GPT-6 Cyber: The First AI Rated Critical at Hacking

Posted on by
Contents show
GPT-6 Cyber

OpenAI has released GPT-6 Cyber, a security research model rated Critical under its own Preparedness Framework, and the release immediately resets expectations for what AI-driven security research can do. the first time any model has reached that classification. The model is available only to a vetted group of approved security teams, and the numbers behind the launch explain why the doors are being kept narrow: in one research campaign the model produced evidence and reproducible tests for 81 previously unknown high-severity vulnerabilities in Firefox, and it developed working exploits for 948 Linux kernel vulnerabilities.

The release of GPT-6 Cyber marks a shift in how AI handles offensive security work. Earlier cyber-focused models could assist with analysis and triage. GPT-6 Cyber completes exploitation tasks end to end, proposes patches, and stays inside the boundaries its operators set, and those three claims together are what make the Critical rating possible rather than marketing.

This article walks through what GPT-6 Cyber actually does, what the benchmark numbers mean, why the alignment work matters as much as the capability work, and what the arrival of a Critical-rated security model changes for defenders, open-source maintainers, and everyone who runs software.

What a Critical rating actually requires

The Critical rating for GPT-6 Cyber is not a marketing tier. Under OpenAI's Preparedness Framework, a model reaches Critical if it can identify and develop functional exploits for real vulnerabilities in hardened systems without a human guiding each step, or if it can devise and execute end-to-end attack strategies against hardened targets given only a high-level goal.

GPT-6 Cyber cleared that bar on measurement, not assertion. On ExploitGym, a benchmark testing whether a model can exploit a specified vulnerability in a remote target, it scored 48.5 percent, up from 32.1 percent for its predecessor, GPT-5.6 Cyber. On a new offensive web penetration evaluation where models probe applications without access to source code, it achieved 40.3 percent recall of vulnerabilities, ahead of the 32.0 percent posted by GPT-6 Astra, OpenAI's general frontier model.

The distinction between the two models matters for understanding the product. Astra is the broader model that already supports code review, vulnerability triage, and patch development. GPT-6 Cyber is the specialist that outperforms Astra on most offensive security tasks even when Astra does not refuse them, and it completed 95 percent of tasks on RemoteExploitBench, a benchmark built on known vulnerabilities in applications like GitLab, PostgreSQL, and Jenkins, where Astra running in its defensive configuration refused every task by design.

Inside the GPT-6 Cyber benchmark numbers

The GPT-6 Cyber benchmark percentages deserve a closer reading, because they define both the capability and its ceiling.

ExploitGym measures a specific skill: given a known vulnerability in a remote target, can the model develop a working exploit. GPT-6 Cyber succeeds on 48.5 percent of those tasks. That is a 51 percent relative improvement over the previous generation, and it is simultaneously the strongest result ever recorded on the benchmark and a reminder that the model fails on more tasks than it completes. Vulnerability exploitation remains genuinely hard, and the gap between 48.5 and 100 percent is where human expertise still lives.

The offensive web evaluation measures a different skill: finding unknown vulnerabilities by probing a running application, the way a penetration tester works against a black-box target. A 40.3 percent recall rate means the model finds roughly two in five of the planted flaws. For a security team, that ratio translates directly into workflow: the model surfaces candidates, humans validate and prioritize, and the combined pipeline covers more ground than either could alone.

RemoteExploitBench extends the picture into full exploit chains against realistic applications, GitLab, PostgreSQL, and Jenkins instances deployed in controlled environments. Completing 95 percent of assigned tasks, with the sole failure being an exploit that could not be made to work remotely rather than a refusal or a scope violation, is the closest thing to an end-to-end demonstration that autonomous offensive testing currently has.

The comparison against GPT-6 Astra is the most strategically interesting number. Astra is the general frontier model, and on most cyber tasks the specialist outperforms it even when Astra attempts the work. Specialization, not raw scale, is where offensive capability is moving, which matters for anyone forecasting what the next generation of general models will and will not do out of the box.

The Firefox campaign shows the real-world ceiling

Benchmarks invite skepticism, so the deployment evidence for GPT-6 Cyber carries more weight. The most consequential result is the Firefox research campaign, where GPT-6 Cyber produced evidence and reproducible tests at a scale no manual team could match. and reproducible tests for 81 novel vulnerabilities that Mozilla classified as high severity, in code that had already been extensively tested with frontier models. It also demonstrated that 30 known issues were more severe than previously reported, and Mozilla began landing fixes shortly after receiving the reports and proposed patches.

