|
Can an AI model find and defend against cyberattacks on its own? OpenAI says yes, and it has put a number on it: the company's new GPT-6 Cyber model is built specifically for offensive and defensive security work, and independent scoring inside OpenAI rates it "Critical," the highest capability tier in the company's own risk framework.
OpenAI introduced GPT-6 Cyber this week as the first model in its GPT-6 line dedicated to cybersecurity, a domain where the company says AI can now do work that previously demanded elite human expertise. The announcement comes hot on the heels of Anthropic revealing that its Claude model helped find two critical hypervisor vulnerabilities in the Xen project, a sign that security research is becoming a proving ground for frontier AI.
What can GPT-6 Cyber actually do?
The numbers OpenAI published are striking. On ExploitGym, the company's benchmark for offensive security tasks, GPT-6 Cyber scored 48.5 per cent, up from 32.1 per cent for GPT-5.6 Cyber. In testing, the model produced working evidence for 81 previously unknown high-severity vulnerabilities in the Firefox web browser. OpenAI is giving the model first to a select group of customers under its Daybreak Red programme, before a wider rollout.
Why is the "Critical" rating a big deal?
OpenAI's Preparedness Framework grades models by how dangerous their capabilities could be if misused. Critical is the top tier, reserved for models that could materially help threat actors in real-world attacks. A model rated Critical for cyber capability means OpenAI itself has concluded that the same skills that let it find Firefox bugs could be pointed the other way, which is why access is gated and monitored rather than shipped to everyone.
What does this mean for defenders?
For security teams, the arrival of a purpose-built cyber model cuts both ways. The same reasoning that uncovers 81 fresh Firefox flaws can triage a company's attack surface, audit its code, and draft patches at machine speed. For Nigerian banks and fintechs, which this week had their own insider-assisted heists documented in a major investigation, the defensive use cases matter as much as the threat: automated vulnerability discovery is rapidly becoming a standard tool in serious security shops.
How does it compare to Anthropic's security work?
The two labs are racing in the same direction. Anthropic's Claude found the Xen hypervisor flaws disclosed this week, bugs serious enough that a malicious virtual machine could read and write the memory of other virtual machines, including the host. OpenAI's GPT-6 Cyber goes a step further by being a dedicated, access-controlled product rather than a general model that happens to be good at security. Both companies are effectively advertising that their models can do work once reserved for the world's best vulnerability researchers.
What should businesses do about it?
The practical takeaway is that AI-assisted security testing is moving from experiment to product. Organisations that assume their systems will only face human-paced attacks are now planning against a deadline that keeps shrinking. Patch cycles, threat modelling and code review all face pressure to speed up, and security budgets are likely to follow.
Quick answers
What is GPT-6 Cyber? OpenAI's first model dedicated to cybersecurity, rated Critical under the company's Preparedness Framework. How well does it score? 48.5 per cent on ExploitGym, versus 32.1 per cent for GPT-5.6 Cyber. What did it find? Evidence for 81 previously unknown high-severity vulnerabilities in Firefox. Who gets access first? A select group of customers in OpenAI's Daybreak Red programme.
Sources: OpenAI announcement, November 2026; The Neuron, November 6, 2026; Another Coding Blog, November 6, 2026.
|
0 Comments