OpenAI launches GPT-6 Cyber, scoring 48.5% on ExploitGym benchmark

The latest:

OpenAI has released a security-specific model trained to discover, verify and exploit software vulnerabilities while staying inside boundaries set by researchers. The company said GPT-6 Cyber scored 48.5% on the ExploitGym benchmark, up from 32.1% for GPT-5.6 Cyber, and that it rated the system Critical for cybersecurity capability under its own preparedness framework — a step up from its predecessor’s High rating.

Details:

• The benchmark: OpenAI said the model reached 48.5% on ExploitGym, a test of exploit development, compared with 32.1% for GPT-5.6 Cyber. The company described the gap as a 51% relative improvement over the previous generation, the largest jump it has reported for a security-focused release.
• Scope compliance: According to OpenAI, the model declined to exploit services outside its assigned task in 99.93% of tests run without a deployment prompt, and in 100% of tests when the prompt was included. Scope discipline is the central safety claim for a model designed to attack live systems.
• Linux kernel work: OpenAI said its own researchers used the model to develop 948 privilege-escalation exploits in the Linux kernel. Privilege escalation allows an attacker who already has limited access to gain administrator-level control of a machine.
• Firefox findings: The company said the model surfaced 81 previously unknown high-severity vulnerabilities in the Firefox browser, and that Mozilla has shipped fixes for many of them. OpenAI did not say how many remain unpatched.
• Risk tier: OpenAI placed GPT-6 Cyber at the Critical level for cybersecurity within its preparedness framework, after classifying the earlier model as High. The tier is the company’s internal ceiling for capability that could cause severe harm if misused.
• Corporate users: Security teams at Cisco, Calif and CodeRabbit are using the model for vulnerability research and code review, according to OpenAI. The company did not detail the scale of those deployments or the findings produced by them.
• Access limits: The model is initially available through the API and Codex to a selected group of verified Daybreak Red customers, with expansion to all Daybreak Red customers planned. OpenAI said IP allowlists are required by default, but set no date for the wider rollout.
• Infrastructure program: OpenAI announced a new tier, Daybreak Red for Critical Infrastructure, for verified defenders of critical systems. It allows authorized testing against critical environments such as energy, water and transport networks under the company’s approval.

Background:

ExploitGym measures whether a model can produce working exploits rather than merely identify flaws. OpenAI’s preparedness framework grades models by potential for severe misuse, with Critical as the top tier, triggering tighter deployment controls and restricted customer access.

Between the lines:

The same capability that let researchers generate 948 Linux kernel exploits and 81 unknown Firefox flaws is what makes the Critical rating necessary. OpenAI’s answer is gating rather than capability limits: verified customers only, IP allowlists by default, and a 99.93% scope-compliance figure offered as the guarantee that the model stays where it is told. That leaves unpatched systems exposed to anyone who obtains comparable capability outside those controls.

What’s next

Watch for Mozilla’s remaining Firefox patches, OpenAI’s timeline for opening access to all Daybreak Red customers, and the first disclosed findings from Critical Infrastructure testing.