OpenAI has launched GPT-6 Cyber, a specialized artificial intelligence model built to find software vulnerabilities, prove they can be exploited and propose fixes — and the company is keeping it under tight restrictions because of how powerful it is.
The model, released on November 5, is a version of OpenAI's GPT-6 Astra trained for authorized vulnerability research. In testing, OpenAI says it found 81 previously unknown vulnerabilities in the Firefox browser that Mozilla classified as high severity, and Mozilla has since shipped fixes for many of them. It also flagged 30 previously reported Firefox issues as more serious than first assessed.
In a separate research campaign on the Linux kernel, the model reproduced 1,724 vulnerabilities and developed working exploits for 948 of them, demonstrating how an attacker with low-level access could gain full administrative control. OpenAI said it disclosed 304 critical findings to Linux maintainers along with candidate patches.
On OpenAI's ExploitGym benchmark, which tests a model's ability to exploit a specified flaw on a remote target, GPT-6 Cyber scored 48.5 percent, up from 32.1 percent for its predecessor, GPT-5.6 Cyber. OpenAI has rated the new model's cybersecurity capabilities "Critical" — the highest tier in its Preparedness Framework.
Unlike a general-purpose chatbot, GPT-6 Cyber will not be available to the public. Access is initially limited to a select group of approved customers in Daybreak Red, OpenAI's program for offensive-style security work such as penetration testing and red teaming, through the company's API and its Codex coding tool. Approved users must pass identity checks, use physical security keys and connect from approved networks, and OpenAI says it has added safeguards around industrial controls, essential services and election systems.
