NEW DELHI, Nov 6: Artificial intelligence company OpenAI has introduced GPT-6 Cyber, a specialised cybersecurity model designed to help security researchers identify software vulnerabilities, assess potential threats and develop solutions to protect digital infrastructure.
The launch comes at a time when organisations worldwide are facing increasingly sophisticated cyberattacks, with malicious actors using artificial intelligence to automate hacking activities, identify system weaknesses and develop customised methods of compromising digital networks.
The new model has been developed specifically for cybersecurity research and is intended to assist authorised security professionals in examining complex software systems. Unlike general-purpose AI models, GPT-6 Cyber is designed to handle advanced security-related tasks, including vulnerability discovery, exploit validation and the development of potential software patches.
OpenAI said the model represents a significant improvement over its predecessor, GPT-5.6 Cyber, particularly in identifying security weaknesses and remaining within the boundaries of authorised research activities.
According to the company’s evaluation, GPT-6 Cyber achieved a score of 48.5 per cent on the ExploitGym benchmark, compared with 32.1 per cent for GPT-5.6 Cyber. This represents a 51 per cent relative improvement in performance.
The benchmark measures the ability of AI systems to exploit specified vulnerabilities in controlled environments, helping researchers assess how effectively models can understand software weaknesses and demonstrate their potential security impact.
The company has also placed considerable emphasis on ensuring that the new model follows the restrictions defined by security researchers.
One of the major concerns associated with increasingly capable AI systems is the possibility that automated agents could move beyond their assigned tasks, access unrelated services or attempt to exploit systems that have not been authorised for testing.
OpenAI said GPT-6 Cyber demonstrated improved performance in this area. In its alignment evaluation, the model avoided exploiting services outside the assigned scope in 99.93 per cent of tests without additional deployment prompts. With those prompts, it remained within the authorised boundaries in all the tests conducted.
These safeguards are intended to ensure that the model can support legitimate cybersecurity investigations without unnecessarily expanding its activities beyond the systems designated for examination.
A major demonstration of the model’s capabilities involved research into the Linux operating system, whose kernel forms the foundation of numerous digital devices, servers, cloud platforms and computing systems.
OpenAI said its research team used the model as part of an automated vulnerability discovery and patch-development pipeline. The system examined thousands of potential weaknesses in the Linux kernel, reproduced vulnerabilities in controlled environments and developed proof-of-concept exploits to establish their security impact.
During the research, the pipeline identified 2,308 candidate findings and dynamically reproduced 1,724 vulnerabilities. It subsequently generated 948 working local privilege escalation exploits.
Local privilege escalation vulnerabilities can allow a person with limited access to a computer system to obtain higher-level privileges, potentially gaining administrative or root access.
Such weaknesses can be particularly dangerous in environments where multiple users, applications or services share computing resources.
OpenAI said the research pipeline also generated candidate patches for the identified vulnerabilities. Human security researchers reviewed the findings and prepared reports for the relevant software maintainers.
The company reported that the newer cyber model identified and exploited more than five times the number of Linux local privilege escalation vulnerabilities found during an earlier research exercise conducted with GPT-5.6 Sol.
The findings demonstrate how AI systems could help security teams examine large software projects more efficiently, particularly when the volume of code makes comprehensive manual inspection difficult.
However, OpenAI emphasised that automated findings require human verification. Identifying a possible weakness does not automatically establish that it can be exploited, while a successful demonstration must also be checked to ensure that the intended vulnerability was responsible.
The company said its research pipeline includes several stages, beginning with the identification of security-relevant sections of software. AI agents then examine these areas, reproduce suspected vulnerabilities, assess their potential impact and generate proposed fixes.
Human experts subsequently review the evidence before the findings are reported to software maintainers.
OpenAI also highlighted its work involving the Firefox web browser. According to the company, GPT-6 Cyber helped identify 81 previously unknown high-severity vulnerabilities in Firefox, despite the software having undergone extensive security testing.
The findings were shared with Mozilla, the organisation responsible for developing Firefox, along with supporting evidence and proposed patches. Mozilla subsequently began releasing fixes for several of the reported issues.
The development is significant because web browsers remain among the most widely used applications and regularly handle sensitive information, including passwords, financial details, personal communications and business data.
A vulnerability in a browser can potentially expose users to malicious websites, unauthorised access or other forms of cyber exploitation.
OpenAI said the model has also been used by security teams at organisations including Cisco, Calif and CodeRabbit for vulnerability research and code review.
OpenAI+1
The company has classified GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, reflecting the model’s advanced capabilities in identifying and developing exploits for software vulnerabilities.
The classification also highlights the potential risks associated with making highly capable cybersecurity models widely accessible.
