OpenAI built a model to find holes in software, then rated it at the top of its own cyber risk scale. If you buy security tools or ship code, the same skill is now working for both sides.
OpenAI announced GPT-6 Cyber this week, and the numbers are blunt. According to The Hacker News, the model helped find 81 previously unknown high-severity vulnerabilities in Mozilla Firefox, and an autonomous pipeline built on it produced 948 working local privilege escalation exploits for Linux. OpenAI also sent 304 critical Linux findings to maintainers with suggested fixes, and Mozilla has begun publishing fixes for the Firefox flaws.
You can’t buy it. GPT-6 Cyber is initially available through the API and Codex to select customers in OpenAI’s Daybreak Red program, and Tech Times says access is limited to approved security teams. Digg’s coverage notes there is no price and no general availability date yet. Cisco and CodeRabbit have reportedly used it for code review.
OpenAI classed GPT-6 Cyber as Critical for cybersecurity under its Preparedness Framework, one step above GPT-5.6 Cyber, its predecessor. Read that again. The company selling the defensive tool is telling you, in its own safety paperwork, that the tool is dangerous.
That’s the problem with this whole category. A model that can turn a Linux kernel flaw into a working root exploit for a defender’s test is doing exactly what an attacker needs. Frankly, there’s no version of a better coding model that isn’t also a better hacking model, and every lab racing to improve one is improving the other.
We already have a real case of the attacker’s side. In May, Google’s Threat Intelligence Group disrupted a criminal group that tried to use AI to find and weaponize a zero-day in a popular open-source, web-based admin tool, according to TechRepublic. The exploit bypassed two-factor authentication. Google said it had high confidence an AI model helped, partly because the Python script carried a hallucinated CVSS score. The target company patched before any mass attack began.
The defenders aren’t standing still. OpenAI launched Daybreak on May 11 with partners including Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, Oracle and Akamai, and it competes directly with Anthropic’s Project Glasswing, as Decrypt and Engadget reported at the time.
Can you trust the model to stay in bounds?
OpenAI says it’s getting better at this. Without deployment safety prompts, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests, up from 94.49% for GPT-5.6 Cyber. With the prompts, it stayed in bounds every time. Put the old number the other way round and it means the previous model wandered outside its brief in roughly one test in eighteen.
A 99.93% score in a lab test tells you little about a messy customer network. Treat it as a vendor figure, because that’s what it is.
What founders and security buyers should do now
Start with patch speed, not tool shopping. If a model can produce 948 Linux exploits, the gap between a bug being found and a fix reaching your servers is the number that decides whether you get hurt. Ask your vendors how long that takes, in days, and ask your own team the same.
Second, ask every security vendor which model sits under its product and what stops it going out of scope. A pitch deck that says AI-powered and nothing else isn’t an answer.
Third, if you build software, assume your open-source dependencies will be scanned by models like this one, by people with good and bad intentions. Pin your versions, track advisories and keep someone responsible for updates.
OpenAI hasn’t said when GPT-6 Cyber reaches anyone outside Daybreak Red.
Also read: Protesters break into Microsoft’s Amsterdam data centre site as Europe’s AI backlash spreads • Meta strategy chief Dave Wehner leaves to become CFO of Fireworks AI • Gottheimer, who helps write Democrats’ AI agenda, bought chip stocks after backing a trading ban
The Metropolix, from Startup Fortune
→
This article is posted in AI News, check it out for more related stories.
Almost there. Sign in and your reply posts straight away.
——————————————————-
Click Here For The Original Source.
