploits. OpenAI says it reported 304 critical findings to Linux maintainers with candidate fixes.
Running the investigation required substantial resources. The Decoder reports that compute for the Linux research cost around $1.2 million. Finding an issue is only part of the work: maintainers must assess the report, review a fix and release an update.
Expert and community response
Rob Lee, chief AI officer at Dragos, argues that AI lowers the skill threshold for reconnaissance and vulnerability research ahead of an attack. Dragos evaluated OpenAI models in a controlled lab and worked with the company on safeguards, so his assessment comes from a partner. OpenAI published his comment.
The Hong Kong Linux User Group urged caution about OpenAI's totals without independent verification and details of individual findings. Mozilla has published Firefox fixes, but those releases alone do not independently verify every model-specific figure. We found no public independent evaluation of GPT-6 Cyber in the available sources.
Who can use it
Initially, GPT-6 Cyber is available through the API and Codex to selected approved Daybreak Red customers. OpenAI plans to expand access to the rest of the program gradually. Daybreak Red supports advanced vulnerability research and authorized security testing.
OpenAI classifies GPT-6 Cyber as Critical for cybersecurity under its own risk framework and recommends sandboxing, action review and human oversight for high-risk workflows. The practical value will depend not just on the number of findings, but also on how quickly teams can verify and fix real problems.
Sources: OpenAI, The Decoder, TechCrunch.