OpenAI's GPT-6 Cyber can find software flaws and build exploits: Here's what it can do

OpenAI has entered a new phase of the artificial intelligence cybersecurity race with GPT-6 Cyber, a specialised model designed to discover software vulnerabilities and develop working exploits. The company says the model has made significant progress over its predecessor, GPT-5.6 Cyber, and can outperform its general-purpose GPT-6 Astra model on most cybersecurity tasks.

The announcement is significant because AI tools that can identify software weaknesses could help security researchers fix vulnerabilities faster. However, the same capabilities could also be misused by attackers. OpenAI is therefore restricting initial access to selected cybersecurity professionals.

What can OpenAI's GPT-6 Cyber do?

According to OpenAI, its researchers used GPT-6 Cyber to develop working exploits for 948 Linux kernel vulnerabilities. The company also says the model identified 81 previously unknown high-severity vulnerabilities in Mozilla Firefox. Mozilla was informed about the findings and has started releasing fixes for several critical flaws, according to the supplied information.

The model also recorded a score of 48.5 per cent on the ExploitGym benchmark, compared with 32.1 per cent for GPT-5.6 Cyber. ExploitGym evaluates an AI model's ability to exploit known software vulnerabilities. The higher score indicates improved performance on this particular benchmark.

Why is OpenAI restricting access?

GPT-6 Cyber's ability to discover vulnerabilities and develop exploits creates security risks if the technology reaches unauthorised users. OpenAI is initially making the model available through its API and Codex to selected customers approved for its Daybreak Red programme. The aim is to give trusted security researchers and defenders access to advanced AI capabilities while reducing the risk of malicious use. This approach reflects a growing challenge for AI developers: the same technology that helps identify weaknesses before criminals exploit them can also make cyberattacks more sophisticated.

GPT-6 Cyber vs Anthropic, Google and Microsoft

OpenAI's announcement comes amid growing competition in AI-powered cybersecurity.

Rivals include Anthropic's Claude Mythos Preview, Google's Gemini 3.8 Flash Cyber and Microsoft's AI-focused MDASH system. These products are not identical, but they operate in the same emerging area of AI-assisted vulnerability discovery, exploit testing and software protection. OpenAI says GPT-6 Cyber represents a major improvement over GPT-5.6 Cyber and outperforms GPT-6 Astra on most cybersecurity tasks. The larger question is how quickly AI companies can make these tools useful to security teams without putting powerful exploitation capabilities into the wrong hands.