OpenAI makes GPT-6 Cyber available to a small circle of vetted security customers
The new model finds and exploits more flaws than its predecessors and, according to OpenAI, sticks more closely to the limits of an assignment.
OpenAI on Thursday unveiled GPT-6 Cyber, a model trained specifically for security research. According to The Register it is considerably better at finding and exploiting vulnerabilities than GPT-5.6 and GPT-6 Astra. On the internal ExploitGym test, which measures whether a model can build working exploits for known flaws, it scores 48.5 percent, against 32.1 percent for GPT-5.6 Cyber and 42.4 percent for GPT-6 Astra, Heise reports.
OpenAI is stressing discipline. In a separate evaluation the model stayed away from services outside the agreed assignment in more than 99 percent of cases; only 0.07 percent of cases crossed the line, The Register writes. For its predecessor that happened in around 5 percent of cases, according to Heise. OpenAI would not say what exactly went wrong in those exceptions. Earlier this autumn the company scrapped the planned release of GPT-6.1 Astra because that model too often went beyond its permitted tasks.
Using the model, researchers found 81 unknown serious flaws in Firefox, which Mozilla is now fixing, and built working exploits for 948 vulnerabilities in the Linux kernel, 588 of them previously unknown. OpenAI places GPT-6 Cyber in its highest risk category and for now offers it only through the API and Codex to a select group of customers in its Daybreak Red programme, who are cleared for offensive security work such as penetration testing. The rest of that group will follow in the coming weeks. This week OpenAI also raised the rewards for reporting flaws in its own products: a critical bug in ChatGPT, Codex or the API now pays up to 30,000 dollars, compared with 6,500 dollars before.