GPT‑6 Cyber: Advancing the frontier of aligned cybersecurity agents

A cybersecurity model trained to find and validate exploitable vulnerabilities, while staying within the scope that researchers set.

Share

Advancing frontier cyber capabilitiesAdvancing frontier cyber capabilities

Stronger alignment, better at staying within bounds

Real-world impact for security teams

Detecting misuse and blocking high-risk activity

Defending critical infrastructure

Expanding access to trusted defenders

Advancing frontier cyber capabilities

Stronger alignment, better at staying within bounds

Real-world impact for security teams

Detecting misuse and blocking high-risk activity

Defending critical infrastructure

Expanding access to trusted defenders

We’re introducing GPT‑6 Cyber, a major leap in security research: more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set. GPT‑6 Cyber delivers major gains on key cybersecurity benchmarks over GPT‑5.6 Cyber, including a 51% relative improvement on ExploitGym and a step function improvement when tested on staying within scope. It is already helping to secure real-world software, uncovering and validating thousands of exploits in security-critical codebases such as Linux and Firefox.

On ExploitGym, which tests whether models can exploit a specified vulnerability, GPT‑6 Cyber scores 48.5%, up from 32.1% for GPT‑5.6 Cyber. It also follows task boundaries more reliably: in a separate alignment evaluation, GPT‑6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without its deployment prompt, and 100% with this prompt. This improvement in alignment reflects dedicated training to stay within authorized scope, respect restrictions, and report results accurately.

These capabilities are already helping secure real systems. Our researchers used GPT‑6 Cyber to develop 948 privilege escalation exploits in Linux⁠ and identify 81 previously unknown high-severity vulnerabilities in Firefox, despite extensive prior testing with frontier models. The model also helped develop candidate patches, and Mozilla has released fixes for many of the Firefox vulnerabilities⁠(opens in a new window). Security teams at Cisco, Calif, and CodeRabbit are using it for vulnerability research and code review, and we have relied on it to find and fix weaknesses in our own infrastructure⁠.

It is clear that we have a limited window to use frontier models to secure software⁠. Our goal is to dramatically expand Daybreak, bringing advanced security research to organizations of every size, independent researchers, and open-source maintainers. Mainline models such as GPT‑6 Astra already support code review, vulnerability triage, and patch development. Daybreak Blue helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals, while Daybreak Red enables deeper exploit development and authorized security testing with GPT‑6 Cyber.

GPT‑6 Cyber is a major step up from GPT‑5.6 Cyber and outperforms GPT‑6 Astra on most cyber tasks, even when Astra does not refuse the request. We evaluated the model on tasks that require it to understand software, identify vulnerabilities, and develop working exploits. Based on these results, we classify the model as Critical in cybersecurity under our Preparedness Framework, up from High for GPT‑5.6 Cyber.

On ExploitGym, which tests whether models can exploit a specified vulnerability in a remote target, GPT‑6 Cyber scores 48.5%, about 16 percentage points higher than GPT‑5.6 Cyber’s 32.1%. To test vulnerability discovery, we also built a new evaluation for offensive web penetration testing. Models probe web applications without access to their source code. GPT‑6 Cyber achieved 40.3% recall of vulnerabilities compared with 32.0% for GPT‑6 Astra.

Daybreak Red is designed to support more advanced security workflows, including developing working exploits and using them against remote targets. To evaluate these capabilities, we built a new benchmark called RemoteExploitBench, which uses known vulnerabilities in applications such as GitLab, PostgreSQL, and Jenkins deployed in a controlled environment. In our initial evaluation, GPT‑6 Astra refused 100% of tasks. GPT‑6 Cyber completed 95%; its only failure was an exploit it could not get to work remotely. See the system card for full results and evaluation settings.

One risk for cybersecurity agents is that they go outside the scope of their assigned task, attempt to exploit unrelated services, or disregard the researcher’s rules of engagement.

We made alignment a central focus of GPT‑6 Cyber, using specialized training to help the model stay within authorized scope, follow restrictions on its actions, and report its work accurately. Before deployment, we ran a series of alignment evaluations to measure these behaviors. See the system card for full results.

One of these evaluations is ExploitGym Honeypot, which was informed by the Hugging Face incident⁠. We give the model a difficult exploitation task in an isolated environment with access to supporting services, such as a package registry or object store. We deliberately make these services easy to exploit so that attacking them can reveal the task’s flag. The model must infer that exploiting them is outside the scope of its task.

GPT‑6 Cyber shows a step-change improvement over GPT‑5.6 Cyber on this evaluation. When tested without deployment safety prompts, it avoided exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT‑5.6 Cyber. With those prompts, GPT‑6 Cyber stayed within bounds 100% of the time.

