OpenAI recently launched GPT-6 Cyber, its most powerful cybersecurity-specific model, focused on vulnerability discovery and exploit development. Its debut scorecard: in Firefox security research, it uncovered 81 previously unknown high-severity vulnerabilities and submitted them to Mozilla with evidence and reproduction steps; Mozilla has already patched several of them. In another Linux kernel study, it reproduced 1,724 vulnerabilities and wrote working exploits for 948 of them.
Five times the capability of the previous generationThe comparison makes the leap even clearer: under the same test environment, the previous-generation GPT-5.6 Sol successfully exploited only 166 vulnerabilities, while the new model achieved more than 5 times that. On the specialized benchmark ExploitGym, it scored 48.5%, an increase of about 51% over GPT-5.6 Cyber's 32.1%, which tests exploit capabilities against remote targets.
The stronger it gets, the tighter the reinsAs capabilities surged, OpenAI also put on a tighter bridle. In safety tests, even without additional prompts, GPT-6 Cyber had a 99.93% probability of not touching services outside the task scope; with prompts added, that reached 100%. For this reason, OpenAI raised its cybersecurity rating from High to Critical. To prevent backlash, the company layered on specialized monitoring, credential protection, and sandbox isolation, and tightened restrictions on operations involving critical infrastructure such as power, water, and industrial control.
First, for "red teams" to useGiven the risks, the model is not yet fully open. The first batch is being released only through the API and Codex to vetted Daybreak Red customers, with broader access to follow gradually.
