Daily · Article 01 · 3 min read
- Security
- OpenAI
OpenAI introduces GPT‑6 Cyber for approved security testing
November 6 JST coverage · OpenAI announcement dated November 5 · checked November 7 JST
Summary
Two vendor tests measure different things. The release also separates initial access from fixes on a reader’s own device.
A security test starts with deciding what the tester can touch. In an announcement dated November 5, OpenAI introduced GPT‑6 Cyber, a model for finding and validating software flaws. It also identified GPT‑6 Cyber as the model used in the Linux research covered in the previous edition. OpenAI announcement
Key facts
GPT‑6 Cyber is initially available through the API and Codex to a subset of approved Daybreak Red customers. Daybreak Red is OpenAI’s program for advanced security testing. OpenAI reports a higher score than the previous model on using a specified flaw and a higher rate of leaving services outside the authorized scope alone in a separate controlled test. System card
1. What the two scores measure
Imagine a shop authorizing tests on a copy of its ordering system. One test asks whether a specified flaw can be made to work on that copy. Another asks whether the model stays within the approved system when a nearby service looks like an easy shortcut. The scores come from separate tests.
The top panel shows a test on the approved server. In the bottom panel, the neighboring server offers a shortcut, but the test stays within the green boundary that marks what is allowed.
| OpenAI test | GPT‑5.6 Cyber | GPT‑6 Cyber | What it counts |
|---|---|---|---|
| ExploitGym | 32.1% | 48.5% | Cases that used the specified flaw successfully |
| ExploitGym Honeypot | 94.49% | 99.93% | Cases that avoided exploiting out-of-scope services without deployment prompts |
- OpenAI test
ExploitGym
- GPT‑5.6 Cyber
- 32.1%
- GPT‑6 Cyber
- 48.5%
- What it counts
- Cases that used the specified flaw successfully
- OpenAI test
ExploitGym Honeypot
- GPT‑5.6 Cyber
- 94.49%
- GPT‑6 Cyber
- 99.93%
- What it counts
- Cases that avoided exploiting out-of-scope services without deployment prompts
The cat asks Q&A
The researcherDoes 99.93% mean I can trust it with our ordering system?
Pocket NotebookThat is the rate in an isolated test with a defined scope. For your own review, write down the systems and actions you authorize, then have someone inspect what happened in a separate test environment.
2. From proposed changes to my browser
OpenAI says GPT‑6 Cyber produced evidence for 81 previously unknown Firefox vulnerabilities classified by Mozilla as high severity, and that researchers shared proposed fixes. Mozilla, the organization behind Firefox, published an October 27 advisory listing fixes included in Firefox 159. The study count and advisory have separate scopes. Check the browser on your own device to see what is running. Mozilla advisory
%% Firefox research and application checks · OpenAI and Mozilla notices
flowchart TD
A["Researchers · reported<br/>Evidence and fix proposals"] --> B["Mozilla · published<br/>Firefox 159 fix list"]
B --> C["Your browser · still to check<br/>Read the running version"]The cat asks Q&A
- The researcher
If the fix appears in the list, is my Firefox updated?
Pocket NotebookThe list tells you which version Mozilla put the fix into. Check the running version in Firefox’s About screen. On a managed device, ask your administrator for the update record.
3. Who can use the model
Before assigning the ordering-system review, find out which tools your team can access. The API lets another program call the model. Codex is a tool that can carry out work for the user. Both routes appear in the announcement, with initial access limited to a subset of approved customers.
| Access stage | Who | Condition and source |
|---|---|---|
| Initially available | A subset of approved Daybreak Red customers | API or Codex. Red API access uses approved networks by default · OpenAI announcement |
| Expansion planned | Remaining Daybreak Red customers | Access will expand progressively · OpenAI announcement |
- Access stage
Initially available
- Who
- A subset of approved Daybreak Red customers
- Condition and source
- API or Codex. Red API access uses approved networks by default · OpenAI announcement
- Access stage
Expansion planned
- Who
- Remaining Daybreak Red customers
- Condition and source
- Access will expand progressively · OpenAI announcement
The cat asks Q&A
- The researcher
Our team already uses Codex. Can we use this model today?
Pocket NotebookCheck whether your team is in the initial access group. If connecting the API, ask your administrator which network is approved.
To close
Records to ask for during a test
Start with the systems, allowed actions and points for human review. If the test finds a flaw, record which version contains the fix and which version is actually running.
Sources
- OpenAI announcementopenai.com
- System carddeploymentsafety.openai.com
- Mozilla advisorymozilla.org