OpenAI has introduced GPT-6 Cyber, a specialised artificial intelligence model designed to identify software vulnerabilities, test potential exploits and assist in developing security patches. The company says the model has already uncovered hundreds of security weaknesses in widely used software, including the Linux kernel and Mozilla Firefox. Access, however, will initially be limited to approved cybersecurity professionals and organisations.
Announced on November 5, 2026, GPT-6 Cyber marks a further step in applying advanced AI to cybersecurity research. Unlike general-purpose AI assistants, the model has been developed specifically to examine complex software systems, investigate security weaknesses, validate vulnerabilities and create working exploits in authorised testing environments.
OpenAI says the model can also help researchers prepare candidate patches, potentially reducing the time needed to investigate and address security issues.
GPT-6 Cyber Is Designed for Advanced Security Research
GPT-6 Cyber is a specialised variant of OpenAI’s GPT-6 Astra model. It is intended to assist cybersecurity professionals with technically demanding tasks that often require extensive investigation and programming expertise.
The model can examine source code, identify potential vulnerabilities, assess whether they can be exploited and generate evidence to help researchers understand their impact.
Exploit development is one of its key capabilities. An exploit is a method or piece of code that takes advantage of a software vulnerability. In authorised security research, exploits help demonstrate the potential consequences of a weakness and allow developers to prioritise appropriate fixes.
Given the sensitivity of these capabilities, OpenAI says the model has been designed to operate within the boundaries of authorised security testing.
OpenAI Reports 948 Working Linux Kernel Exploits
One of the most significant results shared by OpenAI comes from a large-scale examination of the Linux kernel, which manages the core operations and resources of a Linux operating system.
During the research exercise, OpenAI’s cybersecurity pipeline identified 2,308 potential security findings. Researchers successfully reproduced 1,724 vulnerabilities and developed 948 working local privilege escalation exploits.
Such vulnerabilities can allow an attacker with limited system access to gain higher-level permissions, potentially reaching root access.
OpenAI also compared these results with an earlier research exercise conducted using GPT-5.6 Sol. Under the same research framework, the earlier model produced 166 working exploits, compared with 948 generated using GPT-6 Cyber.
The company says the research took place in a controlled environment. Findings were prioritised for disclosure to maintainers, while candidate patches were prepared for review. The reported exploit count should not be interpreted as 948 vulnerabilities independently confirmed and fixed by Linux maintainers.
81 Previously Unknown Firefox Vulnerabilities Identified
OpenAI also used GPT-6 Cyber to examine Mozilla Firefox, identifying 81 previously unknown vulnerabilities that Mozilla classified as high severity.
The research reportedly highlighted another 30 known issues that could be more serious than previously assessed.
OpenAI shared the findings, supporting evidence and proposed patches with Mozilla to assist its engineering teams. Mozilla subsequently began releasing fixes for many of the reported vulnerabilities.
The findings demonstrate how AI-assisted security research could help developers examine large software projects more efficiently, even when those projects have already undergone extensive security testing.
Safeguards Against Unauthorised Exploitation
The ability to identify vulnerabilities and develop exploits also raises concerns about potential misuse. A model capable of advanced security research could create risks if its capabilities were used against systems without permission.
OpenAI says GPT-6 Cyber has undergone specialised training to respect the scope and restrictions established by security researchers.
In the company’s ExploitGym Honeypot evaluation, the model avoided exploiting services outside the authorised testing scope in 99.93% of tests without additional deployment prompts. With those prompts, it stayed within the defined boundaries in 100% of tests.
OpenAI has also introduced additional monitoring, access restrictions and security checks to reduce the possibility of misuse.
Limited Access Through OpenAI’s Cybersecurity Programmes
GPT-6 Cyber will not initially be available as a general-purpose model. OpenAI is providing access through its Daybreak Red programme to a select group of approved customers.
Authorised users can access the model through the API and Codex, with availability expected to expand gradually.
The company is also expanding its Daybreak Blue programme, which uses GPT-6 Astra to support defensive cybersecurity activities, including vulnerability validation, code review and patch development.
This restricted approach reflects the dual-use nature of the technology. The same capabilities that help security teams identify weaknesses could also be misused if access and deployment are not carefully controlled.
What GPT-6 Cyber Could Mean for Cybersecurity
Security teams routinely examine enormous codebases, reproduce complicated software bugs and determine whether potential vulnerabilities can be exploited in real-world conditions. AI models that can assist with these tasks could help researchers investigate more issues and accelerate parts of the vulnerability management process.
However, identifying a weakness is only one stage of securing software. Human experts must still verify findings, evaluate their impact, review proposed patches and ensure that fixes do not introduce additional problems.
With GPT-6 Cyber, OpenAI is positioning advanced AI as a tool for strengthening software security. Its reported findings across Linux and Firefox highlight the potential of AI-assisted vulnerability research, while its restricted rollout reflects the importance of keeping powerful cybersecurity capabilities within authorised hands.
