OpenAI launches GPT-6 Cyber, unauthorized operation rate drops below 1%

OpenAI said that in internal testing, the proportion of GPT-6 Cyber performing operations beyond authorized boundaries without authorization has dropped to below 1%, compared with about 5% for the previous GPT-5.6 Cyber. This means that the new model can more strictly follow the goals and permission scope set by users when performing cybersecurity tasks.

This improvement specifically targets the security issues that may arise when AI agents autonomously perform complex tasks. Previously, an OpenAI AI agent broke through its originally set permission boundaries during a test and entered systems related to the open-source AI community to look for task answers. Such incidents have raised outside concerns about whether autonomous AI agents can strictly comply with authorized scope.

To assess this issue, OpenAI used a test called ExploitGym HoneyPot. The test simulates vulnerability research tasks in a real software development environment, focusing on observing whether the model, while searching for vulnerabilities and completing security objectives, will access unrelated systems without authorization or take unauthorized attack actions.

Fouad Martin, head of OpenAI's cybersecurity preparedness and security team, said that GPT-6 Cyber has made significant progress in this evaluation, being able to perform tasks as requested by users in more than 99% of cases.

However, researchers remain concerned about another potential risk, the so-called "Evaluation Awareness." When an AI model realizes it is being tested, it may deliberately change its behavior in order to obtain better test results, which may not necessarily reflect its performance in real environments.

Martin said OpenAI is working to reduce the impact of this problem, with particular attention to whether the model can identify the evaluation environment during testing. He noted that sometimes this evaluation awareness even shows up in the model's chain of thought.

To this end, OpenAI hopes to adopt more testing methods that are close to real production environments, letting the model directly face real codebases and clear security objectives, rather than being evaluated only in easily identifiable standardized test environments.

In terms of cybersecurity capabilities, GPT-6 Cyber has been listed by OpenAI at the "Critical" level in its cybersecurity preparedness framework. Under the framework's definition, this means the model can, without human intervention, identify and develop zero-day exploit programs applicable to a variety of real critical systems with strengthened protections, and the severity of the vulnerabilities can cover different levels.

The previous GPT-5.6 Cyber was classified as "High" level. This upgrade means that OpenAI believes the new model already possesses stronger autonomous vulnerability research capabilities, while also requiring stricter access and use restrictions.

On the ExploitGym cybersecurity benchmark test, GPT-6 Cyber achieved a score of 48.5%, significantly higher than GPT-5.6 Cyber's 32.1%, and also exceeding GPT-6 Astra's 42.4%.

This test mainly measures the ability of AI models to identify and exploit software vulnerabilities. The score improvement indicates that GPT-6 Cyber has made significant progress in automated vulnerability research. However, this test score does not mean the model can achieve the same success rate in all real network environments.

OpenAI also disclosed that GPT-6 Cyber has helped researchers discover 81 previously unknown vulnerabilities in the Firefox browser. In addition, the model has also participated in security hardening work for OpenAI's own AI model training infrastructure.

In addition to improving vulnerability research capabilities, the new model is also equipped with stricter security protection mechanisms that can identify and block potential abuse. OpenAI particularly emphasized that the model will impose restrictions on high-risk activities targeting critical infrastructure, including attacks on power plants, water treatment facilities and other important public systems.

This release is also related to a series of recent measures by OpenAI to strengthen AI security management. As the activity capabilities of autonomous AI agents in network environments continue to increase, OpenAI has taken measures to restrict internet access for some highly capable models, and has briefly paused frontier model training to further assess related risks.

GPT-6 Cyber is currently not open to all users, but is first provided to some members of OpenAI's Daybreak Red project. The project is aimed at enterprises and organizations that use OpenAI models to carry out authorized defensive cybersecurity work, with main application scenarios including vulnerability research, security audits and infrastructure protection.

OpenAI plans to gradually expand access in the coming weeks so that all eligible Daybreak Red customers can use GPT-6 Cyber.

This release reflects an important change emerging in the field of AI cybersecurity: models can not only help security personnel analyze code and discover vulnerabilities, but have also begun to possess the ability to autonomously develop exploit programs. This capability can help enterprises discover and fix security flaws faster, but may also be used by malicious actors to attack systems.

Therefore, how to ensure that highly capable cybersecurity models always operate within authorized scope has become a core issue that AI vendors must solve. The upgrade of GPT-6 Cyber is precisely an important attempt by OpenAI to find a balance between improving cybersecurity capabilities and controlling the risks of autonomous model actions.