OpenAI has announced GPT-6-Cyber, an AI model developed specifically for cybersecurity research.
The company says the new model significantly outperforms its predecessor, GPT-5.6-Cyber, at finding and fixing security vulnerabilities. Its most notable achievement for everyday users concerns the Firefox browser.
اضافة اعلان
During one research campaign, the model discovered 81 new security vulnerabilities in the browser, all of which Mozilla classified as high severity.
The discovery is significant because Firefox had previously been tested by several AI models, meaning these flaws had not been detected in earlier checks.
The model did more than identify the vulnerabilities. It also suggested software fixes, and revealed that 30 security vulnerabilities already on record were more serious than earlier assessments had indicated.
Since then, Mozilla has released security updates to address many of these vulnerabilities. Firefox engineer Brian Grinstead said the fixes have reached millions of users.
Fixing vulnerabilities early helps close the paths attackers might exploit before they are discovered and used in attacks.
Firefox users who have disabled automatic updates are therefore advised to manually install the latest version of the browser to receive the available security fixes.
Testing the Linux kernel and OpenAI's servers
GPT-6-Cyber's testing was not limited to the Firefox browser. The model also developed working methods to exploit 948 security vulnerabilities in the Linux kernel.
By comparison, the older model GPT-5.6 Sol developed methods to exploit only 166 vulnerabilities, using the same research test environment.
OpenAI said it had reported 304 critical security findings to the maintainers of the Linux kernel, along with proposed fixes for the problems discovered.
Companies including Cisco and CodeRabbit have also begun using the model to review code, with the aim of finding security problems and improving software quality.
OpenAI also tested the model on its own infrastructure. Tests carried out in controlled environments showed that AI agents operating with GPT-6-Cyber and other company models were able to break out of isolated operating environments and execute code on the underlying host machines.
The company used the results of these tests to fix its software and tighten network restrictions, with the aim of reducing the chances of such vulnerabilities being exploited in future.
How safe is GPT-6-Cyber?
The importance of an AI model capable of carrying out intrusions lies not only in its technical abilities, but in how far it sticks to specified instructions and avoids going beyond the tasks it is permitted to perform.
To test this, OpenAI gave the model a complex task inside a closed environment, with a number of nearby services containing vulnerabilities that could easily be exploited.
The model could have broken into those services to reach the required answer, but they were outside the scope of the authorised task, and it had to recognise this limit on its own.
The test results showed that GPT-6-Cyber refrained from targeting those services in 99.93% of cases, even without being given any specific safety instructions.
When safety instructions were added, the model stayed within the scope of the task in all tests.
According to the company's tests, these results point to the model's ability to distinguish between permitted activities and those that exceed the limits of the task, even when technical opportunities exist to carry out further intrusions.
However, most users will not be able to try the model at present.
OpenAI has classified GPT-6-Cyber as "critical" in cybersecurity under its safety framework, a rating that reflects the sensitive security capabilities it possesses.
For this reason, access to the model is currently limited to a small group of cybersecurity teams that have received prior approval from the company.
Source: Al-Ghad.
