A cybersecurity model trained to find and validate exploitable vulnerabilities, while staying within the scope that researchers set.

We’re introducing GPT‑6 Cyber, a major leap in security research: more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set. GPT‑6 Cyber delivers major gains on key cybersecurity benchmarks over GPT‑5.6 Cyber, including a 51% relative improvement on ExploitGym and a step function improvement when tested on staying within scope. It is already helping to secure real-world software, uncovering and validating thousands of exploits in security-critical codebases such as Linux and Firefox.

On ExploitGym, which tests whether models can exploit a specified vulnerability, GPT‑6 Cyber scores 48.5%, up from 32.1% for GPT‑5.6 Cyber. It also follows task boundaries more reliably: in a separate alignment evaluation, GPT‑6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without its deployment prompt, and 100% with this prompt. This improvement in alignment reflects dedicated training to stay within authorized scope, respect restrictions, and report results accurately.

These capabilities are already helping secure real systems. Our researchers used GPT‑6 Cyber to develop 948 privilege escalation exploits in Linux ⁠ and identify 81 previously unknown high-severity vulnerabilities in Firefox, despite extensive prior testing with frontier models. The model also helped develop candidate patches, and Mozilla has released fixes for many of the Firefox vulnerabilities ⁠ (opens in a new window) . Security teams at Cisco, Calif, and CodeRabbit are using it for vulnerability research and code review, and we have relied on it to find and fix weaknesses in our own infrastructure ⁠ .

Source link