Editorial illustration for OpenAI rates GPT-6 Cyber "Critical" for breaking and fixing systems
GPT-6 Cyber Finds Software Bugs Before Attackers
OpenAI rates GPT-6 Cyber "Critical" for breaking and fixing systems
OpenAI released GPT-6 Cyber this week, a version of its flagship model built for one job: finding holes in software before attackers do. The company says the model can locate vulnerabilities, write exploits that actually work, and then turn around and recommend a fix for the same bug it just broke.
That dual capability is the whole point, and also the obvious worry. A model good enough to hand a defender a working patch is a model good enough to hand an attacker a working exploit. OpenAI has run GPT-6 Cyber against real targets to show what it can do.
In Firefox, the model turned up 81 critical vulnerabilities nobody had flagged before, all now patched by Mozilla. In the Linux kernel, it reproduced 1,724 known vulnerabilities and built functioning exploits for 948 of them, a jump of more than five times over the previous model's output.
Numbers like that raise the obvious question of control: what stops a model this capable from wandering outside the systems it's supposed to be testing. OpenAI says it built in guardrails for exactly that scenario, and tested them against a scenario drawn from an incident most of the AI world remembers.
In the Linux kernel, GPT-6 Cyber reproduced 1,724 security vulnerabilities and developed working exploits for 948 of them, more than five times the 166 that GPT-5.6 Sol managed under the same conditions, according to OpenAI. 304 critical findings were reported to Linux maintainers along with suggested fixes, the company says.
Why this matters
A model that found 81 unknown critical bugs in Firefox and built working exploits for 948 Linux kernel vulnerabilities isn't a research curiosity anymore, it's infrastructure. Mozilla patched its holes fast because OpenAI disclosed them first, but that's the best-case scenario. The same weights that generate a patch can generate the exploit, and OpenAI's own "Critical" rating on its Preparedness Framework is an admission that the defensive and offensive capabilities are inseparable here.
For developers and founders building on top of frontier models, the ExploitGym score of 48 matters less than the trend line: these systems are closing in on autonomous vulnerability research at a pace that outstrips most internal security teams' patch cycles. Researchers should be asking who gets access to GPT-6 Cyber before attackers find their own version of it, and what disclosure norms OpenAI actually commits to versus what it publishes in a benchmark table. Capability races in cybersecurity don't wait for consensus on safe deployment.
Watch whether OpenAI restricts access to this model, and how fast comparable tools show up outside a lab with a Preparedness Framework at all.
Related Reading
Browse all OpenAI news →
LLMs & Generative AI ChatGPT's 'Nerdy' tweak rewards goblin metaphors in answers, study finds
LLMs & Generative AI Google to End Free Access to Gemini AI for Non-Subscribers
LLMs & Generative AI AI Engineers Face Rising Costs, Need New Strategies for Efficiency
Related Topic OpenAI AGI chief takes leave as company buys viral talk show TBPN today
Business & Startups
Related Topic OpenAI's GPT Transcribe Cuts Error Rate to 3.31%, Improving on GPT-4o
Open Source
From Archives Google's Gemini Omni 1.2 Flash Extends AI Video to 15 Seconds, Cuts Prices 30%
From Archives Online requantization smooths checkpoint conversion to serving formats
From Archives OpenAI Releases Cybersecurity Model; Alpha in Unaudited Code via AI
Open Source
From Archives OpenAI’s GPT-6 Cyber Rated Critical for Zero-Day Exploit Ability
Common Questions Answered
What is the primary purpose of GPT-6 Cyber and how does it differ from previous versions?
GPT-6 Cyber is specifically designed to find security vulnerabilities in software systems before attackers can exploit them. Unlike previous versions, it has the unique dual capability to both locate vulnerabilities, write working exploits, and recommend fixes for the same bugs it discovers, making it significantly more powerful than GPT-5.6 Sol which managed only 166 exploits compared to GPT-6 Cyber's 948.
How many Linux kernel vulnerabilities did GPT-6 Cyber reproduce and exploit according to OpenAI's testing?
According to OpenAI, GPT-6 Cyber reproduced 1,724 security vulnerabilities in the Linux kernel and developed working exploits for 948 of them, which is more than five times the 166 exploits that GPT-5.6 Sol managed under the same conditions. The company reported 304 critical findings to Linux maintainers along with suggested fixes.
What is the main security concern with GPT-6 Cyber's capabilities?
The primary concern is that a model powerful enough to generate defensive patches and fixes for vulnerabilities is equally capable of generating working exploits that attackers could use. OpenAI's own "Critical" rating on its Preparedness Framework acknowledges that the defensive and offensive capabilities are inseparable, meaning the same model weights that help defenders can help attackers.
How many critical vulnerabilities did GPT-6 Cyber find in Firefox?
GPT-6 Cyber found 81 unknown critical bugs in Firefox and built working exploits for them. Mozilla was able to patch these vulnerabilities quickly because OpenAI disclosed them responsibly before they could be exploited maliciously.
Further Reading
- OpenAI's GPT-6 Cyber ups the ante on vulnerability discovery - CSO Online
- OpenAI says its new cybersecurity model is better at not hacking other companies - The Verge
- OpenAI launches GPT-6 Cyber with 'Critical' cybersecurity rating - Reuters
- OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement' - The Register
- OpenAIs GPT-6 Cyber can both break into systems and propose how to fix them - The Decoder
