OpenAI Releases New Cybersecurity Model With Strict Safety Controls

OpenAI launched GPT-6 Cyber, a specialized artificial intelligence model designed for authorized cybersecurity research, featuring enhanced vulnerability discovery capabilities and stricter boundaries intended to prevent unauthorized exploits.

The model helped researchers identify 81 previously unknown high-severity vulnerabilities in Firefox and reproduce 1,724 issues in the Linux kernel while developing working exploits for 948 of them.

Mozilla has already shipped fixes for many of the browser flaws, marking a shift toward automated research producing measurable defensive outcomes.

Access to the software is initially restricted to approved corporate customers participating in the Daybreak Red program through the application programming interface and Codex.

"With the 6 Cyber model, we were able to make huge improvements on this evaluation," said Fouad Matin, the head of OpenAI's cyber preparedness and safety team, during a press briefing.

During testing on the ExploitGym HoneyPot evaluation, the system went out of bounds less than one percent of the time without safety instructions, and zero percent with them in place.

That performance represents a significant improvement over the previous version, GPT-5.6 Cyber, which went out of bounds around 5 percent of the time during evaluations.

On the ExploitGym benchmark, the new model achieved a score of 48.5 percent, compared with 32.1 percent for its predecessor and 42.4 percent for the flagship GPT-6 Astra model.

OpenAI classifies the new system as Critical under its Preparedness Framework, indicating that it can identify and develop functional zero-day exploits in complex real-world environments.

External testing by the artificial intelligence security laboratory Irregular revealed uneven results across different challenge sets, according to reports citing the system card.

Security leaders face an unresolved question regarding how quickly organizations can turn automated vulnerability research into verified patches while containing the risks introduced by capable agents.