Artificial intelligence is proving to be increasingly capable of identifying flaws in software, which in some cases have been hidden for decades. Demonstrating exploitation and even preparing a fix can make the cybersecurity job much easier. This is essentially the promise of GPT-6 Cyber, the new model announced by OpenAI and designed to search for vulnerabilities. The model would have found and corrected hundreds of flaws, some of which were present in popular software, such as the Mozilla Firefox browser (81) and Linux (948).
At the time of writing, GPT‑6 Cyber is available via API and Codex to a select group of approved Daybreak Red customers, a project that is part of an initiative by OpenAI to make advanced security research tools available to independent organizations and researchers.
GPT-6 Cyber is better at finding and exploiting vulnerabilities
Compared to GPT-5.6 Cyber, the new GPT-6 Cyber model shows significant progress. Suffice it to say that in the ExploitGym benchmark (a standard test with which to test the model in specific tasks, in this case related to IT security) it managed to reach a score of 48.5%, against 32.1% of the previous version. An increase of 16.4 percentage points.
Excellent results were also recorded in controlled simulations of so-called cyber attacks penetration test of Web applications, where GPT-6 Cyber detected 40.3% of vulnerabilities without being able to consult the source code of the sites and online services examined, compared to 32% for GPT-6 Astra, OpenAI’s generalist model.
Another evaluation, called RemoteExploitBench, which serves to verify whether artificial intelligence can develop working exploits against vulnerable applications (such as GitLab, PostgreSQL and Jenkins), allowed the model to complete 95% of the proposed tasks. Based on these assessments, OpenAI assigned it the “Critical” level for cybersecurity in its Preparedness Framework, higher than the “High” level attributed to its predecessor.
From Firefox to Linux: the flaws identified by artificial intelligence
The model’s capabilities have been proven beyond test environments and have identified numerous flaws in software widely used by users around the world. For example, the result obtained with Firefox was notable. OpenAI researchers, using GPT-6 Cyber, were able to identify 81 previously unknown vulnerabilities, which were then classified by Mozilla as high severity. OpenAI then provided reproducible tests, evidence of issues, and patch proposals to Mozilla, which began implementing the suggested fixes. In the same campaign, 30 known problems also emerged, but more serious than what had already been assessed previously.
That’s not all. OpenAI also analyzed the Linux kernel, the central component of the operating system that manages computer resources, identifying 948 potential problems.
The risk of hackers and the limits imposed by OpenAI
But if an artificial intelligence can identify such complex vulnerabilities, what stops an attacker from using it to attack servers and online services? This is a very good question and it is also one of the main problems that OpenAI attempted to address, which trained the model so that it could be used within certain boundaries. In this regard, Open AI explained:
As models become more capable and discover more security vulnerabilities, we also see an increase in attempts to use them to cause harm. These include attempts by malicious cyber actors and hostile groups seeking to distill our patterns. We then complemented GPT‑6 Cyber’s increased capabilities with stronger security measures to detect and stop abuse and keep the model’s actions within the user’s intent and permissions.
In tests, GPT-6 Cyber avoided attacking services outside its operating perimeter 99.93% of the time, a percentage that rose to 100% with additional security instructions given to the model.
How to protect yourself from vulnerabilities exploited by AI
As reassuring as the percentage indicated by OpenAI on security tests of the model may be, obviously there is always the risk that bad actors could exploit any flaws discovered with this or other latest generation AI models. It is not possible to completely eliminate this risk, unfortunately, but we can at least adopt some good practices that allow us to have greater protection than those who neglect digital hygiene.
To protect yourself, a first fundamental rule is to keep your operating system, browser, applications and router updated. Security updates fix known vulnerabilities and reduce the time during which a device could remain exposed (just think of the recent case involving an iOS vulnerability exploited by criminals to take over some WhatsApp accounts).
A further precaution is to use different passwords for each online service used, preferably generated using specific tools and stored through a password manager. Don’t forget to enable multi-factor authentication and passkeys whenever these security modes are available.
