On ExploitGym, the benchmark used by OpenAI to evaluate AI models' ability to exploit known vulnerabilities in remote targets, GPT-6 Cyber achieved a 48.5% success rate, compared to 32.1% for GPT-5.6 Cyber. That's a 16.4-percentage-point improvement in just a few months.
But the progress goes beyond a benchmark. OpenAI's new model has demonstrated that it can identify vulnerabilities, reproduce them, and develop working exploits with increasing autonomy.
The question is no longer just what AI can find, but what happens when it can also demonstrate how those vulnerabilities can be exploited.
From finding vulnerabilities to exploiting them
The results published by OpenAI show just how far these capabilities have advanced.
In Firefox, GPT-6 Cyber identified and documented 81 previously unknown vulnerabilities rated high severity by Mozilla, supported by evidence and reproducible proof-of-concept tests. Mozilla has begun rolling out fixes for the reported issues.
In the Linux kernel, the model reproduced 1,724 vulnerabilities and successfully developed 948 working privilege-escalation exploits in a research environment. For comparison, GPT-5.6 Sol, using the same tools, produced 166.
These were not 948 newly discovered vulnerabilities, but rather demonstrations of the model's ability to reproduce and exploit known flaws. That distinction matters: AI can do more than point to a potential security issue. It can also generate evidence that a vulnerability is exploitable.
OpenAI classified GPT-6 Cyber at the Critical cybersecurity capability level under its Preparedness Framework, above the High level assigned to GPT-5.6 Cyber.
The increase in capability is significant. But it also raises new questions about how these tools can be used safely.
More powerful AI, but not available to everyone
Despite its capabilities, GPT-6 Cyber is not generally available.
OpenAI has restricted access to approved organizations participating in Daybreak Red, its program for authorized security teams. The model is accessible through the API and Codex, subject to specific access and usage requirements.
The decision is intended to reduce the risk of advanced offensive capabilities being used outside authorized environments.
However, it also presents a challenge for the cybersecurity ecosystem: AI capabilities are evolving rapidly, but access to them is far from universal.
For organizations relying on AI-powered security tools, this raises an important question: what happens to testing coverage and depth when the most advanced model is unavailable to their security provider?
The answer should not depend solely on access to a particular model, but on the ability to integrate different technologies into a consistent security strategy.
The 0.07% that also matters
The autonomy of an offensive AI agent is not measured only by the vulnerabilities it can exploit. What it chooses not to do matters just as much.
OpenAI evaluated how well GPT-6 Cyber respected scope boundaries during tests involving vulnerable services that were explicitly outside the authorized testing environment.
According to its safety evaluation, without additional safety instructions, the model avoided attacking those services in 99.93% of cases, compared to 94.49% for GPT-5.6 Cyber. With safety instructions in place, no out-of-scope attacks were observed during the evaluation.
That is a meaningful improvement. But the remaining 0.07% also deserves attention.
Although these results come from controlled testing conditions and do not represent real-world incident rates, the experiment highlights why operational safeguards remain essential.
When AI autonomously performs offensive security testing, defining and respecting scope is not a minor technical detail. It is a fundamental requirement for safe operation.
What does this mean for security teams?
GPT-6 Cyber's progress does not mean every organization can fully automate offensive security testing. But it does show how quickly AI systems are advancing in their ability to investigate and exploit vulnerabilities.
And that evolution has practical implications.
Greater testing capabilities. AI agents can expand the number of assets and scenarios evaluated, run tests more frequently, and generate technical evidence that previously required more manual intervention.
Stronger operational safeguards. The more autonomous an offensive security tool becomes, the more important it is to define which assets it can test, what actions it is authorized to perform, and how its activity is monitored and recorded.
Growing pressure on remediation. As the ability to discover and validate vulnerabilities increases, security teams need processes to prioritize findings, coordinate fixes, and verify that issues have actually been resolved.
The challenge is not simply adopting more powerful models. It is building a security operation capable of using those capabilities without sacrificing visibility or control.
Finding more vulnerabilities doesn't mean managing risk better
Another figure from the launch deserves attention.
During its Linux testing, OpenAI developed 948 working exploits and reported 304 critical issues to maintainers, along with proposed fixes.
But identifying a vulnerability, demonstrating its exploitability, and fixing it are three different stages.
Every finding requires context. Not all vulnerabilities represent the same level of exposure, and not all require the same urgency when it comes to remediation.
As AI accelerates vulnerability research, reliable evidence, clear prioritization criteria, and mechanisms to verify fixes become increasingly important.
The value of offensive security is not measured by how many vulnerabilities it finds, but by how effectively it helps an organization reduce real risk.
Three questions to ask your security provider
The evolution of models like GPT-6 Cyber is also changing what organizations should expect from offensive security providers.
- Which AI models does your testing capability depend on? What happens to coverage if a model becomes unavailable or a more advanced alternative emerges?
- How is exploitability validated? What evidence supports the findings, and how are security experts involved in the process?
- What safeguards govern autonomous agents? How is testing scope defined, how are actions monitored, and how is each execution audited?
These questions help organizations evaluate something more important than the model itself: the strength of the security strategy behind it.
The real challenge isn't finding more. It's acting better.
GPT-6 Cyber is another example of how AI is transforming offensive security. Tasks that recently required hours of specialized research can now, in certain scenarios, be performed autonomously and at an increasingly large scale.
But one thing remains unchanged: finding a vulnerability is not the same as reducing risk.
As models become more capable, the difference will lie in how organizations put those capabilities to work: through recurring testing, evidence of exploitability, clear operational safeguards, and remediation processes that can keep pace.
Because the next leap in offensive AI capabilities may be just around the corner. The question is whether security teams will be ready to make the most of it.
