OpenAI released its new GPT-6 Cyber model to help identify and fix major cybersecurity flaws. The company said the model is less likely to hack companies compared to previous versions. “It’s over 99 percent of the time doing what you ask,” said Fouad Matin, head of the safety team.
OpenAI has taken the wraps off its latest AI model, called GPT-6 Cyber. This model, the company says, is designed to identify and fix major cybersecurity flaws. But as per OpenAI, there are fewer chances of GPT-6 Cyber going rogue and hacking others when compared to its previous models.
In a blog post, OpenAI classified GPT-6 Cyber as “critical” in cybersecurity under its preparedness framework. This makes the model more capable at such tasks compared to GPT-6 Astra, which is classified as “high.” The company also revealed that it was this model which found 948 critical exploits in Linux in a single run.
GPT-6 Cyber is better at not going rogue
Before we delve into the benchmarks of OpenAI’s latest model, we should have a look at GPT-6 Cyber’s safeguards. OpenAI has had multiple cases of AI models going rogue in recent months, including the Hugging Face hack and its AI agents trying to access US government websites.
But OpenAI says GPT-6 Cyber is less likely to try and hack companies or do something beyond authorisation. “With the 6 Cyber model, we were able to make huge improvements on this evaluation,” Fouad Matin, head of OpenAI’s cyber preparedness and safety team, said during a press briefing. “It’s over 99 percent of the time doing what you ask.”
Excerpts from the model’s reasoning included, “Can't assume extra API or attack controller not target. We should only target binary/server.” Another said, “Don't explore out of scope credentials.”
In the ExploitGym Honeypot evaluation, designed on the Hugging Face breach, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93 per cent of cases without deployment safety prompts, up from 94.49 per cent for GPT-5.6 Cyber. With the prompts, it stayed within scope in every test.
How good is GPT-6 Cyber?
At the same time, GPT-6 Cyber is better at identifying and fixing cyber flaws. On ExploitGym, which tests whether models can exploit a specified vulnerability, GPT-6 Cyber scored 48.5 per cent, compared to 42.4 per cent for GPT-6 Astra. In a web penetration-testing evaluation, where models examined applications without access to their source code, GPT-6 Cyber achieved 40.3 per cent vulnerability recall against GPT-6 Astra’s 32 per cent.
The model also completed 95 per cent of tasks on RemoteExploitBench, a benchmark involving known vulnerabilities in applications in a controlled environment.
Apart from the flaws found in Linux kernel, OpenAI researchers used GPT-6 Cyber to spot 81 previously unknown Firefox vulnerabilities classified by Mozilla as high severity. The model also indicated that another 30 known issues were more severe than previously reported and helped propose patches. Mozilla has released fixes for many of the vulnerabilities.
As per OpenAI, GPT-6 Cyber is initially available through API and Codex to a select group of approved Daybreak Red customers engaged in authorised security testing and exploit development.
The model’s release comes just after Black October, the internet’s nickname for the past month, where vulnerabilities in PHP, NodeJS, and eMudhra security keys, put websites on alert globally.