OpenAI introduces GPT-6 Cyber, a new AI model specialised in detecting and fixing vulnerabilities in software. The model performs significantly better on security benchmarks than its predecessor.
It had been nine days since OpenAI last announced a new model, so it was high time for the next launch. Today, OpenAI announces GPT-6 Cyber, which is specifically trained for security tasks. The main difference from other models in the OpenAI stable is that GPT-6 Cyber shows ‘improved reliability’ in respecting its boundaries.
OpenAI says the improvement in alignment, the process by which the model accurately follows the user’s instructions, is very large. In tests, the model stayed outside the defined scope in almost all cases. That should prevent AI agents based on the model from unintentionally attacking other systems, as OpenAI has already experienced several times.
Improved performance on benchmarks
A new model comes with benchmarks. On ExploitGym, which tests whether a model can exploit a specific vulnerability, GPT-6 Cyber scores 48.5 percent. That is a considerable increase on the 32.1 percent achieved by the previous model, GPT-5.6 Cyber. This represents a relative improvement of 51 percent in this specific area.
Besides exploiting vulnerabilities, the model has also become better at discovering new weaknesses. In web penetration tests, GPT-6 Cyber achieved a recall of 40.3 percent on vulnerabilities. That is an improvement on the 32.0 percent achieved by the more general frontier model GPT-6 Astra on comparable tasks.
Based on these benchmark scores, OpenAI labels the model as critical for cybersecurity under its own framework, whereas the previous version was still rated as high.
Real-world impact
The practical applicability of the technology has already been proven in critical software environments. Researchers used the model to identify 81 previously unknown, serious vulnerabilities in the Firefox browser. Mozilla has since released several fixes for these flaws.
The model has also achieved major results for the Linux kernel. It developed 948 exploits for vulnerabilities in the kernel, more than five times as many as was possible with earlier models. OpenAI has since shared 304 of these critical findings with the software’s maintainers.
Besides discovering flaws, the model also helps develop patches to close them. Security teams at companies such as Cisco and CodeRabbit are currently using the technology for code reviews and vulnerability research.
Protecting critical infrastructure
As the model’s capabilities grow, OpenAI is tightening its safety measures. New controls have been added to detect and block misuse, especially when it concerns sensitive systems such as power plants or water treatment facilities.
The company is working with partners to test the effectiveness of these safeguards in controlled environments. The aim is to give defenders the right tools without the technology being usable to disrupt industrial control systems.
GPT-6 Cyber is currently available via the API to a select group of approved customers. Access will be expanded soon, but the model is unlikely to become available to the general public any time soon.