OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement'

The ability to exploit bugs is now significantly more automated and safer for authorized users.

OpenAI has released GPT-6 Cyber, a new AI model specifically designed for cybersecurity tasks. This model reportedly demonstrates improved capabilities in finding and exploiting vulnerabilities compared to previous versions, such as GPT-5.6 and GPT-6 Astra. A key focus for GPT-6 Cyber is its adherence to "rules of engagement," with OpenAI claiming it avoided exploiting out-of-scope services over 99% of the time during evaluations. The model achieved a 48.5% score in OpenAI's ExploitGym training, a significant increase from GPT-5.6 Cyber's 32.1%. OpenAI has classified GPT-6 Cyber as "Critical" under its Preparedness Framework due to its ability to identify and develop zero-day exploits and execute cyberattacks. Consequently, initial access is restricted to a select group of "Daybreak Red" customers through the API and Codex, with broader access planned for the coming weeks. This release coincides with OpenAI's efforts to enhance its product security, including raising bug bounty rewards.

GPT-6 Cyber's release signals a maturing market for AI-powered offensive security tools, moving towards greater control and predictability. The emphasis on adhering to "rules of engagement" addresses a critical concern for organizations deploying these powerful models, aiming to prevent unintended consequences or misuse during authorized testing. This suggests a trend towards more responsible AI development in the cybersecurity domain, where capability is balanced with safety protocols.

This development directly impacts security professionals and organizations engaged in penetration testing, red teaming, and vulnerability research. The availability of a more effective and demonstrably safer tool can accelerate these processes, potentially uncovering critical vulnerabilities faster and with less risk of accidental scope creep. The restricted initial release also points to a cautious rollout strategy for highly capable AI, emphasizing controlled deployment for specialized use cases before wider availability.