Just now, GPT-6 Cyber was officially released, and the sharpest spear of AI has also become its strongest shield.
The capabilities of AI in the field of cybersecurity have ushered in another major upgrade.
Just now, OpenAI officially released its new-generation cybersecurity model GPT-6 Cyber, which can independently discover software vulnerabilities, verify whether the vulnerabilities are exploitable, and assist researchers in developing remediation solutions.
Compared with the previous-generation GPT-5.6 Cyber, the new model has seen an approximate 51% relative improvement in performance during exploit testing, and has greatly enhanced its instruction-following capability when executing security tasks. What is more noteworthy is that OpenAI has already deployed GPT-6 Cyber in real-world software security research and achieved quite impressive results.
Figure | Official Blog 🔗 https://openai.com/index/introducing-gpt-6-cyber/
In Linux kernel research, GPT-6 Cyber successfully developed 948 runnable exploits; in the Firefox browser, it also discovered 81 previously unknown high-severity vulnerabilities.
Some of the Firefox vulnerabilities have been fixed by Mozilla, and relevant security updates are now being rolled out to users.
According to information released by OpenAI, GPT-6 Cyber outperforms the general-purpose flagship model GPT-6 Astra on most cybersecurity tasks, and Cyber still has advantages even when the latter does not refuse to execute relevant requests.
With this round of capability improvement, OpenAI has rated the risk level of GPT-6 Cyber in the cybersecurity field as Critical, which is higher than the High rating of the previous-generation GPT-5.6 Cyber.
In accordance with OpenAI's Preparedness Framework, this rating means the model already possesses cyberattack capabilities that require stricter protective measures to be taken.
Exploit Capability Increased by 51%, Capable of Independently Finding Unknown Vulnerabilities
Cybersecurity research usually requires understanding software operation mechanisms, analyzing code, finding vulnerabilities, constructing attack programs, and then verifying whether vulnerabilities can be successfully exploited in the actual environment.
In the past, these tasks were highly dependent on the experience of professional researchers, especially the development of exploits, which might require long periods of repeated debugging.
Nowadays, GPT-6 Cyber is already able to participate in completing the entire process mentioned above.
In ExploitGym, a dedicated environment for evaluating exploit capabilities, GPT-6 Cyber achieved a success rate of 48.5%, while the previous-generation GPT-5.6 Cyber recorded 32.1%, representing a relative improvement of approximately 51%.
This test requires the model to develop valid exploits for specified vulnerabilities in a remote target environment, so it is closer to actual security research than simply judging whether there are security issues in the code.
OpenAI also designed a web penetration test, requiring the model to find vulnerabilities by interacting with web applications without access to the source code.
In this test, the vulnerability recall rate of GPT-6 Cyber reached 40.3%, exceeding the 32.0% of GPT-6 Astra.
Another new benchmark called RemoteExploitBench further tests the model's remote exploit capability, covering known vulnerabilities in software such as GitLab, PostgreSQL, and Jenkins, with all tests conducted in a controlled environment.
Preliminary evaluations show that GPT-6 Astra with Daybreak Blue refused to execute all test tasks, while GPT-6 Cyber with Daybreak Red completed 95% of them. The only failure occurred when the exploit failed to work properly in the remote environment.
The two adopt different security access configurations, so this set of results is also affected by security policies.
Compared with the scores on the benchmark test leaderboard, the performance of GPT-6 Cyber in real-world software projects is more convincing.
OpenAI disclosed that its research team used GPT-6 Cyber to conduct large-scale research on the Linux kernel, successfully reproducing 1724 vulnerabilities, and developing runnable exploits for 948 of them.
GPT-5.6 Sol, which uses the same research framework, previously only successfully exploited 166 vulnerabilities, and the results of GPT-6 Cyber are more than five times that number.
In accordance with the vulnerability disclosure specifications of the Linux community, OpenAI has reported 304 of these key findings to relevant maintainers and provided candidate remediation solutions, and the remediation of the remaining issues is still in progress.
Another achievement comes from Firefox.
Mozilla's Firefox browser has long been reviewed by security researchers and multiple generations of cutting-edge AI models, and it belongs to a software project with relatively mature security protection.
Even so, GPT-6 Cyber still discovered 81 previously unknown vulnerabilities that were classified as high-severity by Mozilla, and proved that the severity of 30 other known issues was higher than previously assessed.
Researchers also provided reproducible test evidence and remediation suggestions to help Mozilla engineers carry out remediation work.
Brian Grinstead, Distinguished Engineer at Firefox, said that even after security hardening from multiple generations of cutting-edge models, GPT-6 Cyber still discovered unknown high-severity vulnerabilities, and helped the team deliver security fixes to millions of users.
In addition, OpenAI also used GPT-6 Cyber together with other models to study critical vulnerabilities in the Brotli compression library, verifying that they may lead to remote code execution risks in downstream applications.
In the controlled red team testing of OpenAI's own infrastructure, the relevant AI Agent was even able to combine multiple vulnerabilities, break through the isolation of micro virtual machines, and execute code on the underlying host. The research team subsequently fixed software defects, strengthened network access restrictions, and disclosed the issues to relevant maintainers.
AI Will Launch Active Attacks, But It Must Also Know Which Targets Are Off-limits
As the capabilities of cybersecurity models continue to grow, a practical problem has become more prominent.
When AI is already able to independently write attack programs, and even combine multiple vulnerabilities to complete attacks, how can we ensure that it will not arbitrarily attack unauthorized systems?
To this end, OpenAI specially enhanced the model's ability to comply with authorization scopes, enforce operation restrictions, and accurately report research results during the training process of GPT-6 Cyber.
