On November 5, 2026, OpenAI announced the launch of the GPT-6 Cyber Model, designed to help security researchers discover and investigate software vulnerabilities and develop necessary fixes before they are exploited by malicious actors.
The company classified the model's capabilities in the field of cybersecurity at the "Critical" level “Critical” according to its risk assessment framework, compared to the “High” level it gave to the previous generation GPT-5.6 Cyber.
This rating does not indicate an actual attack or new hack, but rather the level of technical capabilities demonstrated by the model in specific security tests.
OpenAI+1
Outstanding results in Firefox And Linux
One of the most notable results presented by OpenAI was the model's contribution to the discovery of 81 previously unknown vulnerabilities in the Firefox browser, which Mozilla classified as high risk.
The company said that it had submitted the research results to Mozilla, with proposals for reform, and that the latter had begun issuing patches for a number of Problems discovered.
In separate Linux kernel research, GPT-6 Cyber helped reproduce 1,724 vulnerabilities and develop practical verification methods to exploit 948 of them within authorized research environments.
The company reported that it had informed Linux developers of 304 critical findings, accompanied by suggestions to correct the problems.
And who It is necessary to distinguish here between vulnerabilities that have been tested for exploitation within a research environment, and vulnerabilities that have been subjected to attacks in real systems. The published numbers do not mean that 948 devices or systems were compromised.
OpenAI
Improvement in aptitude tests
OpenAI tests showed Internal model performance on the ExploitGym benchmark increased to 48.5%, compared to 32.1% for the previous generation GPT-5.6 Cyber.
This criterion measures the model's ability to deal with specific security issues within controlled evaluation environments, and does not represent a general success rate in all types of attacks or protection tests. realism.
The company also announced results regarding the model's ability to adhere to its stated mission scope, which is a critical issue when using systems that operate with a degree of autonomy.
One evaluation showed that the model avoided dealing with services outside the specified scope in 99.93% of cases. Of the cases without additional deployment instructions, the percentage reached 100% in test conditions with those instructions applied.
These results are based on published evaluation methodology and are not a guarantee that errors will not occur in every future use.
Why do new capabilities spark a security debate?
The sensitivity of cybersecurity niche models lies in their dual-use nature.
A security researcher may benefit from a model capable of analyzing complex code, discovering a problem that is difficult to observe, and proving its seriousness in a way that helps developers fix it.
But analytical abilities Developed software may also be of value to parties seeking to exploit systems without permission.
That's why OpenAI is trying to combine improving research capabilities with restrictions on access to the model and monitoring uses associated with high-risk activities.
Access via Daybreak Red
The company explained that Initial availability of GPT-6 Cyber is limited to a select group of customers certified in the Daybreak Red program, intended for advanced, authorized security testing work.
Reuters said that the company intends to gradually expand access to other entities approved in the program over the course of Weeks following the announcement.
The controls announced by OpenAI include reviewing high-risk activities, monitoring adherence to the scope of work, and measures to protect customer credentials and limit abuse.
Reuters
What does this mean for software development?
Advanced models may change The way to organize security reviews, especially in large software projects that need continuous analysis of the code and tracking of fixes between different versions.
These tools can help reduce the time between discovering an issue and presenting it to developers in a verifiable form.
but Relying on AI models does not eliminate the need for human review or coordinated vulnerability disclosure; Inaccurate results or early disclosure of sensitive details may cause new security problems.
What's next?
The future of GPT-6 Cyber depends on how successful OpenAI is in expanding access Defensive researchers are able to access its capabilities, without turning these capabilities into tools that can be easily misused.
The results of the collaboration with Firefox and Linux developers will also be a practical indicator of the value that specialized models can add to secure software development processes.
