The company launched the model on Thursday through its Daybreak Red programme, initially making it available to selected customers using its application programming interface and Codex coding platform. OpenAI classified its cybersecurity capabilities as Critical under its Preparedness Framework, reflecting the potential for advanced systems to assist both defenders and attackers.
OpenAI said the model identified 81 previously unknown high-severity vulnerabilities in Mozilla’s Firefox browser and produced reproducible evidence to support their investigation. Its researchers also established that 30 previously identified Firefox issues were more serious than initially assessed. Mozilla has released fixes for many of the newly identified weaknesses, according to OpenAI.
The company reported substantial results from research involving the Linux kernel. GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 of them. OpenAI said it disclosed 304 critical findings to maintainers, accompanied by proposed patches, while work to address other flaws continues.
The findings illustrate the model’s ability to move beyond identifying suspicious code towards demonstrating whether weaknesses can actually be exploited. Such validation can help developers prioritise repairs, although the same capability creates risks if placed in unauthorised hands.
On ExploitGym, a controlled benchmark measuring exploitation of specified vulnerabilities, GPT-6 Cyber achieved a success rate of 48.5 per cent, compared with 32.1 per cent for GPT-5.6 Cyber. The increase represented a relative improvement of approximately 51 per cent.
A separate assessment of web penetration testing, conducted without giving models access to application source code, recorded vulnerability recall of 40.3 per cent for GPT-6 Cyber against 32 per cent for GPT-6 Astra. On RemoteExploitBench, which uses controlled deployments of applications including GitLab, PostgreSQL and Jenkins, the new model completed 95 per cent of tasks.
OpenAI emphasised that its evaluations were conducted under specified conditions and should not be interpreted as guarantees of performance across real-world systems. The company has paired stronger exploitation capabilities with additional training intended to keep the model within authorised targets and instructions.
On its ExploitGym Honeypot alignment assessment, GPT-6 Cyber avoided exploiting services outside the assigned scope in 99.93 per cent of tests without a deployment safety prompt. That compared with 94.49 per cent for GPT-5.6 Cyber. With the deployment prompt, the new model remained within scope in every test reported.
Those results do not eliminate the possibility of misuse or operational mistakes. OpenAI is introducing monitoring designed to distinguish legitimate security testing from attempts to target systems without permission, alongside checks addressing dangerous assistance involving essential services and industrial controls.
Access arrangements include identity verification, organisational security requirements and restrictions on authorised use. Daybreak Red organisations must employ measures including single sign-on and multifactor authentication, while API access generally requires approved network addresses. Individual applicants face identity checks and additional account protections.
The company also recommends isolated testing environments, limits on network access and human supervision for high-risk operations. Its Private Safety Processing system provides automated misuse checks for certain customers operating under zero-data-retention arrangements, with encrypted records held in customer-controlled storage for a limited period.
OpenAI has established a dedicated Daybreak Red access group for approved critical infrastructure defenders. Its safeguards target assistance that could compromise industrial equipment, disrupt essential services or create risks of physical harm, while allowing authorised specialists to examine vulnerabilities.
Cybersecurity company Dragos evaluated permissive models in a simulated power plant environment. Its chief artificial intelligence officer, Rob T. Lee, said the system distinguished operational technology assets from other network equipment and discovered two previously unknown flaws in engineering software handling protective relay information.
The company said its own security teams also used the model during controlled investigations of infrastructure supporting advanced AI development. Agents combined weaknesses to escape isolated virtual machines and execute code on underlying hosts. OpenAI said the exercises led to software patches, tighter network restrictions and disclosures to affected maintainers. These tests were conducted as defensive research rather than attacks on public services, with findings reviewed by its security specialists.
OpenAI said organisations including Cisco and CodeRabbit are already using GPT-6 Cyber for vulnerability research and code review. The company plans to broaden Daybreak Red availability, while extending access to its less permissive Daybreak Blue programme for additional security researchers.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
