OpenAI Releases GPT-6 Cyber and Rates It Critical for Security
OpenAI has released GPT-6 Cyber, a model built to find and exploit security flaws, to a small group of vetted customers, and has rated it Critical under its own cybersecurity safety framework, a step up from the High rating it gave the previous model.
The rating is not a marketing label. OpenAI says its researchers used the model to find 81 previously unknown vulnerabilities in Firefox that Mozilla classified as high severity, and that Mozilla has begun releasing fixes. It also says the model helped develop working exploits for 948 Linux kernel vulnerabilities, 588 of which were previously unknown.
But the part that decides whether this is a defensive tool or a weapon is the disclosure trail. OpenAI says it has disclosed 304 critical Linux findings to maintainers along with proposed patches, which is the behaviour of a security research outfit rather than a seller of exploits.
Access runs through Daybreak Red, the company's tier for authorised security work such as penetration testing and exploit development, and the model goes first to selected customers with expansion to all approved Daybreak Red customers over the coming weeks. OpenAI is also moving the earlier GPT-5.6 Cyber model to all Daybreak Red customers now.
And the numbers explain the caution. A single system that can produce working exploits for hundreds of kernel bugs shortens the interval between a vulnerability being found and being usable by someone who wants to break in, which is the same argument that has been made about every offensive tool since fuzzers.
So the gate is the product rather than the model. OpenAI is selling access to vetted organisations instead of publishing weights, which keeps the capabilities behind an approval process and makes the customer list the real security control.
The company says it is seeing more attempts to misuse artificial intelligence, including by malicious cyber actors and by groups seeking to distill its models, which is the second reason the release is narrow. A model that finds bugs is also a model that teaches someone how to find bugs.
For software maintainers the practical change arrives in the inbox. Mozilla has already started shipping fixes for the Firefox issues, and the 304 Linux disclosures come with patches attached, so the work is now about how quickly a downstream distributor can test and merge them.
So security teams should read the rating as a statement about capability rather than about intent. A Critical classification means the model can meaningfully assist an expert, not that it will act alone, and every documented use here ran through researchers who reported what they found.
But the distinction matters when a procurement team asks whether a tool like this can be pointed at its own estate, because the answer depends on who is holding it. OpenAI says the model is being used to fix flaws before attackers reach them, which is the same wager every security vendor makes, and the evidence offered is the patch count, and it leads the exploit count by a wide margin.
OpenAI released GPT-6 Cyber to vetted customers through its Daybreak Red tier
It is rated Critical for cybersecurity, up from High for GPT-5.6 Cyber
The model found 81 previously unknown Firefox bugs Mozilla rated high severity
It produced working exploits for 948 Linux kernel vulnerabilities, 588 of them new
OpenAI disclosed 304 critical Linux findings to maintainers with proposed patches
Source: Reuters
