GPT-6 Cyber scores 48.5% on ExploitGym, targets Linux and Firefox

By Elena Vasquez

GPT-6 Cyber scored 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, according to OpenAI's release announcement.

That 16.4-point rise represents OpenAI's claimed 51% relative improvement over its predecessor.

OpenAI says the model can find and fix vulnerabilities while staying inside researcher-set boundaries.

The release adds an exploit-capable model to that field.

Security researchers and malicious actors now use AI to find flaws in operating systems, platforms and applications at an unprecedented pace across cybersecurity, OpenAI said.

The company added that leading AI labs increasingly restrict their strongest models to trusted organizations and researchers.

That places controlled access at the center of OpenAI's launch.

In its announcement, OpenAI wrote:

“We’re introducing GPT‑6 Cyber, a major leap in security research: more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set.”

OpenAI also said GPT-6 Cyber has already uncovered and validated thousands of exploits in security-critical codebases such as Linux and Firefox.

What does the benchmark show?

OpenAI described ExploitGym as a test of whether models can exploit a specified vulnerability.

The company reported 48.5% for GPT-6 Cyber and 32.1% for GPT-5.6 Cyber.

A separate alignment evaluation tested whether the model would exploit services outside the assigned task.

GPT-6 Cyber avoided those out-of-scope services in 99.93% of tests without a deployment prompt.

It avoided them in 100% of tests when researchers supplied the prompt.

OpenAI attributed the improvement to dedicated training in authorized scope, researcher restrictions and accurate reporting.

The scores address separate failure modes.

Exploit performance measures useful capability.

Scope adherence measures whether that capability stays under researcher control.

For a security vendor, either failure can block deployment because exploit capability without scope control can turn routine testing into a new operational liability for customers.

OpenAI's headline claim pairs both gains rather than treating them as interchangeable.

The company did not disclose ExploitGym's size, task mix, scoring method or an outside validation.

It also did not say how many alignment tests produced the 99.93% and 100% results.

The post offers OpenAI-reported measurements, not independent confirmation.

OpenAI's reported benchmark gains break down as follows:

• ExploitGym performance: 48.5% for GPT-6 Cyber.
• Previous model: 32.1% for GPT-5.6 Cyber.
• Relative improvement: 51% over GPT-5.6 Cyber.
• Out-of-scope avoidance: 99.93% without a deployment prompt.
• Out-of-scope avoidance: 100% with the prompt.

What has the model found in real software?

OpenAI's researchers put GPT-6 Cyber to work on security-critical code.

For its real-world tests, OpenAI wrote:

“Our researchers used GPT‑6 Cyber to develop 948 privilege escalation exploits in Linux and identify 81 previously unknown high-severity vulnerabilities in Firefox, despite extensive prior testing with frontier models.”

The Linux work produced 948 privilege escalation exploits, OpenAI said.

The Firefox work surfaced 81 previously unknown high-severity vulnerabilities.

OpenAI said those flaws had escaped earlier testing with frontier models.

The model also helped researchers build candidate patches.

Mozilla has released fixes for many of the Firefox vulnerabilities, OpenAI reported.

Those fixes make part of the release a software-maintenance result, not only a benchmark exercise.

They also show the proposed workflow spanning discovery, validation and remediation.

OpenAI did not provide a count for candidate patches or released Firefox fixes.

Nor did the announcement publish technical details for the 81 Firefox vulnerabilities.

Mozilla's released fixes will test the research claims in production, although the announcement included no independent Mozilla assessment.

OpenAI said Cisco, Calif and CodeRabbit use the model for vulnerability research and code review.

OpenAI itself used GPT-6 Cyber to find and fix weaknesses in its own infrastructure.

Those deployments cover an operating-system project, a major browser, outside security teams and the developer's internal systems across several distinct parts of the software ecosystem.

The common thread is a model positioned to move from discovery through validation and patch work.

OpenAI said the model had already helped secure real systems before broader Daybreak Red access arrives.

How does Daybreak separate research from testing?

OpenAI's plan covers three related model paths.

By putting general code review in Astra, narrower validation in Blue and deeper exploit work in Red, OpenAI has split security work according to capability and authorization.

Mainline GPT-6 Astra already supports code review, vulnerability triage and patch development, the company said.

Daybreak Blue helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals.

Daybreak Red enables deeper exploit development and authorized security testing with GPT-6 Cyber.

OpenAI said Daybreak aims to bring advanced security research to organizations of every size.

The company also named independent researchers and open-source maintainers as intended users.

OpenAI put those groups near the center of its security-access plan.

OpenAI said the security field has a limited window to use frontier models to secure software.

Its rollout plan therefore tries to widen Daybreak before that window closes.

Who gets access to GPT-6 Cyber?

OpenAI's first release reaches customers through the API and Codex.

The company said GPT-6 Cyber is available through those channels to a select group of approved Daybreak Red customers.

Access will expand progressively to all Daybreak Red customers soon, OpenAI said.

OpenAI also made GPT-5.6 Cyber available to all Daybreak Red customers.

By placing GPT-6 Cyber behind approval while opening GPT-5.6 Cyber to every Daybreak Red customer, OpenAI is separating model capability from customer trust for deployment.

The announcement gave no calendar date, pricing or approval criteria for the expansion.

OpenAI compared the restriction with similar models from Anthropic and Google, which also limit access to trusted partners.

That makes approval a practical dependency for security teams seeking the new exploit capability.

It may matter most to open-source maintainers, whom the company wants to include in Daybreak.

Yet expanding the user base will also test whether the scope controls hold outside OpenAI's selected deployments.

The post offered no evidence on that outcome among newly approved customers.

The scope-control claim rests on the reported 99.93% and 100% alignment results.

The practical claim rests on the Linux exploits, Firefox fixes and deployments at Cisco, Calif and CodeRabbit.

What will decide whether the release holds up?

OpenAI's next milestone is not another benchmark point.

It is broader Daybreak Red availability.

The company has promised a progressive expansion but has not supplied a date.

Mozilla's fixes, the Linux exploit work and current security-team deployments now provide reference points.

If newly approved users reproduce that workflow, GPT-6 Cyber could move beyond a specialist research tool.

If they cannot, the access expansion will expose the limits of the benchmark and alignment results.

OpenAI says defenders have a limited window to use frontier models.

Its next test is whether expanded access can convert that capability into released fixes without weakening the boundaries that make the tool usable in practice.