OpenAI unveils GPT-6 Cyber, scoring 48.5% on ExploitGym

OpenAI is positioning GPT-6 Cyber less as a general-purpose assistant than as a tool for the specific workflow of vulnerability research: finding a flaw, checking whether it can actually be exploited, and proposing a fix. The benchmark figure it cites, 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, is meant to quantify that jump in exploit capability, and OpenAI describes the model as a major step forward on both cybersecurity capability and safety.

The Firefox and Linux kernel results illustrate what that capability looks like in practice. In Firefox, the researchers surfaced 81 unknown vulnerabilities that Mozilla classified as high severity; in the Linux kernel, they reproduced 1,724 vulnerabilities and built working exploits for 948 of them. Those are the kind of findings that normally take human security teams considerable time to produce.

Access is being kept narrow for now, with OpenAI planning to give the model first to security specialist organizations that pass its screening. That gating suggests the company is treating the model's exploit-writing ability as something to distribute carefully rather than release broadly.