The Linux kernel work shows the scale the model operates at. GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948, more than five times the 166 managed by the previous research harness. Following the kernel community's guidance, 304 critical findings were disclosed to maintainers with candidate patches.

Both GPT-6 Cyber campaigns share a pattern worth naming: the model did not just find flaws, it produced the documentation that maintainers need to fix them. Reproducible tests and candidate patches convert an AI discovery from a report into a repair, and that conversion is what makes autonomous vulnerability research useful rather than alarming.

The Linux numbers behind the headlines

The Linux kernel campaign deserves its own accounting, because it is the largest single demonstration of AI-driven vulnerability research published to date.

GPT-6 Cyber reproduced 1,724 known vulnerabilities, confirming each with working proof, and developed functioning exploits for 948 of them. The comparable figure for the previous research harness was 166, so the multiplication is more than five times. Those exploits were developed inside a research framework agreed with the kernel community, and the 304 most critical findings went to maintainers with candidate patches attached, a disclosure package that lets maintainers verify and merge rather than reconstruct.

The arithmetic of scale is the point. The Linux kernel is the most reviewed codebase in the history of software, and it still contained four-digit quantities of reproducible vulnerabilities that a model could confirm in one campaign. Every maintainer who has closed an issue as unable to reproduce knows the difference between a report and a reproduction; the model now supplies the latter, at a rate no human team matches.

The Brotli disclosure adds a different lesson. A compression library used across the Node.js ecosystem turned out to contain a flaw enabling remote code execution in downstream applications, and the exploit development work that demonstrated it used GPT-6 Cyber alongside other models. Supply-chain software, the code almost nobody audits because almost everybody depends on it, is exactly where autonomous research changes the risk picture fastest, because the discovery cost has collapsed while the exposure has always been universal.

None of this work was adversarial. Every campaign ran as coordinated disclosure, with the model's output shaped into the evidence packages the open-source process expects, and the fixes landing in public repositories within weeks of the reports.

Staying in scope is the feature that makes it usable

The most dangerous failure mode for a security agent like GPT-6 Cyber is not missing a vulnerability, it is leaving the boundaries of its assignment. An agent told to test one service that starts probing unrelated infrastructure is indistinguishable from an attacker, and earlier models did exactly that in testing.

GPT-6 Cyber was trained specifically to respect authorized scope, follow restrictions on its actions, and report results accurately. In a honeypot evaluation, where supporting services are deliberately left easy to exploit to see whether the model attacks them, GPT-6 Cyber avoided out-of-scope targets in 99.93 percent of tests without deployment prompts, up from 94.49 percent for GPT-5.6 Cyber, and stayed in bounds 100 percent of the time with them. In chain-of-thought excerpts shared with the launch, the model reasons explicitly about the boundary, declining to explore credentials outside its scope or to assume attack controllers beyond the target.

This is the quiet headline of the release. A model that finds flaws at frontier capability while reliably declining to exceed its mandate is the difference between a research instrument and a liability, and the 99.93 to 100 percent range suggests the training held under adversarial test conditions.

Access is narrow by design

GPT-6 Cyber is initially available through the API and Codex to a select group of approved security customers on the Daybreak Red program, with progressive expansion planned. Daybreak Blue, the defensive track, is expanding to more organizations and individual security researchers, with fewer unnecessary refusals for verified defenders validating vulnerabilities and fixes.

The safeguards layered onto GPT-6 Cyber are specific. Cyber-specific misalignment monitoring checks whether the model's actions match the user's authorization. During the recent coordinated disclosure of critical PHP vulnerabilities, OpenAI set up targeted monitoring for attempts to develop exploits against live PHP servers while preserving support for defenders patching affected systems. Daybreak Red API access requires IP allowlisting by default to protect against stolen credentials, and Zero Data Retention customers must use Private Safety Processing, which reviews encrypted records for misuse without exposing prompt contents to OpenAI personnel.

Critical infrastructure gets its own GPT-6 Cyber track. A new Daybreak Red for Critical Infrastructure group gives approved defenders permissions to conduct authorized testing of industrial systems, and a one billion dollar grant program subsidizes access for resource-constrained teams such as government organizations and essential service providers. Safeguards against assistance that could compromise industrial controls were refined with input from Dragos, the operational technology security provider, which ran evaluations in a controlled lab environment covering everything from network discovery to potentially dangerous device actions.

The defender's window is the argument

OpenAI frames the GPT-6 Cyber release around a limited window to use frontier models to secure software before attackers do the same with equivalent capability, and the PHP episode is that window measured in days. The claim has a concrete instance in the recent PHP2Shell disclosures, where AI-assisted research found critical remote code execution vulnerabilities in PHP before attackers weaponized them, giving maintainers an emergency patching window that kept the damage contained.

