OpenAI 发布 GPT-6 Cyber，可挖掘漏洞并给出修复建议

OpenAI has introduced GPT-6 Cyber, an AI model trained specifically to hunt for security vulnerabilities in software.

OpenAI says the model can find flaws, build working exploits, and suggest patches. It's also supposed to stay within its assigned boundaries, something some OpenAI models have struggled with in recent months.

The firm says it trained GPT-6 Cyber to respect its operational guardrails, using, among other things, a honeypot inspired by the Hugging Face incident. Without any special safety instructions, GPT-6 Cyber avoided boundary violations in 99.93 percent of cases, up from 94.49 percent for its predecessor. With safety instructions enabled, the model stayed within bounds in 100 percent of tests. Overall, OpenAI rates GPT-6 Cyber as "Critical" in the cybersecurity category of its own Preparedness Framework, the same rating it gave to GPT-6 Astra, the "base" model.

On ExploitGym, a benchmark that tests whether a model can exploit a given vulnerability in a remote system, GPT-6 Cyber scores 48.5 percent according to OpenAI, compared to 32.1 percent for its predecessor GPT-5.6 Cyber. On a new test for finding vulnerabilities in web apps without access to source code, OpenAI reports a hit rate of 40.3 percent, versus 32.0 percent for GPT-6 Astra, the standard model without cyber training.

Full results are available in the system card. All benchmark numbers come from OpenAI itself. No independent testing of the model has been published so far.

GPT-6 Cyber already found real vulnerabilities in Firefox and the Linux kernel

GPT-6 Cyber has already produced results in real-world security research, according to OpenAI. In a targeted campaign, the model found 81 previously unknown severe vulnerabilities in Firefox, even though the browser had already been tested with earlier AI models. The model also showed that 30 already-known issues were more severe than previously thought. Mozilla accepted the reports and has already shipped fixes.

In the Linux kernel, GPT-6 Cyber reproduced 1,724 security vulnerabilities and developed working exploits for 948 of them, more than five times the 166 that GPT-5.6 Sol managed under the same conditions, according to OpenAI. 304 critical findings were reported to Linux maintainers along with suggested fixes, the company says.

For the Linux kernel campaign, OpenAI built a dedicated automated system of scout and analyst agents. They first scanned roughly 5,034 security-relevant locations in the kernel, about seven percent of the total codebase, then filtered those down to 2,308 candidates and confirmed 1,724 vulnerabilities in isolated virtual machines. From there, the system developed the 948 working exploits that OpenAI had already reported. The entire run cost $1,213,430 in compute, according to OpenAI, which works out to $1,279 per exploit. For comparison, programs like Pwn2Own and TyphoonPWN have historically paid between $20,000 and $70,000 per comparable finding as a bounty.

The agents used at least ten novel attack techniques that were previously unknown even to external kernel security experts, OpenAI says. In OpenAI's telling, the models replicated known attack patterns but also found their own approaches. How much weight that claim carries depends on how narrowly you define "own approaches." Researchers still disagree about whether AI models can actually make new discoveries or just recombine what they've seen during training.

OpenAI limits access to selected customers for now

GPT-6 Cyber is initially available through the API and Codex for a select group of Daybreak Red customers, according to OpenAI. Access will be expanded gradually to all Daybreak Red customers. GPT-5.6 Cyber is being opened up to all Daybreak Red users at the same time, and alpha access to Daybreak Blue for GPT-6 Astra will be extended to more organizations and individual security researchers.

OpenAI acknowledges that as models grow more capable, abuse attempts are rising too. Some actors and groups have tried to transfer model capabilities into their own systems.

OpenAI lists several countermeasures: checks that verify whether a model's actions match the user's permissions, targeted monitoring for newly disclosed vulnerabilities, automated safety checks through what it calls Private Safety Processing, IP-based access restrictions for Daybreak Red, and the recommendation to run the model in isolated environments with human oversight.

OpenAI is paying special attention to protecting critical infrastructure like power plants and water treatment facilities. To make access easier for defenders, the company points to its billion-dollar "Daybreak for Frontline Defenders" funding program and a new subgroup called "Daybreak Red for Critical Infrastructure" for authorized testing.

OpenAI talks about a limited window of opportunity in which top-tier models could be used to secure software. The goal is to expand the Daybreak program to organizations of all sizes, independent researchers, and open-source maintainers. Whether that will actually work is another question. Researchers from Epoch AI just showed that the open GLM model could have exploited known but still-unpatched Firefox vulnerabilities.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.