As AI systems become more effective at identifying weaknesses in software, there is a possibility that malicious actors could attempt to use similar capabilities to accelerate cyberattacks.
OpenAI said it has introduced additional safeguards to reduce the likelihood of misuse. These include specialised monitoring of cybersecurity-related activities, restrictions on access to sensitive capabilities and mechanisms designed to identify attempts to use the model for unauthorised operations.
The company has also introduced measures to protect critical infrastructure, including systems used in electricity generation, water treatment and industrial operations.
Such infrastructure is particularly sensitive because a cyberattack could affect essential public services and potentially create physical safety risks.
OpenAI said access to GPT-6 Cyber would initially be limited to approved customers and authorised cybersecurity professionals through its Daybreak Red programme.
The programme is designed to support security researchers and organisations conducting legitimate vulnerability assessments and penetration testing.
The company is also expanding its Daybreak Blue initiative, which provides cybersecurity-related assistance through its general-purpose AI models.
Another important aspect of the announcement is the company’s focus on supporting open-source software communities. Many critical digital services rely on open-source components maintained by developers and research groups with limited resources.
Automated vulnerability discovery and patch development could help these maintainers identify weaknesses more quickly and prioritise security fixes.
Linux, for example, is used across cloud infrastructure, mobile devices, enterprise systems and supercomputers. A vulnerability in a widely deployed component can affect thousands of organisations and millions of users.
OpenAI believes that increasingly capable AI models could help developers identify weaknesses before malicious actors discover and exploit them.
The company has also pointed to the importance of keeping software updated. Its research found that security vulnerabilities can remain present in complex systems for extended periods, even when those systems have undergone repeated testing.
The rapid development of AI-based security tools could therefore change how software companies approach vulnerability management.
Rather than relying exclusively on periodic security audits, organisations may increasingly use automated systems to examine code continuously, identify potential problems and recommend corrective measures.
However, the introduction of advanced AI cybersecurity tools also raises questions about responsible access, independent verification and accountability.
Security experts will need to ensure that automated systems operate within clearly defined boundaries and that their findings are reviewed before changes are introduced into critical software.
OpenAI has recommended the use of isolated testing environments, human supervision and additional security checks when deploying its cybersecurity capabilities.
The launch also reflects a broader transformation in the relationship between artificial intelligence and cybersecurity. While AI-assisted attacks are becoming a growing concern for governments and businesses, advanced models are also being developed to strengthen digital defences.
Recent warnings from India’s cybersecurity agency CERT-In regarding AI-assisted attacks on financial institutions have further highlighted the urgency of improving security preparedness. The agency has identified automated tools being used to target financial organisations and exploit their digital payment systems.
The emergence of specialised defensive models such as GPT-6 Cyber could provide security professionals with additional resources to respond to this changing threat landscape.
Nevertheless, AI alone cannot guarantee protection against cyberattacks. Strong authentication, timely software updates, secure network architecture and trained security personnel will remain essential components of an effective defence strategy.
The latest development signals a shift towards greater automation in cybersecurity, with AI systems increasingly assisting researchers in identifying vulnerabilities and preparing fixes.
As organisations continue to expand their digital operations, the ability to detect and address software weaknesses quickly could become a decisive factor in protecting sensitive information and maintaining the reliability of essential technology infrastructure.
GPT-6 Cyber’s initial deployment among approved security users will provide an opportunity to assess how effectively advanced AI capabilities can be applied to real-world cybersecurity challenges while maintaining appropriate safeguards.
Focus Keyphrase: OpenAI GPT-6 Cyber cybersecurity model
Additional context for Report 1: The campaign also illustrates the risks created by interconnected financial technology platforms. Digital lenders often depend on external banking partners, payment gateways and third-party service providers to complete transactions. A weakness in one connection can create opportunities for attackers to access services beyond the originally compromised system.
Financial institutions are therefore required to examine not only their internal networks but also the security arrangements of their technology partners. Regular API testing, transaction limits, multi-factor authentication and real-time fraud alerts can help reduce the possibility of unauthorised transfers.
Additional context for Report 2: The development of GPT-6 Cyber also raises questions about the future cost and accessibility of cybersecurity services. Smaller companies and open-source developers often lack the financial resources to maintain large security teams or conduct frequent independent audits. AI-powered tools could potentially make advanced vulnerability research more accessible, provided their deployment remains controlled and affordable.
The challenge for technology companies will be to maintain a balance between making defensive capabilities available to legitimate researchers and preventing those same capabilities from being misused. Strong access controls, transparent reporting procedures and cooperation with software developers will remain important as AI becomes increasingly involved in securing digital infrastructure.