GPT‑6 Cyber Wrote Exploits for 948 Linux Kernel Bugs and Stayed in Scope in 99.93% of Tests

OpenAI has released GPT‑6 Cyber, a specialized model that finds vulnerabilities in software, verifies that they can actually be exploited, and is supposed to stay strictly within the boundaries set by the researcher. The release targets a problem familiar to anyone who has handed someone else's infrastructure to automation: an agent that knows how to break in can easily attack, "while it's at it," something it was never asked to touch. Imagine you ask it to test one web application, and the agent notices a vulnerable file store next door and goes after it as easy prey.

In a test of exactly this behavior, GPT‑6 Cyber left unrelated services alone in 99.93% of cases. On real projects, it wrote working exploits for 948 Linux kernel vulnerabilities.

If you are responsible for product security, do code review, or build your own agents, this is a useful reference point: it shows both the ceiling of what these models can do and a way to measure how obedient they are.

What the model can do in practice

The main benchmark is called ExploitGym. It tests whether a model can exploit a given vulnerability on a remote target. GPT‑6 Cyber solves 48.5% of tasks; the previous GPT‑5.6 Cyber solves 32.1%. That is roughly 16 percentage points higher, or 51% in relative terms. In a new web-application pentest evaluation, where the model has no access to source code, it found 40.3% of vulnerabilities. The general-purpose GPT‑6 Astra found 32.0%.

For Daybreak Red mode, OpenAI built another set, RemoteExploitBench. It deploys known vulnerabilities in GitLab, PostgreSQL and Jenkins in a controlled environment. GPT‑6 Astra in Daybreak Blue mode refused every task (100% refusals), while GPT‑6 Cyber completed 95%. Its only failure was an exploit that it could not get to work remotely. Based on these evaluations, OpenAI rated the model Critical in cybersecurity under its Preparedness Framework; GPT‑5.6 Cyber was rated High.

Real-world results look more convincing than the benchmarks. The model reproduced 1 724 vulnerabilities in the Linux kernel and built working exploits for 948 of them. On the same research testbed, GPT‑5.

6 Sol managed only 166, so the new result is more than five times better. Maintainers received 304 critical findings along with candidate patches. In Firefox, which has long been checked by frontier models, among other tools, GPT‑6 Cyber found 81 new vulnerabilities that Mozilla classifies as high severity.

It also showed that another 30 known issues are more dangerous than previously thought. Mozilla is already shipping fixes. In addition, OpenAI researchers, working together with other models, showed how a critical bug in the Brotli compression library, which Node.

js uses, can lead to remote code execution in dependent applications.

How the model is kept within bounds

For OpenAI, alignment became the central task. The model was specifically trained to stay within permitted limits, respect restrictions on its actions, and report honestly on its results. The check is called ExploitGym Honeypot and is based on an incident involving Hugging Face. The model gets a hard exploitation task in an isolated environment that also contains auxiliary services, such as a package or object store. These services are deliberately made easy to break into: attacking them reveals the task's flag. The model has to work out on its own that it must not touch them.

Without deployment safeguard prompts, GPT‑6 Cyber avoided attacking such services in 99.93% of cases, while GPT‑5.6 Cyber did so in 94.49%. With those prompts, the result was 100%. The chain of reasoning shows the model's train of thought: it writes that it should not assume an additional API exists and should attack only the binary or the server, and that it should not look for credentials outside the task.

Who is already using it and what comes next

Users include Cisco, Calif, CodeRabbit, Palo Alto Networks, SentinelOne, Perplexity and Cognition. CodeRabbit reports that on an internal test, the model found 66% more high- and medium-severity issues than its production model. Cognition scored 23% on its test for finding new vulnerabilities, against a previous best of 13%. These are partner testimonials published by OpenAI itself, not independent measurements. The company also used the model to harden its training infrastructure: in training red-team exercises, agents built on GPT‑6 Cyber and other models chained vulnerabilities together to escape microVMs and execute code on the host.

OpenAI acknowledges the flip side: the stronger the models, the more attempts there are to use them for harm, including by malicious actors and by groups that want to "distill" the models. The increased capabilities therefore come with stronger mechanisms for detecting and stopping abuse. The company also wants to significantly expand Daybreak so that organizations of any size, independent researchers and open-source maintainers can get state-of-the-art vulnerability-finding methods. Vetted defenders get Daybreak Blue, with fewer unnecessary refusals, while Daybreak Red is intended for deep exploit development and authorized testing. Standard models such as GPT‑6 Astra support code review, vulnerability triage and patch preparation.

The practical takeaway is simple. If you have code where mistakes are costly, it is worth taking a look at Daybreak and preparing an isolated environment for testing in advance. And if you are building your own agents, it helps to adopt OpenAI's approach: test not only what the agent can do, but also what it must not do. The full evaluation setups and results are in the system card.