OpenAI classifies GPT-6 Cyber as a critical risk after tool crafts exploits for Linux and Firefox flaws

OpenAI has introduced GPT-6 Cyber, a specialized artificial intelligence model designed to discover software vulnerabilities, validate them by building working attacks, and help draft fixes. Under the company's internal Preparedness Framework, GPT-6 Cyber has been assigned a Critical rating for cybersecurity—the framework's highest tier—up from the High rating given to GPT-5.6 Cyber. OpenAI demonstrated the system's power by using it to find 81 previously unknown high-severity flaws in Firefox and develop working local privilege escalation exploits for 948 distinct Linux kernel vulnerabilities. [1][2]

Because of its offensive capabilities, the model is not part of ChatGPT. It is available only through an API and Codex to a select group of approved participants in OpenAI's Daybreak Red program for authorized penetration testing. Access requires IP allowlists, includes credential monitoring, and blocks assistance with attacks on water treatment facilities, power plants, and industrial control systems. On the ExploitGym benchmark, GPT-6 Cyber completed 48.5% of tasks, up from 32.1% achieved by its predecessor. OpenAI claims the model stayed within researcher-set boundaries and avoided out-of-scope targets in 99.93% of tests without deployment prompts. [1]

Software projects are already deploying fixes developed with the tool. Mozilla credited OpenAI for 41 high-severity patches included in its Firefox 159 release, while kernel maintainers received 304 critical reports and draft patches, which distributions like Ubuntu and Fedora must still push to users. OpenAI warned that defenders face a narrow window to find and patch systemic flaws before malicious actors harness similar automated capabilities. [1][2]