OpenAI's new restricted-access model, GPT-6 Cyber, is built to help security researchers find and validate exploitable bugs, gauge their impact, and harden patches before they ship. The company's numbers are what make it worth a closer look, and they point to a problem that's getting bigger, not smaller.
Finding more bugs in mature code
OpenAI researchers say the model turned up 81 previously unknown high-severity vulnerabilities in Firefox. Mozilla has started shipping fixes. On the Linux side, the team developed working exploits for 948 kernel vulnerabilities, 588 of which were previously unknown. Those findings are going to maintainers with candidate patches attached.
The Firefox result is the one that stands out to me. Those bugs surfaced after several generations of frontier models had already been run against that codebase. Chris Hughes, VP of security strategy at Noma Security, reads it as evidence that the long tail of vulnerabilities in mature software runs deeper than most people assumed. "If that holds up, the long tail of vulnerabilities in mature software is deeper than most of us assumed, which is the same 'vulnpocalypse' pressure many have been discussing this year," he said.
Ten exploitation techniques that look new
From a sample of 166 exploits, OpenAI's researchers identified 10 techniques the company says appeared novel. According to OpenAI, external kernel exploitation experts had not seen them before. Several of them could let someone with local access escalate to root.
That's where Rob T. Lee, chief AI officer at industrial cybersecurity company Dragos, sees the bigger question. Novel techniques suggest models can do more than locate known bug classes. They may also generate new exploitation paths. "That could mean a few things, but that's interesting to me as it could reveal models can create new exploitation paths," Lee said. "Adding new TTPs and exploitation paths will make detection more complex."
Security at agent speed
OpenAI's pitch goes beyond bug hunting. Its representatives argued that models can help validate exploitability, map alternative attack paths, harden patches, and support patch rollout. They described the target as security operating at "agent speed."
OpenAI researcher Eric Wallace said the goal is to "validate the potential exploitability of vulnerabilities at scale" and rank the flaws that matter most. He also stressed testing fixes against other routes to the same weakness. "One vulnerability might not be the only attack path," he said.
OpenAI cybersecurity research lead Clint Gibler described advance coordination the company ran around recent PHP vulnerabilities, working with researchers, maintainers, and security vendors. "We wanted to get ahead of that public patch and release, so that as many users and companies could be protected even before the patch was available," he said. OpenAI also worked with Cloudflare so it could deploy web application firewall rules that protect sites before the bug became public.
Finding flaws is easier to measure than fixing them
Here's the gap, though. OpenAI hasn't published measurements showing how much its models speed up enterprise patch deployment or reduce exposure. Finding bugs produces clean numbers. Fixing them doesn't.
Hughes argues that defensive use cases need the same scrutiny. "Detection engineering, incident response, hardening, and prioritization are harder to score because success depends on each organization's environment, tooling, and risk tolerance," he said. Shared defender benchmarks, in his view, would push progress toward "the work that closes the remediation gap, not only toward finding more bugs."
He also pointed to OpenAI's own Patch the Planet dashboard, which shows a remediation rate below 25% so far. More discovery at this pace, he argues, means more known flaws left unfixed, and attackers with similar capabilities will find them. "This highlights even further risk for organizations facing the rise of industrialized discovery via AI," he said.
Restricted access and the scope problem
OpenAI classifies GPT-6 Cyber as "Critical" for cybersecurity under its own Preparedness Framework. The company says the model was trained to stay within authorized scope, respect restrictions, and report results accurately. In its ExploitGym Honeypot evaluation, GPT-6 Cyber went out of scope in 0.07% of cases. The prior model, GPT-5.6 Cyber, did so in 5.51%.
Hughes called that a real improvement. "At the scale these models operate, though, even a small fraction means actions against systems nobody authorized," he said.
Access starts narrow. GPT-6 Cyber will initially be available through the API and Codex to a select group of approved Daybreak Red customers. Daybreak Red is the more permissive of two vetted tiers in OpenAI's Daybreak trusted-access program. Daybreak Blue is the tier OpenAI recommends for most defenders. OpenAI says it will expand GPT-6 Cyber to all Daybreak Red customers over the coming weeks, and it's making GPT-5.6 Cyber available to that group too.
In briefing materials ahead of the call, OpenAI wrote, "We are working to responsibly expand access to frontier cyber capabilities to many more organizations and members of the security community. To start, we're broadening access to an alpha of Daybreak Blue for Astra," the company's GPT-6 general-purpose frontier model. My read: the discovery numbers will keep climbing. Whether defenders can close the gap between a found bug and a deployed fix is the question to watch.
