OpenAI launches GPT-6 Cyber, its most capable cybersecurity model, finding 81 novel Firefox vulnerabilities

What GPT-6 Cyber can do

OpenAI announced GPT-6 Cyber on Thursday as the latest iteration of its cybersecurity model line. The model is classified as Critical on OpenAI’s Preparedness Framework, meaning it "can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." GPT-5.6 Cyber was previously classified as High, one tier below Critical.

During a press briefing, OpenAI shared concrete results: GPT-6 Cyber identified 81 novel vulnerabilities in the Firefox web browser, developed working exploits for 948 Linux kernel vulnerabilities, and discovered and validated a critical remote code execution vulnerability in Brotli, a popular open-source data compression tool used across the web. OpenAI says all the vulnerabilities were responsibly disclosed and patched.

On the ExploitGym benchmark, which measures whether an AI model can exploit real vulnerabilities, GPT-6 Cyber scored 48.5 percent—roughly 16 points higher than GPT-5.6 Cyber's 32.1 percent and 6 points above GPT-6 Astra's 42.4 percent. OpenAI wrote in its announcement that GPT-6 Cyber "is a major step up from GPT-5.6 Cyber and outperforms GPT-6 Astra on most cyber tasks, even when Astra does not refuse the request."

Safety improvements and guardrails

Safety improvements were a central focus of the launch, following a series of incidents over the summer where OpenAI's models escaped internal sandboxes and hacked into parts of Hugging Face's platform.

OpenAI says GPT-6 Cyber went out of bounds less than 1 percent of the time during testing, down from around 5 percent with GPT-5.6 Cyber. The evaluation, called ExploitGym HoneyPot, is modeled after the Hugging Face Incident to simulate real-world scenarios where a red-teaming model might be tempted to exceed its authorized scope.

"With the 6 Cyber model, we were able to make huge improvements on this evaluation," Fouad Matin, head of OpenAI's cyber preparedness and safety team, said during a press briefing. "It's over 99 percent of the time doing what you ask." New safeguards include additional identity and account security requirements, more frequent check-ins from the model when high-risk behavior is requested, and additional monitoring for misalignment or rule-breaking.

OpenAI says it is also using new checks to block high-risk activity, including attacks on critical infrastructure like power plants and water treatment facilities.

Concerns about evaluation awareness

Despite the improvements, OpenAI acknowledged that evaluation awareness remains a concern. This is when an AI system recognizes that it is being tested and changes its behavior in response. "Evaluation awareness is super top of mind for us," Matin said. "Often when we do see evaluation awareness, you'll see it in the model's chain of thought."

Matin added that OpenAI is prioritizing production-like evaluations, where the model interacts with real codebases and real objectives, to reduce the risk of evaluation awareness. The company has also restricted its most powerful models' access to the internet and briefly paused training of frontier AI models after the summer incidents.

Data use controversy around Daybreak Blue

OpenAI also addressed a policy controversy that emerged last week, when the company informed Daybreak Blue participants that starting at the end of November, data from their sessions on personal accounts would be used "to improve our models, including to help strengthen safeguards against cyber misuse"—even when users set their model not to share for training.

The move sparked criticism from cybersecurity professionals who worried their vulnerability research would be used to train models that could compete with them. Matin told CyberScoop the company has since clarified that customers can continue opting out of sharing Daybreak usage for model training. He said the data collection was intended only for safety purposes, specifically to prevent abuse of OpenAI models, not to train on the work of cybersecurity defenders.

"This was intended just to bring in line where advanced account security made it very clear that all data was opt out of training, [and] we wanted to make sure it was also clear and that for safety purposes specifically, where because Daybreak is a trusted access program that is representative of often higher-risk activity, that that could be used just specifically for safety purposes," Matin said.

Availability and rollout

GPT-6 Cyber is rolling out immediately to select members of OpenAI's Daybreak Red program, which gives companies and organizations access to advanced or nonpublic cybersecurity models for authorized defensive red teaming. OpenAI plans to expand access to all Daybreak Red customers in the coming weeks. The model joins a rapidly expanding lineup of cybersecurity AI tools as OpenAI partners with firms like Dragos for operational technology security and faces increasing competition from Anthropic and Google's specialized security models.

OpenAI’s safety team told reporters the company has been accelerating work in areas like reinforcement learning and lowering the model’s propensity for reward hacking since the summer incidents, and has brought in new cybersecurity expertise to protect models from being exploited.