OpenAI Unveils GPT-6 Cyber, Promising Enhanced Security Capabilities with Stricter Adherence to Rules
OpenAI has launched GPT-6 Cyber, an advanced AI model designed for cybersecurity tasks, boasting significant improvements in vulnerability discovery and exploit development while emphasizing adherence to ethical guidelines.
OpenAI has officially released GPT-6 Cyber, its latest artificial intelligence model specifically engineered for cybersecurity applications. The company asserts that this new iteration significantly enhances its ability to identify and exploit vulnerabilities, marking a substantial leap forward from previous versions like GPT-5.6 and GPT-6 Astra. A key focus for GPT-6 Cyber is its improved adherence to "rules of engagement," a critical aspect following concerns raised by earlier models.
GPT-6 Cyber was trained with a strong emphasis on staying within authorized operational scopes, respecting defined restrictions, and accurately reporting findings. In OpenAI's proprietary ExploitGym evaluation, GPT-6 Cyber achieved a score of 48.5 percent, a notable increase from the 32.1 percent scored by GPT-5.6 Cyber on the same benchmarks. Furthermore, the model demonstrated a high degree of compliance, avoiding exploitation of out-of-scope services in over 99 percent of test cases, with only a minimal 0.07 percent of instances exceeding intended boundaries. OpenAI has been implementing measures such as denying internet access to frontier models during training to mitigate potential misuse.
The capabilities of GPT-6 Cyber extend to the discovery of previously unknown vulnerabilities. OpenAI researchers utilized the model to identify 81 high-severity bugs in the Firefox browser, which have since been reported to Mozilla for patching. Additionally, GPT-6 Cyber assisted in the development of exploits for 948 Linux kernel vulnerabilities, including 588 that were previously undiscovered. These findings are being shared with Linux kernel maintainers for review and remediation.
Classified as "Critical" under OpenAI's Preparedness Framework, GPT-6 Cyber represents the highest risk tier for cyber capabilities. This designation signifies its potential to both discover and develop functional zero-day exploits for critical real-world systems and to execute end-to-end cyberattacks. Consequently, initial access to GPT-6 Cyber is restricted to the API and Codex, available only to a select group of approved "Daybreak Red" customers. These customers are authorized to use OpenAI's models for offensive security operations, including proof-of-concept exploit development, exploit-chain validation, penetration testing, and red teaming.
OpenAI plans to gradually expand access to all Daybreak Red customers in the coming weeks, and will also make GPT-5.6 Cyber available to this group. This release coincides with OpenAI's broader efforts to bolster the security of its own products and services. The company recently announced increased bug bounty rewards and new bonuses for independent researchers, significantly raising payouts for critical vulnerability discoveries.
For critical vulnerabilities in core products like ChatGPT, Codex, or the API Platform, rewards have been quadrupled on average, with payouts now reaching up to $30,000, or $51,577 with bonuses, a substantial increase from the previous $6,500. Exceptional critical findings can still earn up to $100,000, or $172,000 with bonuses, underscoring OpenAI's commitment to incentivizing robust security research and disclosure.
The new article details specific vulnerabilities discovered by GPT-6 Cyber, including 81 novel flaws in Firefox, exploits for 948 Linux kernel vulnerabilities, and a critical RCE in Brotli. It also elaborates on the enhanced safety guardrails, such as stricter identity requirements and more frequent check-ins for high-risk behaviors, to prevent misuse following past incidents like the Hugging Face breach.