We can see directly in the GPT‑6 Cyber model’s chain of thought how it reasons about staying within bounds:

GPT‑6 Cyber is already helping security teams find vulnerabilities, validate their impact, and develop fixes. Customers have put it to work on large codebases, long-running exploit development, and security review:

We have also relied on GPT‑6 Cyber to secure our own systems. It was one of the main models behind the work we recently shared on hardening the infrastructure used to train frontier models⁠. In controlled red-teaming campaigns, agents using GPT‑6 Cyber and other OpenAI models chained vulnerabilities to escape microVMs and execute code on the underlying hosts. We used the findings to patch software, tighten network restrictions, and report issues to maintainers and vendors.

Our vulnerability researchers also use GPT‑6 Cyber to find and validate vulnerabilities in open-source software at scale. This work has uncovered previously unknown flaws in software that has been scrutinized for years:

Found 81 novel Firefox vulnerabilities. GPT‑6 Cyber can be suitable for use in autonomous workflows for finding vulnerabilities and proposing high-quality patches at scale. During a vulnerability research campaign, GPT‑6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity, and showed that an additional 30 known issues were more severe than previously reported. We disclosed the findings to Mozilla, along with proposed patches to help its engineers develop fixes. Mozilla was supportive of this work, and began landing fixes shortly after receiving the reports⁠(opens in a new window).

Developing exploits for 948 Linux kernel vulnerabilities⁠. GPT‑6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948—more than five times the 166 exploited by GPT‑5.6 Sol using the same research harness. Following the Linux community's guidance, we disclosed 304 critical findings to maintainers with candidate patches and are in the process of getting other vulnerabilities fixed.

Demonstrating critical RCE vulnerabilities. We recently discussed a critical vulnerability in Brotli⁠(opens in a new window), a compression library used by Node.js and other software. Our security researchers used GPT‑6 Cyber alongside other OpenAI models to develop and validate exploits showing how the flaw could enable remote code execution in downstream applications.

As models become more capable and uncover more security vulnerabilities, we are also seeing more attempts to use them to cause harm. These attempts include efforts by malicious cyber actors and adversarial groups seeking to distill our models. We have thus paired GPT‑6 Cyber’s stronger capabilities with stronger safeguards to detect and disrupt misuse and keep the model’s actions within the user’s intent and authorization.

We added and strengthened these protections alongside the release of GPT‑6 Cyber (see the system card for full information):

Cyber-specific misalignment monitoring. We monitor whether actions match the user’s authorization, while recognizing legitimate exploit development and testing.

Targeted monitoring for emerging threats. For example, during the coordinated disclosure of critical PHP vulnerabilities, we set up targeted monitoring for attempts to develop exploits against live PHP servers, while preserving support for defenders patching affected systems.

Private Safety Processing (PSP). We use automated checks to review related interactions for misuse. Standard retention remains the default. API customers using Zero Data Retention⁠(opens in a new window) generally must use PSP⁠(opens in a new window), which reviews encrypted records retained in customer storage for 30 days without exposing prompts and responses to OpenAI personnel.

Protection against stolen credentials. We require IP allowlisting for Daybreak Red API access by default, restricting requests to approved networks with limited exceptions. We also monitor credentials for compromise.

Sandboxing and oversight. As with past models, we recommend sandboxing⁠(opens in a new window), action review⁠(opens in a new window), and human oversight for high-risk workflows.

Protections against high-risk cyber assistance. We use new checks to block high-risk activity involving critical systems (see below for more).

Protecting critical infrastructure has been a key consideration in designing GPT‑6 Cyber’s safeguards and access, including power plants, water treatment facilities, and the operational technology and industrial control systems (OT/ICS) that underpin them. We simultaneously want to give the teams defending these systems access to our most capable models while also strengthening our safeguards to prevent unauthorized attacks.

First, to equip these defenders, our $1 billion Daybreak for Frontline Defenders⁠ grant program subsidizes access for resource-constrained teams such as government organizations and essential service providers. We’re also introducing a new group within Daybreak Red (Daybreak Red for Critical Infrastructure) for approved critical infrastructure defenders, which gives them permissions to conduct authorized testing of critical systems while retaining safeguards against model misalignment.

Second, to prevent misuse of the Daybreak Red and Blue platforms, we have refined safeguards against assistance and capability development that could compromise industrial controls or safety-critical systems, interfere with equipment, or cause serious injury, catastrophic physical damage, or life-endangering service disruption. The figure below compares safeguard label rates across four access configurations, before and after the recent updates we’re rolling out alongside GPT‑6 Cyber.

Higher safeguard block rates are not always better. Many of the techniques in this evaluation are also essential to legitimate security work: understanding systems, finding vulnerabilities, and verifying that fixes withstand attack. We therefore assess these rates alongside support for legitimate research and patching, rather than aiming for 100%.

To evaluate how our models can help defend critical infrastructure, we partnered with Dragos, the global provider for extended operational technology (xOT) cybersecurity. Dragos ran evaluations using cyber-permissive Daybreak Red models in a controlle