OpenAI releases AI model built to find and exploit software vulnerabilities

OpenAI on November 5 released a specialized artificial intelligence model built specifically to find and exploit software vulnerabilities, its fourth cybersecurity-focused model this year and the most capable one yet. The system, called GPT-6 Cyber, is not available to the public. OpenAI has restricted it to a small number of vetted security teams through a program called Daybreak Red, and has classified it as "Critical" under its internal Preparedness Framework, the company's highest risk tier, up from "High" for its predecessor, GPT-5.6 Cyber, which shipped in August.

Benchmark scores and real-world finds

In tests OpenAI ran before release, GPT-6 Cyber scored 48.5 percent on ExploitGym, an internal benchmark that measures whether a model can turn a known flaw into a working exploit, compared with 32.1 percent for GPT-5.6 Cyber, according to CybersecurityNews' account of OpenAI's technical materials. On RemoteExploitBench, a separate test built around exploiting remotely reachable services, the new model completed 95 percent of tasks, the outlet reported.

OpenAI also described two exercises against real, widely used codebases. Turned loose on Firefox's source code, the model surfaced 81 previously unknown, high-severity vulnerabilities that Mozilla is now working through, according to reporting from CyberInsider and Fortune. Set against the Linux kernel, it produced working exploits for 948 vulnerabilities, 588 of which had not been previously documented; many of the kernel flaws could let a local attacker escalate to root privileges, Fortune reported. That is more than five times the number of Linux exploits a GPT-5.6-generation model produced in a July study, per Fortune's account of OpenAI's materials.

OpenAI additionally reported a scope-adherence metric specific to dual-use tools of this kind: how often the model stays inside the bounds of an authorized engagement rather than probing systems it was not asked to test. Without an explicit safety instruction, the model reportedly stayed in scope in 99.93 percent of trials, up from 94.49 percent for GPT-5.6 Cyber; with a deployment-time safety prompt added, it stayed in scope in every tested case, according to specialist coverage of OpenAI's release materials.

An AI arms race on both sides of the fence

The release lands amid what Fortune described as growing alarm that AI models are becoming proficient enough at finding and weaponizing software flaws to shift the balance between attackers and defenders. Gartner forecasts worldwide spending on AI-related cybersecurity products will reach $51.3 billion this year, roughly double last year's $25.9 billion, according to the research firm's estimate as cited by Fortune.

OpenAI is not alone in building restricted, less-filtered models for security work. Anthropic runs a comparable vetted-access program, Glasswing, that gives approved researchers capabilities its public Claude models otherwise decline to use, and Google offers vetted defenders access to a version of its Gemini 4 Argon model with cybersecurity guardrails removed, through a program called Fairwind, Fortune reported. Anthropic has already demonstrated the approach's payoff at Mozilla's expense: in a disclosure Anthropic published on its own site, its Claude Opus 4.6 model scanned Firefox's C++ codebase and filed 112 vulnerability reports in February, 14 of them rated high-severity, in bugs Mozilla fixed mostly in Firefox 148.

"AI is making it possible to detect severe security vulnerabilities at highly accelerated speeds," Anthropic said in its own announcement of that earlier Firefox effort.

OpenAI has treated cybersecurity as a particular growth opportunity. The company hired Dali Rajic, an executive with a cybersecurity software background, as chief revenue officer, and GPT-6 Cyber extends a cyber-focused product line that began with releases in April, June and August, according to Fortune.

Narrow access, wide implications

Because the same techniques that let a defender find and patch a flaw can also let an attacker weaponize it, OpenAI is not making GPT-6 Cyber broadly available. Access currently runs through Daybreak Red, the tier of OpenAI's Daybreak framework meant for offensive-style work such as exploit validation and red-team testing, and for now is limited to a small group of approved customers. OpenAI plans to extend it to all Daybreak Red customers over the coming weeks, Dataconomy reported. A separate tier, Daybreak Blue, is aimed at defensive work such as malware analysis and incident response and does not currently include the new Cyber model.

• Risk classification: "Critical" under OpenAI's Preparedness Framework, up from "High" for GPT-5.6 Cyber
• 81 previously unknown, high-severity vulnerabilities found in Firefox
• 948 working exploits produced against Linux kernel bugs, 588 previously undocumented
• Access restricted to vetted customers in OpenAI's Daybreak Red program

That structure keeps the model's practical effect mostly in the hands of security vendors, enterprise red teams and researchers working through coordinated disclosure, rather than the general public. Mozilla has not yet published advisories crediting GPT-6 Cyber for any of the 81 Firefox vulnerabilities it reportedly surfaced. Confirmed flaws of this kind are typically assigned a tracking identifier by the CVE Program, the federally supported system that Mozilla and the Linux kernel's security maintainers both use to catalog and patch disclosed bugs once a fix ships.

What happens next

OpenAI's planned expansion means more vetted security teams are likely to gain access to GPT-6 Cyber in the coming weeks, widening its practical footprint beyond the initial group of approved customers. Mozilla and the Linux kernel's maintainers are still working through the specific flaws the model surfaced, and formal advisories and patch notes tied to that work had not been published as of this writing. OpenAI has not said whether it will publish a full technical system card for outside researchers to review, or whether its benchmark results can be independently replicated.

The broader question hanging over the release is one OpenAI, Anthropic and Google are all now navigating in parallel: whether restricting these tools to vetted users is enough to keep the defensive advantage from eroding as the underlying capability keeps improving. Gartner's spending forecast suggests enterprises are, at minimum, betting that the answer requires buying considerably more AI-driven defense than they have so far.