GPT-6 Cyber: Automated Security Audits and Patch Proposals for Small Teams

OpenAI has released GPT-6 Cyber, an AI model specifically trained to hunt for software security vulnerabilities, build working exploits, and propose patches. According to The Decoder, the model achieved a 100% success rate in staying within operational boundaries when safety instructions were enabled, marking a significant improvement in reliability over its predecessor.

What happened

The Decoder reports that GPT-6 Cyber scores 48.5 percent on the ExploitGym benchmark, compared to 32.1 percent for GPT-5.6 Cyber. In real-world testing, the model identified 81 previously unknown severe vulnerabilities in Firefox and reproduced 1,724 security vulnerabilities in the Linux kernel, developing working exploits for 948 of them. OpenAI notes that the entire Linux kernel campaign cost $1,213,430 in compute, equating to $1,279 per exploit. This is significantly lower than the $20,000 to $70,000 bounties historically paid by programs like Pwn2Own. The model is currently available through the API and Codex for select Daybreak Red customers, with broader access planned. OpenAI emphasizes that all benchmark numbers are self-reported and no independent testing has been published yet.

Why it matters for small company owners and team leads

For small companies, the traditional barrier to enterprise-grade security auditing has been cost and talent scarcity. While the $1.2 million total cost for a kernel-wide scan is out of reach for most SMBs, the per-exploit cost of $1,279 is a game-changer. Previously, hiring a specialized security researcher or paying for a manual penetration test could cost tens of thousands of dollars for a single finding. GPT-6 Cyber shifts the paradigm from expensive, periodic audits to continuous, automated vulnerability discovery. However, the key constraint is access. Since the model is initially limited to select Daybreak Red customers, small teams must assess whether they can gain entry or if they need to rely on the broader GPT-5.6 Cyber rollout. The ability for the model to propose patches, not just find bugs, reduces the operational burden on small engineering teams who often lack dedicated security staff. This allows a two-person dev team to handle security fixes that would previously require an external agency.

What to do this week

1. Audit your current software supply chain to identify the top three critical applications where a vulnerability would cause the most immediate financial or operational damage, prioritizing these for early adoption of automated scanning tools.
2. Register your organization for the Daybreak Red program or monitor OpenAI’s API documentation for the GPT-5.6 Cyber rollout, as this is the likely entry point for small teams before GPT-6 Cyber becomes widely available.
3. Establish a simple internal protocol for handling AI-generated patch proposals, including a mandatory manual code review step, to mitigate the risk of introducing new vulnerabilities while leveraging the model’s speed.

Sources

• OpenAIs GPT-6 Cyber can both break into systems and propose how to fix them — The Decoder