OpenAI launched GPT 6 Cyber, an artificial intelligence system built specifically to discover software vulnerabilities and draft defensive patches. The model scored 48.5% on the ExploitGym benchmark and maintained 100% boundary compliance when tested with deployment prompts. Access remains restricted to verified enterprise security researchers through the Daybreak Red program.
OpenAI designed the model to inspect code while strictly following researcher boundaries. On the ExploitGym benchmark, GPT 6 Cyber achieved a 48.5% exploit generation rate, beating the 32.1% score from GPT 5.6 Cyber. Web penetration evaluations showed a 40.3% vulnerability detection rate without access to underlying source code. In isolated environments designed to test boundary discipline, the software refused to attack unauthorized targets 99.93% of the time without custom instructions, reaching 100% compliance once safety prompts were applied.
Security teams deployed the system against active open source codebases to evaluate practical defense capabilities. The model identified 81 previously undiscovered high severity vulnerabilities in Mozilla Firefox, allowing Mozilla engineers to push functional updates to production. Testing on the Linux kernel yielded functional exploits for 948 known vulnerabilities, generating 304 direct disclosures and patch candidates for system maintainers.
Brian Grinstead, an engineer working on Firefox security, verified the practical impact of the audit:
GPT 6 Cyber is a world class model for cyberdefense. Firefox entered 2026 as one of the most hardened and scrutinized codebases. Even after further hardening with multiple generations of frontier models, GPT 6 Cyber uncovered previously unknown high severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users.
OpenAI partnered with operational technology firm Dragos to evaluate safeguards around industrial control systems and public utilities. Testing across simulated power stations led to stricter API barriers that block attempts to compromise electrical equipment or water treatment facilities. The company also introduced a $1,000,000,000 funding initiative through Daybreak for Frontline Defenders to subsidize access for public utilities, while requiring IP allowlists and automated activity monitoring for commercial red team accounts.
