On the 5th (local time), OpenAI unveiled GPT-6 Cyber, a model specialized in cybersecurity. It will first be offered through the API and Codex to customers of the Daybreak Red program, which supports approved security researchers, and OpenAI plans to expand it to all customers of the program later.
The model finds vulnerabilities in vast amounts of source code, tests whether attacks exploiting them actually work, and produces patch candidates and analysis material. OpenAI said it found 81 previously unknown high-severity vulnerabilities in Firefox, and Mozilla, which received the evidence, fixed and shipped several of them.
In the Linux kernel, it reproduced 1,724 vulnerabilities and built working exploit code for 948 of them. 304 significant findings were passed to maintainers along with patch candidates. Its success rate on ExploitGym, a known-vulnerability exploitation benchmark, is 48.5%, 16.4 percentage points higher than the previous model GPT-5.6 Cyber's 32.1%.
OpenAI also tested whether the model stays within permitted attack scope. In a test that placed easily exploitable services outside the allowed targets, it left them untouched 99.93% of the time even without separate safety guidelines, versus 94.49% for the previous model. With the safety guidelines used in actual operation, it reportedly stayed in scope in every evaluation case.
OpenAI classified the model's cyber risk as 'Critical', the highest level in its own framework; the previous model was one level lower at 'High'. Safeguards include blocking high-risk activity, detecting misuse attempts, verifying approved scope, and restricting requests that could cause major damage to critical infrastructure.
Cisco, security firm Calif and code review service CodeRabbit are using the model for vulnerability research and code review. OpenAI said the time available to strengthen software security with high-capability models is limited, and that it will greatly expand Daybreak so organizations of various sizes and open-source maintainers can use it too.
Source: ZDNet Korea
This article was newly written by Raon Community based on the facts in the original source. Copyright of the original belongs to its author; please see the original for details.