One of the key tests is called ExploitGym Honeypot.
Researchers will provide the model with a difficult exploit task, configure auxiliary services such as software package repositories and object storage in an isolated environment, and at the same time deliberately make these services have easily exploitable vulnerabilities.
According to the task requirements, the model can only attack the specified target, and even if it finds security flaws in other services, it cannot exploit them without authorization.
The test results show that without the deployment-stage security prompt, GPT-6 Cyber complied with the authorization scope in 99.93% of the tests, while the previous-generation GPT-5.6 Cyber recorded 94.49%.
After adding the deployment security prompt, the compliance rate of GPT-6 Cyber in this test reached 100%.
OpenAI also showed part of the model's reasoning records, which clearly stated that it cannot assume that additional APIs or attack controllers are within the target scope, nor can it explore credentials outside the authorized scope.
To further limit the risk of misuse, OpenAI has also introduced a monitoring mechanism for cybersecurity tasks, including checking whether model behaviors comply with user authorization, identifying high-risk attack requests, and monitoring dangerous operations targeting critical infrastructure such as industrial control systems.
For example, during the coordinated disclosure of critical PHP vulnerabilities, OpenAI once deployed special monitoring measures to identify behaviors of developing exploits against real PHP servers, while retaining support for legitimate defense work.
For enterprise API users, OpenAI has also introduced the Private Safety Processing (PSP) mechanism to identify potential misuse behaviors through automated checks. For customers using Zero Data Retention, enabling PSP is usually required to perform 30-day security checks on encrypted interaction records stored in the customer's storage space.
In addition, the Daybreak Red API requires the use of an IP whitelist by default to restrict unauthorized network access.
AI Infiltrates Simulated Power Plant and Discovers Two Zero-day Vulnerabilities
In addition to traditional software security, OpenAI also cooperated with industrial cybersecurity company Dragos to simulate an industrial control network in a controlled laboratory to test the understanding and attack capabilities of cutting-edge models on critical infrastructure.
Relevant tests cover network discovery, asset identification, target reconnaissance, sensitive data acquisition, and dangerous operations that may affect the operation of industrial equipment.
Rob T. Lee, Chief AI Officer of Dragos, revealed that in a simulated power plant test, the researchers provided almost no environmental information, but the model was still able to independently distinguish between industrial control devices and ordinary IT systems, and discovered two zero-day vulnerabilities in the engineering software that manages protective relay data.
These vulnerabilities may expose sensitive information such as protection settings and circuit breaker tripping logic, providing important conditions for subsequent attacks.
Rob T. Lee believes that AI is lowering the technical threshold for attackers to carry out preliminary reconnaissance and vulnerability research, and relevant tests can help defense teams understand potential attack paths in advance.
Based on these studies, OpenAI has newly established Daybreak Red for Critical Infrastructure, which provides special permissions for approved critical infrastructure defense teams, allowing them to conduct security tests within the authorized scope.
At the same time, OpenAI also plans to provide usage subsidies for defense teams with limited resources such as government agencies and important public service providers through the Daybreak for Frontline Defenders grant program with a total amount of 1 billion US dollars.
The New Paradox of Cybersecurity: Defenders Need More Powerful Attack Tools
The release of GPT-6 Cyber reveals an increasingly realistic paradox in the cybersecurity industry.
To make the internet more secure, defenders may need to master increasingly powerful attack capabilities.
Faced with potential vulnerabilities, security researchers can only judge the degree of harm and the remediation effect after verifying whether the vulnerabilities can be actually exploited. As AI gains the ability to independently develop exploits, defenders also need tools of the same level.
According to OpenAI's arrangement, GPT-6 Cyber is only initially open to some approved Daybreak Red customers via API and Codex, and will be gradually expanded to all Daybreak Red users in the future.
At the same time, GPT-5.6 Cyber will be open to all Daybreak Red customers, and the Daybreak Blue Alpha test based on GPT-6 Astra will also be expanded to more enterprises and individual researchers.
Among them, Daybreak Blue mainly serves vulnerability analysis and remediation verification, while Daybreak Red allows authorized researchers to develop exploits and carry out more in-depth security tests.
In terms of pricing, the API pricing of GPT-6 Cyber is quite expensive. In the short context mode, the input cost is 20 US dollars per million tokens, and the output cost is as high as 100 US dollars per million tokens, both of which are 5 times that of GPT-5.6 Sol. The cached input price is 2 US dollars per million tokens, and the cache write fees for 30 minutes and 12 hours are 25 US dollars and 50 US dollars respectively.
Figure | 🔗 https://developers.openai.com/api/docs/pricing?cyber-context-length=short
In the past, AI companies mainly controlled risks by rejecting dangerous requests. Now OpenAI has started to enable professional researchers to obtain more powerful cybersecurity capabilities through identity authentication, hierarchical authorization and continuous monitoring.
However, the stronger the attack capability of the model, the higher the risk of opening it for use. A strict access mechanism certainly helps prevent misuse, but it may also make it difficult for independent researchers and open source project maintainers with limited resources to access advanced tools.
OpenAI is improving this situation by expanding Daybreak access and providing financial subsidies. What is more noteworthy is whether in the future, enough legitimate defenders can obtain these capabilities in a timely manner, while preventing them from falling into the hands of malicious attackers.
After all, when attackers also start using AI to find vulnerabilities, defenders can no longer only rely on past technical means. To counter increasingly powerful attack capabilities, perhaps we can only rely on equally powerful tools. As the saying goes, magic has to be defeated by magic in the end.