Artificial intelligence models are becoming increasingly more capable and are being used to attack devices that until now, due to laziness or for whatever reason, have not been in the spotlight. This puts pressure on companies to strengthen their defenses, and OpenAI has responded with a special version of its latest model.
It’s called GPT-6 Cyber and is the company’s new “critical” tool.
In short. We saw this recently with Hugging Face and PHP. In July of this year, an OpenAI model “escaped” from its isolated environment in a cybersecurity test and compromised the Hug Mouth platform. At the end of October, alarm bells rang across the Internet halfway across the planet when the PHP Foundation released patches for critical vulnerabilities discovered with AI.
These vulnerabilities allow commands to be executed on a server without a password or legitimate access, and this seems to be the straw that broke the camel’s back for some realizing how essential it is to update all security systems in the current era of AI. That’s where GPT-6 Cyber comes into play, a variant of GPT-6 Astra that specializes in vulnerability research and development exploits.
These are programs that take advantage of failures to attack a system and, according to OpenAI itself, its latest model outperforms Astra in most cybersecurity tasks.
“Critical“. Sam Altman’s company classifies it as a “critical” model in cybersecurity, above the “high” level held by GPT-5.6 Cyber. These are the terms or “categories” by which OpenAI measures the risk of its models, and the previous one described as critical was Astra.
New Cyber’s strong point is finding and developing zero-day exploits on hardened systems and without human intervention.
evidence. OpenAI tested the model with two open source projects that have been under the spotlight for years:
- Firefox– Finding 81 unknown vulnerabilities that Mozilla classified as “severe”.
- he Linux kernelwhich is the key that controls a machine’s resources. It found working exploits for 948 kernel vulnerabilities, 588 previously unknown. This is five times more than what GPT-5.6 Sol achieved in July this year and these exploits would allow an attacker to gain administrator privileges with simple local access.
Playpen. But every time they introduce one of these models, there’s another side to the coin, and there’s the question of what happens if something so powerful falls into the wrong hands. According to CyberScoop, OpenAI adds several additional identity and security requirements and additional monitoring for behavior outside the rules.
In fact, the training part includes a simulation based on the hug face phenomenon we’ve already discussed, and OpenAI maintains that the current model adheres to the allowed scope much better than its predecessor.
business. Now, because of the risk of this tool falling into the wrong hands, OpenAI has made the same decision as Anthropic with its Project Glasswing models: offer it only to very select clients. It’s currently available to a select group via the Codex API, and access will be extended to all Daybreak Red customers in the coming weeks.
As we read in Fortune, this is the fourth cybersecurity model that OpenAI has launched this year, and the company has two layers or security programs:
- Daybreak Blue for defensive work, code review, malware analysis or incident investigation.
- Daybreak networks for advanced tasks such as attack simulation based on building controlled attack tools to test defenses.
And this focus on cybersecurity is one of the ways OpenAI is exploring growing business users who need the latest in cybersecurity. This is where it can be an important source of income and not among “ordinary” users who pay a monthly subscription. In fact, global spending on cybersecurity with AI is expected to reach $51.3 billion this year, nearly double that of 2025, and this is where OpenAI wants to be well positioned. It’s going to be tough because Anthropic has Glasswing and Google is also playing with Gemini 4 Argon.
Picture | OpenAI (edited)
In Xataka | An anthropologist was eating lunch when he received an email he should never have received: it was Mythos.
