November 6, 2026, (Inside AI) — OpenAI on Thursday released GPT-6 Cyber, a security-focused AI model that can find and exploit software vulnerabilities, to a small group of vetted customers. The company rated the model "Critical" under its cybersecurity safety framework, up from "High" for its predecessor, GPT-5.6 Cyber.
The model is designed to help security researchers identify flaws, test how attackers could exploit them, and patch them before malicious actors do. OpenAI said its researchers used GPT-6 Cyber to find 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity. Mozilla has begun releasing fixes. The model also helped develop working exploits for 948 Linux kernel vulnerabilities, including 588 that were previously unknown, according to OpenAI. The company disclosed 304 critical Linux findings to maintainers, along with proposed patches.
GPT-6 Cyber is available to select customers of Daybreak Red, OpenAI's access tier for authorized security work such as penetration testing and exploit development. Access will expand to all approved Daybreak Red customers over the coming weeks. OpenAI is also making its earlier GPT-5.6 Cyber model available to all Daybreak Red customers starting Thursday.
Why a Critical Rating Raises the Stakes
The upgrade to "Critical" reflects the model's dual-use nature. The same capabilities that help researchers find and fix flaws can be repurposed by attackers. OpenAI said it is seeing more attempts to misuse AI, including by malicious cyber actors and groups seeking to distill its models. The rating signals that GPT-6 Cyber poses a higher risk if it falls into the wrong hands, which explains the tightly controlled release.
"The model is meant to help security researchers find vulnerabilities, test how they could be exploited and fix flaws before attackers do," OpenAI said in a statement. The company did not name the specific safety measures it has added to prevent misuse.
The Firefox and Linux findings offer a concrete measure of the model's power. Finding 81 high-severity Firefox bugs is a significant haul for any single research effort. The 948 Linux kernel exploits, including 588 zero-days, suggest GPT-6 Cyber can automate vulnerability discovery at a scale that human teams cannot match. Mozilla's decision to begin releasing fixes validates the findings, though the company has not commented publicly on the collaboration.
OpenAI's move comes as AI companies face growing pressure to secure their models against misuse. The Daybreak Red tier is designed to limit access to vetted security professionals. But the existence of a model that can develop working exploits raises questions about how OpenAI will prevent unauthorized use. The company said it is expanding access gradually, starting with a small group of customers.
The release also highlights a broader trend: AI models are becoming capable enough to conduct meaningful security research. That could be a boon for defenders, who often struggle to keep up with attackers. But it also lowers the barrier for offensive operations. OpenAI's decision to rate GPT-6 Cyber as "Critical" acknowledges that risk.
For now, the model's impact will be limited to a handful of approved users. But as access expands, the security community will be watching closely to see whether GPT-6 Cyber tips the balance toward defenders or creates new dangers.
Tobias is less interested in what a robot or a prompt can do today than in what it means for tomorrow. He writes about prompt engineering and robotics for readers who want context, not just specs.
