OpenAI recently released GPT-6 Cyber, a cybersecurity-focused AI model that reportedly identifies and exploits vulnerabilities at an unprecedented scale. According to OpenAI’s announcement dated November 5th, 2026, GPT-6 Cyber can find and validate exploitable bugs, marking a significant leap from its predecessor, GPT 5.6 Cyber. The model scored 48.5% on the Exploit Gym benchmark, a 51% relative improvement over the previous version, and demonstrated strong performance in a new Remote Exploit Bench, completing 95% of tasks involving real bugs in popular software like GitLab and PostgreSQL. Additionally, it found 40.3% of vulnerabilities in web penetration testing without source code, outperforming earlier models.
One of the most striking claims is GPT-6 Cyber’s ability to reproduce 1,724 Linux kernel vulnerabilities and create working exploits for 948 of them, a more than fivefold increase compared to GPT 5.6 Cyber. OpenAI disclosed 304 critical Linux vulnerabilities with candidate patches to maintainers, highlighting the model’s practical impact. The model also uncovered 81 new high-severity bugs in the Firefox browser, which has been extensively tested over the years, along with 30 known issues that were worse than previously reported. Mozilla has already begun fixing these vulnerabilities, with a Firefox engineer praising the model’s contribution to cyber defense.
OpenAI emphasizes the importance of keeping the AI’s actions within ethical and operational boundaries. They developed an “Exploit Gym honeypot” with deliberately vulnerable services nearby to test whether the model would attack out-of-scope targets. GPT-6 Cyber stayed within bounds 99.93% of the time without explicit deployment prompts, improving to 100% with prompts. Despite this high compliance, OpenAI stresses the necessity of sandboxing, human oversight, and strict safeguards to prevent misuse, especially given the model’s critical classification under their cybersecurity preparedness framework.
The model’s deployment is currently limited to approved Daybreak Red customers, including governments and essential service providers, through a controlled API and commercial exchange (CEX). OpenAI has launched a $1 billion Daybreak grant program to subsidize access for frontline defenders, reflecting the model’s potential to transform cybersecurity defense. However, the broader community awaits independent verification of OpenAI’s claims, including third-party reruns of benchmarks and Mozilla’s own bug counts, to fully validate the model’s effectiveness and safety.
In summary, GPT-6 Cyber represents a major advancement in automated vulnerability discovery and exploitation, with impressive results on Linux and Firefox security. While OpenAI’s self-assessment is promising, the cybersecurity community remains cautious, emphasizing the need for transparency, external validation, and robust safeguards. Security professionals are encouraged to apply for access, rigorously sandbox the model, and share their experiences to help shape the responsible use of this powerful technology.
Useful Links
