OpenAI’s New Cyber Model Puts “Staying in Scope” at the Center of AI Security
OpenAI has introduced GPT‑6 Cyber, a specialized model designed to help security researchers find, validate, and fix software vulnerabilities. The big story is not simply that the model is stronger at offensive security work. OpenAI is framing the release around a harder problem: making powerful systems useful to defenders without letting them wander outside an authorized assignment.
According to the company, GPT‑6 Cyber scored 48.5% on its ExploitGym benchmark, compared with 32.1% for GPT‑5.6 Cyber. That is a meaningful jump in a task category built around identifying and exploiting known weaknesses. It also reported stronger performance in web-application testing and said the model avoided exploiting out-of-scope systems in 99.93% of tests without a special deployment prompt, reaching 100% with it.
The model has already been used in research involving major open-source software. OpenAI says it helped uncover 81 previously unknown high-severity Firefox vulnerabilities and develop 948 Linux privilege-escalation exploits in controlled research. Mozilla reportedly released fixes for many of the Firefox findings. OpenAI classifies GPT‑6 Cyber as “Critical” under its preparedness framework, a step above the previous model’s “High” rating.
Security AI is rapidly shifting from a code-review assistant into something closer to a tireless research partner. That could mean faster flaw discovery, better patch suggestions, and more security capacity for smaller teams and open-source maintainers. It also raises a hard question: can the same systems that expose dangerous bugs be deployed safely enough to improve defence faster than they increase risk?
The practical answer will depend on access controls, clear authorization boundaries, auditing, and how seriously vendors treat misuse prevention. GPT‑6 Cyber is a useful marker of where the industry is heading: autonomous security agents are no longer a general idea; they are becoming a product category with real-world stakes.
