OpenAI revealed GPT-6 Cyber, a new artificial intelligence model that discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws.
The company announced the model Thursday, saying it significantly improves on previous AI models by finding software vulnerabilities, validating their impact and helping developers create fixes.
During security testing, GPT-6 Cyber discovered 81 previously unknown high-severity vulnerabilities in Firefox and helped develop fixes, many of which Mozilla has already released.
Separately Linux Kernel ResearchThe model identified 2,308 potential security vulnerabilities, successfully reproduced 1,724 vulnerabilities, and developed local privilege escalation exploits for 948 distinct vulnerabilities that could allow an unprivileged user to gain root access.
In benchmark testing, GPT-6 Cyber successfully exploited 48.5% of vulnerabilities in ExploitGym, compared to 32.1% for GPT-5.6 Cyber.
Source: OpenAI
OpenAI classified the new model as having “critical” cybersecurity capabilities in its readiness framework, up from the “high” classification given to its previous model.
The new model is not publicly available, with access currently limited to a select group of approved customers in OpenAI’s Daybreak Red. OpenAI plans to expand access to all Daybreak Red customers soon.
Daybreak Red supports advanced exploit development and authorized security testing, while the company’s Daybreak Blue program allows verified defenders to investigate vulnerabilities and validate patches with fewer restrictions.
OpenAI warned that defenders have a limited window to use increasingly powerful AI models to discover and fix vulnerabilities before similar capabilities are more widely available to attackers.
“It is clear that we have a limited window to use boundary models to secure software,” OpenAI said.
Recent research and breaches illustrate how AI is already accelerating vulnerability discovery and cyberattacks.
In October, researchers from OpenAI, Calif and Wiz used AI models to discover two critical PHP vulnerabilities, dubbed PHP2Shell, that attackers began targeting even before security patches were released.
This week, a security researcher revealed that he used AI agents to perform approximately 17,600 authentication tests and discovered a previously unknown OpenSSH authentication bypass flaw, known as “*sshole.”
Artificial intelligence is also increasingly being used to automate cyberattacks, with autonomous AI agents demonstrating the ability to compromise real-world systems.
In August, nearly 700 malware agents powered by an OpenAI model escaped a controlled test environment and exploited vulnerabilities to compromise Hugging Face’s infrastructure.
More recently, Chinese hackers used an AI-based penetration testing framework called ARTEX to automate cyberattacks against more than 200 organizations worldwide, compromising at least nine.
OpenAI announced plans to expand its Daybreak programs to offer advanced cybersecurity research tools to organizations of all sizes, independent researchers, and open source maintainers.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
