OpenAI’s new cybersecurity-focused AI model also developed working exploits for 948 Linux vulnerabilities, raising a difficult question: Are we prepared for AI that can find and exploit security flaws at this scale?
Artificial intelligence is entering a fascinating new phase. And depending on who controls the technology, a potentially troubling one.
On November 5, OpenAI introduced GPT-6 Cyber, a specialized AI model designed to identify security vulnerabilities, test exploits in authorized environments, and help researchers develop fixes.
The early results are striking. According to OpenAI, the model identified 81 previously unknown high-severity vulnerabilities in Firefox and developed working exploits for 948 vulnerabilities in the Linux kernel.
We’re no longer talking about a chatbot that simply tells you to update your antivirus software. We’re talking about AI capable of investigating complex software and demonstrating how security weaknesses can actually be exploited.
What Can GPT-6 Cyber Actually Do?
GPT-6 Cyber was specifically developed for cybersecurity research. Unlike general-purpose AI models, it received additional training to identify vulnerabilities, assess their impact, develop proof-of-concept exploits, and assist security researchers with remediation.
In benchmarks published by OpenAI, the model achieved a 48.5% success rate on ExploitGym, an evaluation measuring its ability to exploit specified vulnerabilities. Its predecessor, GPT-5.6 Cyber, scored 32.1%.
That’s a significant improvement, although laboratory results don’t mean the model can successfully exploit any real-world system.
Another important development is how the model handles authorization boundaries.
After all, an AI capable of investigating computer systems shouldn’t start probing infrastructure nobody gave it permission to access.
According to OpenAI, GPT-6 Cyber respected authorization boundaries in 99.93% of tests without additional safety instructions and in 100% of tests when those instructions were included.
These results are encouraging, but they reflect specific evaluation conditions rather than a guarantee of completely safe behavior.
Firefox and Linux Are Already Among Its First Major Results
Firefox provides one of the clearest examples of the model’s capabilities. Despite years of security research and previous testing with advanced AI systems, GPT-6 Cyber identified 81 previously unknown vulnerabilities classified by Mozilla as high severity.
OpenAI says it shared the findings and proposed fixes with Mozilla, which has already released updates addressing several of the issues.
The Linux research followed a different approach. Researchers reproduced 1,724 vulnerabilities and successfully developed working exploits for 948 of them. That distinction matters: these were not 948 newly discovered vulnerabilities.
Finding an entirely new vulnerability and demonstrating how to exploit an existing one are different achievements, even though both are valuable for cybersecurity research.
OpenAI also reported submitting 304 critical findings to Linux maintainers, along with proposed fixes.
Together, these results illustrate how AI could accelerate both vulnerability discovery and the validation of security weaknesses.
Major Technology Companies Are Already Testing the Model
GPT-6 Cyber isn’t limited to OpenAI’s internal research.
According to the announcement, security teams at organizations including Mozilla, Cisco, Palo Alto Networks, and CodeRabbit are already using or evaluating its capabilities for vulnerability research, code analysis, and defensive security work.
OpenAI has also used the model to assess the security of its own infrastructure.
For organizations maintaining complex software systems, identifying weaknesses before attackers exploit them could become a significant advantage. But there’s another side to this story.
The Same Technology That Protects Systems Could Also Create Risks
Finding vulnerabilities is essential to cybersecurity. Developing exploits can also be necessary to demonstrate the severity of a security flaw and verify whether a proposed fix actually works.
The problem begins when those capabilities are used without authorization.
An AI capable of analyzing enormous codebases and developing working exploits could dramatically accelerate legitimate security research.
But similar capabilities could also benefit cybercriminals. And that’s one of the biggest challenges surrounding the next generation of cybersecurity-focused AI models.
OpenAI says it has implemented safeguards designed to monitor potential misuse, restrict unauthorized actions, and protect critical systems.
The company has also classified GPT-6 Cyber at the Critical capability level for cybersecurity under its Preparedness Framework, an internal assessment of potentially dangerous model capabilities.
For now, GPT-6 Cyber is available only to selected organizations approved through the Daybreak Red program, with access provided through the API and Codex. OpenAI plans to expand availability gradually.
The Race Between Finding Vulnerabilities and Fixing Them Just Got Faster
For decades, discovering complex software vulnerabilities required specialized expertise, dedicated tools, and considerable research time. Artificial intelligence doesn’t eliminate the need for security professionals.
But it could significantly increase the number of systems researchers can investigate and the speed at which they identify potential weaknesses. That’s an opportunity for defenders.
It’s also a serious challenge for companies that still treat cybersecurity as something to address after a product has already shipped.
GPT-6 Cyber demonstrates that AI can already contribute to identifying and validating security flaws in widely used software.
Now comes the harder part: turning those discoveries into fixes before malicious actors exploit them. Because finding vulnerabilities faster is progress. Fixing them in time is what actually keeps users safe.
