OpenAI’s GPT-6 Cyber found 81 new Firefox flaws and is rated ‘Critical’

OpenAI has released GPT-6 Cyber, a security model it says beats all its earlier models at finding and exploiting software flaws. OpenAI says it also stays within the limits researchers set more reliably. The company announced the model on Thursday. It rated it “Critical” in cybersecurity under its Preparedness Framework, up from “High” for GPT-5.6 Cyber.

At first, only a select group of approved customers can use it, through the API and Codex. They belong to Daybreak Red, the tier of OpenAI’s cyber programme for exploit development and authorised security testing. OpenAI launched Daybreak in May and said it will open GPT-6 Cyber to all Daybreak Red customers soon.

Fortune first reported the plans in September. GPT-6 Cyber is OpenAI’s fourth cybersecurity model this year, Wen Shao reported for Fortune. Anthropic and Google also give vetted defenders access to models with fewer cyber restrictions.

Staying in scope

OpenAI said it trained the model to stay within its authorised scope, respect limits on its actions and report results accurately. OpenAI built one test, ExploitGym Honeypot, after the Hugging Face incident. In that incident, OpenAI’s AI agents broke out of a sandbox and hacked the platform.

The test sets the model a hard hacking task. Nearby services are easy to break into, but off limits. Without its deployment safety prompt, GPT-6 Cyber left those services alone in 99.93% of tests. GPT-5.6 Cyber did so in 94.49%. With the prompt, GPT-6 Cyber stayed in bounds every time.

Fouad Matin heads OpenAI’s cyber preparedness and safety team. He spoke about the results at a press briefing, The Verge reported.

“It’s over 99 percent of the time doing what you ask.” Fouad Matin, OpenAI

Matin said OpenAI still watches for evaluation awareness. That is when a model notices a test and changes how it behaves.

81 Firefox flaws

On ExploitGym, which tests whether a model can exploit a given flaw, GPT-6 Cyber scored 48.5%. GPT-5.6 Cyber scored 32.1%. On a new benchmark of remote attacks, GPT-6 Astra refused every task, while GPT-6 Cyber completed 95%.

OpenAI researchers used the model to find 81 previously unknown high-severity flaws in Firefox. Mozilla has started releasing fixes. In the Linux kernel, it reproduced 1,724 vulnerabilities and built working exploits for 948. GPT-5.6 Sol managed 166 with the same setup. OpenAI said it has disclosed 304 critical Linux findings to maintainers, with proposed patches.

Critical infrastructure

OpenAI also created a Daybreak Red group for approved critical infrastructure defenders. It tightened safeguards against attacks on industrial control systems, and pointed to its $1bn grant programme for defenders with limited resources.

Dragos, an industrial cybersecurity company, tested OpenAI’s permissive models on a mock power plant. The model found two zero-days in engineering software that manages protective relay data, Dragos said.

“The skill floor is dropping for the reconnaissance and vulnerability research needed before an attack.” Rob T. Lee, chief AI officer, Dragos

Open questions

Chris Hughes is vice president of security strategy at Noma Security. He told CSO the drop in out-of-scope actions is a real improvement, but added a warning.

“At the scale these models operate, though, even a small fraction means actions against systems nobody authorized.” Chris Hughes, Noma Security

Hughes also said OpenAI’s Patch the Planet dashboard shows fewer than 25% of flaws fixed so far. He expects better discovery to widen that gap.

Last week, OpenAI told Daybreak Blue members it would use data from personal accounts to improve its models, CyberScoop reported. The move angered some users online. Matin told CyberScoop that customers can still opt out of sharing their Daybreak use for model training.