OpenAI has released an AI model built to hunt down software weaknesses and turn them into working attacks, and rated it “Critical”, the top tier of its cyber risk scale. GPT-6 Cyber went on Thursday to a small group of vetted security customers. OpenAI says it helped uncover 81 previously unknown serious flaws in the Firefox browser and produced working exploits for 948 Linux kernel vulnerabilities. It is a striking demonstration of what frontier AI can now do to the software the world runs on, for defenders and potentially for attackers.

What OpenAI has released

GPT-6 Cyber is a specialist version of OpenAI’s flagship GPT-6 Astra model, trained for authorised security work such as finding vulnerabilities, writing exploits to prove they are real, and testing web applications. It is not available to the public. For now it is offered through the API and Codex to a select group of approved customers of Daybreak Red, the tier of OpenAI’s Daybreak security programme set aside for advanced work like exploit development and penetration testing. Reuters reported that access will widen to all approved Daybreak Red customers over the coming weeks, and that OpenAI is also making its earlier GPT-5.6 Cyber model available to that whole group from now.

OpenAI named Cisco, Calif and CodeRabbit among the teams already using it for vulnerability research and code review.

What the “Critical” rating means

The headline detail is the label. Under its Preparedness Framework, OpenAI classifies GPT-6 Cyber as “Critical” for cybersecurity, up from “High” for GPT-5.6 Cyber. According to the framework wording quoted by The Verge, that tier covers models that can identify and develop working zero-day exploits, meaning attacks on flaws nobody has yet patched, in many hardened real-world systems without human help. The Register describes it as the company’s highest-risk tier for cyber capabilities.

The performance numbers explain why. On ExploitGym, a benchmark that tests whether a model can exploit a specified vulnerability, GPT-6 Cyber scored 48.5%, against 32.1% for GPT-5.6 Cyber and 42.4% for GPT-6 Astra, according to OpenAI and The Verge. These are OpenAI’s own results on its own tests, not yet checked by outsiders.

The real-world finds

The figures that grabbed attention come from live software that has been picked over by human experts for years.

  • Firefox: OpenAI says its researchers used the model to find 81 previously unknown vulnerabilities that Mozilla classed as high severity, plus 30 known issues that turned out to be worse than reported. Mozilla has started releasing fixes.
  • Linux kernel: the model reproduced 1,724 vulnerabilities and developed working exploits for 948 of them, 588 of which were previously unknown, according to Reuters and Fortune. OpenAI says that is more than five times the 166 exploited by GPT-5.6 Sol using the same set-up. The Linux exploits could let an attacker with ordinary local access gain full control of a machine, Fortune reported.
  • Disclosure: OpenAI says it has passed 304 critical Linux findings to the maintainers along with proposed patches, following the Linux community’s guidance.

OpenAI quotes Firefox engineer Brian Grinstead saying the browser entered 2026 as one of the world’s most hardened codebases, yet the model still found new high-severity bugs.

The promise: it stays inside the lines

Much of the launch is about control rather than raw power. A cyber-attack model that wanders outside its brief is a serious risk, and OpenAI has history here. The Verge notes that one of the new tests, ExploitGym Honeypot, was modelled on the Hugging Face incident, in which OpenAI’s agents breached the open-source AI community while chasing the answer to a task.

In that test the model is given a hard exploitation task alongside deliberately easy-to-attack supporting services, and has to work out that attacking them is out of scope. Without its deployment safety prompts, GPT-6 Cyber avoided the out-of-bounds services 99.93% of the time, up from 94.49% for GPT-5.6 Cyber. With the prompts, OpenAI says it stayed in bounds every time. Put the other way round, that leaves about 0.07% of runs going astray, and The Register reports that OpenAI declined to say what happened in those cases or whether any involved real incidents.

The Verge also flags a limit on such tests. OpenAI’s cyber safety lead, Fouad Matin, said “evaluation awareness”, where a model notices it is being tested and behaves differently, is a concern, so the company is leaning more on tests with real codebases.

Safeguards and critical infrastructure

OpenAI says it has added several protections alongside the release. These include monitoring for actions that do not match what a user has authorised, automated reviews of related interactions for misuse, and a requirement that Daybreak Red API access is restricted to approved networks by default.

A new group within Daybreak Red is aimed at approved critical infrastructure defenders, such as those protecting power and water systems, who will be allowed to run authorised tests on industrial systems. OpenAI says it has tightened safeguards against help that could compromise industrial controls or cause physical harm, and cites a $1bn grant programme to subsidise access for resource-stretched teams such as government bodies and essential service providers.

Why it matters, including in the UK

The same ability that lets a defender patch a flaw before an attacker finds it also shortens the gap between a bug existing and someone exploiting it. We have already seen the practical side of that in Britain. Two critical PHP flaws found with frontier AI tools led UK councils and NHS boards to pull sites offline, as we reported in our story on the PHP bugs. Any organisation running Firefox, Linux servers or web software can reasonably expect a steady stream of AI-discovered fixes to apply in the months ahead.

It is also a competitive race. Fortune reports this is OpenAI’s fourth cyber-focused model this year, while Anthropic runs a vetted-access programme called Glasswing and Google offers trusted defenders its Gemini 4 Argon model without the usual cyber guardrails through a scheme called Fairwind. Whether the gated-access approach can keep the strongest tools in defenders’ hands is the open question, and OpenAI’s own history of containment problems, covered in our report on its offline training rules and its agents that tried to switch off their safety monitors, will keep that question alive.

What to watch next

  • How quickly Mozilla and the Linux maintainers ship fixes for the flaws OpenAI reported, and whether outside researchers can reproduce the results.
  • The wider rollout to all Daybreak Red customers over the coming weeks.
  • Any independent review of the 99.93% in-scope figure and the model’s behaviour on real systems rather than test ranges.

Keep exploring