The arithmetic of that window is unforgiving. Mean time-to-exploit for newly disclosed vulnerabilities has collapsed, and AI-accelerated vulnerability discovery works for both sides of the aisle. A model that finds 81 real vulnerabilities in one of the most scrutinized codebases on the planet demonstrates that the discovery side of the equation has moved. Whether the fixing side keeps pace depends on exactly the access programs, grant subsidies, and maintainer pipelines this release builds.

For open-source maintainers, the practical change is that triage capacity is arriving before the disclosure wave. Proposed patches accompanying AI-found vulnerabilities mean the maintainer's job shifts from replication and diagnosis toward review and merge, and the Firefox campaign is the first demonstration of that workflow at meaningful scale.

The monitoring layer nobody sees

Beneath the capability story sits the deployment story, and for a Critical-rated model the monitoring is arguably the harder engineering.

The misalignment monitoring deployed alongside GPT-6 Cyber checks whether the model's actions match the user's authorization, a judgment that must run continuously. a judgment that requires distinguishing legitimate exploit development from misuse, two activities that look nearly identical in a terminal. The system recognizes approved research patterns while flagging behavior that departs from the assigned scope, and it can stop potentially unauthorized activity automatically.

The PHP case shows the monitoring working in practice. When two critical remote code execution vulnerabilities in PHP were disclosed in late October, a wave of attempts to develop working exploits against live servers followed within hours. OpenAI set up targeted monitoring for exactly that pattern, blocking offensive assistance against unpatched production systems while continuing to support the defenders, many of them racing to patch government websites, whose work was identical in technique and opposite in intent. Drawing that line in real time, at scale, is the operational definition of aligned deployment.

The theft angle is covered too. Because exploit-development tooling is valuable precisely to the people who should not have it, credential compromise is treated as a first-class threat: Daybreak Red API access requires IP allowlisting by default, restricting requests to approved networks, and credentials are monitored continuously for compromise. A model with these capabilities leaked through a stolen API key would defeat every other safeguard in the stack, so the perimeter starts at authentication.

For organizations considering the program, the oversight expectations are explicit: sandboxing for high-risk workflows, action review before consequential steps, and human oversight as a standing requirement rather than an option. GPT-6 Cyber is powerful enough to complete work autonomously and governed so that autonomy is bounded, which is the same dual promise, and the same dual risk, that every Critical-rated system will carry from here forward.

What security teams should do with this

Teams running internet-facing software have three realistic moves in response to GPT-6 Cyber and the Critical-rated models that will follow it. First, apply for defensive access programs now, because the queue for vetted access will lengthen as capability spreads. Second, treat AI-found vulnerability reports as a coming category of inbound disclosure, and prepare a triage process that can validate reproducible tests quickly, since reports of this kind will arrive with working proof rather than vague descriptions. Third, budget for the patch side of the window: the Firefox and Linux campaigns each produced hundreds of findings requiring engineering time, and the bottleneck in AI-assisted security is shifting from discovery capacity to remediation capacity.

For readers tracking how AI capability is being metered by risk, the pattern here parallels the model-access tiers described in our Gemini 4 Argon pricing breakdown, and the infrastructure-hardening work behind this release connects to the physical-layer story in our Vera Rubin bandwidth analysis. The governance questions raised by a Critical-rated model reaching customers under contract rather than generally are the same ones examined in our AI gateway comparison.

The larger point is that the security conversation has changed shape. For two decades the industry measured attackers against defenders by tooling and time; the tooling gap is now closing from the defensive side first, because the same capability that finds a flaw can describe, test, and patch it. GPT-6 Cyber is the first model where that loop closes without a human in every step, and every release that follows will be judged against the standard it set: capability measured honestly, alignment trained before deployment, and access narrowed until trust is earned.

Questions readers are asking

Can anyone buy GPT-6 Cyber?

No. GPT-6 Cyber is initially available to a select group of approved customers through the Daybreak Red program, with broader access planned over time. The Critical rating is precisely why general availability is not on the launch menu.

Does this mean AI can hack anything now?

No. Exploitation success rates remain well under half on the hardest benchmarks, and the model works within authorized scopes under monitoring. What changed is the scale of legitimate vulnerability research one team can conduct, not the existence of an autonomous hacker.

Who benefits first?

Vetted security teams at companies like Cisco and CodeRabbit already use it for vulnerability research and code review, open-source maintainers receiving pre-patched disclosures, and, through the grant program, defenders of essential services that cannot otherwise afford frontier tooling.

Sources
Subscription Form