GPT-6 Cyber Patches More Security Flaws for Less Cost: OpenAI’s security-tuned version of GPT-6 Astra closed root-level Linux holes for $1,280 each

OpenAI built a cybersecurity model that discovered, exploited, and patched nearly 950 severe vulnerabilities in the Linux kernel in a single run.

What’s new: GPT-6 Cyber, a version of GPT-6 Astra fine-tuned to find software vulnerabilities, is restricted initially to approved customers. In a mid-October scan of the Linux kernel, GPT-6 Cyber generated working exploits for 948 flaws that allow ordinary users to gain full control of a machine. The run cost $1,213,430 in API calls, around $1,279 per exploit. (In July, the same harness running GPT-5.6 Sol exploited 166 such vulnerabilities for a total cost of $513,690, around $3,095 per exploit.)

• Input/output: Text and images in (up to 1,050,000 tokens), text out (up to 128,000 tokens)
• Features: Reasoning, tool use, streaming, structured outputs
• Performance: More capable than GPT-6 Astra on most tests of cybersecurity conducted by OpenAI
• Availability: Initially offered to selected customers of OpenAI’s Daybreak Red advanced security program; customers must use single sign-on, multifactor authentication, managed devices, and least-privileged access and restrict API requests to specific IP addresses
• Price: API $20/$2/$100 per million input/cached/output tokens; cache storage $25 per million tokens for 30 minutes, $50 per million tokens for 12 hours
• License: Proprietary
• Undisclosed: Parameter count, architecture, training data, training details, knowledge cutoff, reasoning levels, schedule for wider availability

How it works: OpenAI fine-tuned GPT-6 Cyber via reinforcement learning on tasks such as reproducing crashes, generating working exploits, and finding code vulnerabilities. The reward function discouraged refusal of authorized security requests and reward hacking, and it encouraged the model to stay within authorized behaviors and to report results accurately. A team of agents ran a pipeline that enabled the model to find, confirm, and exploit flaws in the Linux kernel and patch them.

• In the pipeline, scout agents identified security-relevant parts of the kernel that ordinary users can reach. Analyst agents read the scout agents’ candidate code and flagged 2,308 flaws within 12 hours. For each candidate, a triage agent wrote a short program to trigger the flaw in a virtual machine that detected memory errors.
• The triage agent iterated until the flaw appeared or the agent ran out of approaches. This step confirmed 1,724 flaws within 30 hours. A screening agent reviewed the confirmed flaws and kept those that had a plausible path to root access that would confer full control of a machine.
• Exploit-writing agents tried to gain root access in virtual machines configured with a standard Linux distribution’s protections and produced 1,169 working exploits. The pipeline wrote patches and checked nearby code for variants of each flaw. Security researchers reviewed the exploits and proposed severity ratings before reporting them to Linux maintainers.

Performance: GPT-6 Cyber proved substantially more capable than GPT-5.6 Cyber in tests by OpenAI, and it outperformed GPT-6 Astra on most benchmarks. Independent tests have not yet been published.

• On ExploitGym, which tests whether models can exploit a specified vulnerability in a remote target, GPT-6 Cyber set to the highest reasoning level tested (48.45 percent) outperformed GPT-6 Astra set to its highest level (42.43 percent) and GPT-5.6 Cyber (32.1 percent). On a version of ExploitGym with stronger defenses, GPT-6 Cyber (36.94 percent) outperformed GPT-6 Astra (29.69 percent). Gemini 4 Carbon, evaluated by Google without guardrails at an undisclosed reasoning level, achieved 54.8 percent.
• ExploitGym Honeypot instructs a model to exploit a specific target but includes an easy-to-exploit supporting service that the model may use but isn’t authorized to attack. GPT-6 Cyber attacked that service in 0.07 percent of attempts without OpenAI’s safety deployment instructions, compared with 5.51 percent for GPT-5.6 Cyber and 0 percent for GPT-6 Astra. With the instructions, GPT-6 Cyber did not attack the honeypot.
• On FrontierCyber, 288 real-world challenges, GPT-6 Cyber solved 90 and GPT-6 Astra solved 96. Neither model solved any of the 15 hardest challenges, nor did they successfully attack a fully hardened target. 

Behind the news: The cybersecurity capabilities of recent top-performing AI models — which are available either in guardrailed versions or to selected customers — have set security personnel on high alert. In October, the U.S. government reported critical flaws in the PHP server coding language after OpenAI had led a coalition that addressed them in preceding months. Hackers stole $6.3 billion from the cryptocurrency exchange Binance, the biggest known crypto heist, by exploiting compromised internal AI tools.

Why it matters: The latest cybersecurity models pose both challenges and opportunities for security. On one hand, they’re extremely adept at exploiting flaws. On the other, they make flaws easy and inexpensive to find and fix. Hacking competitions like Pwn2Own have offered $20,000 to $70,000 per Linux kernel exploit, yet OpenAI spent $1,279 per exploit.

We’re thinking: It’s encouraging that GPT-6 Cyber without safety instructions exploited the off-limits service in only 0.07 percent of attempts in OpenAI’s honeypot test, and with safety instructions never tried. We’d like to see OpenAI help independent testers to repeat this test or others like it.