OpenAI’s GPT-6 Cyber Puts AI Defenders in a Race Against AI Attackers
OpenAI’s GPT-6 Cyber Puts AI Defenders in a Race Against AI Attackers
OpenAI’s latest cyber push began with an automated vulnerability pipeline aimed at some of the internet’s most scrutinized code. In a scan of the Linux kernel as it stood in mid-October 2026, the company said its upcoming model identified 948 local privilege-escalation vulnerabilities and generated patches that were then reviewed by a human researcher.
Greg Brockman framed the result as an economics-changing defensive tool: OpenAI had “found, validated, and prepared patches for almost 1,000” Linux privilege escalations at roughly $1,000 per vulnerability. The company says it is also directing significant frontier-computing capacity toward finding and fixing flaws in open-source code, without charge.
The test results, however, illustrate the double edge. OpenAI’s researchers found 1,724 Linux security flaws and developed administrator-level exploits for 948 of them, including 588 previously unknown vulnerabilities; it also reported 81 previously unknown high-severity flaws in Firefox. The Linux findings were reviewed before disclosure to maintainers, but the underlying techniques are the same ones malicious operators could use to seize control of systems.
On Thursday, OpenAI released GPT-6 Cyber only to a subset of verified users, assigning the model its highest, “critical,” cybersecurity-capability rating. It is initially limited to approved Daybreak Red customers conducting authorized advanced security work, with broader access planned among that vetted group.
That restraint reflects the central race now facing security teams. OpenAI argues specialized, aligned access can help patch weaknesses before criminals exploit them; outside observers warn that AI’s ability to discover and test flaws at scale could overwhelm organizations’ capacity to fix them. Competition is accelerating on both the defensive and research fronts: Google DeepMind has separately highlighted AI-assisted advances exposing weaknesses in legacy 1024-bit RSA cryptography.
Write a comment