OpenAI rates its vulnerability-hunting AI "Critical" risk, and customers already have it

On Thursday, November 5, OpenAI opened to a small group of vetted customers an artificial intelligence model that Reuters describes as "designed to find and exploit security flaws." It is called GPT-6 Cyber. The company itself rates it "Critical" for cybersecurity, the highest level on its risk scale. Its predecessor, GPT-5.6 Cyber, was rated one notch lower, "High."

The model is available through OpenAI's API and through Codex, its coding tool. It is reserved for customers of Daybreak Red, the offering aimed at authorized penetration testing and attack development. OpenAI plans to open it to all approved customers of that offering "in the coming weeks." No price has been announced.

81 flaws in Firefox, 948 in Linux

To show what its model can do, OpenAI cites two results. In the Firefox browser, its researchers say they found 81 previously unknown vulnerabilities. Mozilla rated all of them high severity and has begun publishing patches, though it is unclear how many remain open.

In the Linux kernel, the core of the operating system, the model was used to produce working exploits for 948 vulnerabilities, 588 of them previously unknown, according to OpenAI, as cited by Reuters. OpenAI had described this work the day before in a research report, without naming the model. The company says it passed 304 critical flaws to kernel maintainers, with proposed patches.

On ExploitGym, a benchmark that measures the ability to exploit vulnerabilities, GPT-6 Cyber achieves a 48.5% success rate, versus 32.1% for GPT-5.6 Cyber. These scores were measured by OpenAI itself. In the model's system card, OpenAI also summarizes an external evaluation by the company Irregular, which finds its performance broadly comparable to that of GPT-6 Astra, the company's general-purpose model, with better results on long tasks.

What does "Critical" mean at OpenAI?

In the April 2025 version of its "Preparedness Framework," the document that sets out its safety rules, OpenAI defines this threshold as follows: a tool-equipped model that, on its own and without human intervention, finds and develops exploits for vulnerabilities of all severity levels in many well-defended critical systems. Or a model that devises and carries out a novel attack strategy against well-defended targets, starting from a simple objective.

The same text then requires safeguards "even during development," whether or not the model is released. It stated that OpenAI had no model at this level and that it intended to revise its framework before reaching one. As early as July, observers cited by Fortune magazine, including Nathan Calvin of the nonprofit Encode, argued that an internal OpenAI system already met these criteria. The company did not respond directly. On September 3, OpenAI released GPT-6 Astra, presented as its first "Critical"-level model in cybersecurity. GPT-6 Cyber gets the same rating.

OpenAI says it trained GPT-6 Cyber to stay within the scope it is authorized to operate in. In a trap test, it reportedly avoided off-limits services in 99.93% of cases without specific instructions, versus 94.49% for its predecessor, according to the vendor's figures as reported by The Next Web. Chris Hughes of Noma Security, cited by that outlet, considers the progress real. But at this scale, he warns, even a small fraction of deviations hits unauthorized systems. Dragos, an industrial security specialist, reports for its part that the model found two unknown flaws in engineering software that manages protection relay data in a simulated power plant.

What this means for you

According to Reuters, OpenAI is also seeing more attempts by hackers to misuse its models. For IT teams, the most concrete effect lies elsewhere: the number of patches to install will keep growing.

• Let Firefox update automatically: patches for these 81 vulnerabilities are arriving in waves.
• Apply Linux kernel updates from your distributions without delay, starting with servers where several users have accounts.
• Plan for a flood of security advisories: according to Chris Hughes, cited by The Next Web, the dashboard of OpenAI's Patch the Planet program shows that fewer than a quarter of the flaws have been fixed so far.

Next step: the opening to all Daybreak Red customers. But only full independent evaluations will show what this "Critical" level is really worth.