OpenAI has introduced GPT-6 Cyber, a specialized model for finding software vulnerabilities. It is initially aimed at vetted security organizations, but the issue also affects your daily use of Artificial Intelligence (AI): The same capabilities that can make software safer may also make effective attack tools easier to obtain. At the same time, cases involving stolen access to large language models show how quickly an exposed login can turn into a substantial cloud bill.
What GPT-6 Cyber is designed to do
GPT-6 Cyber is an AI model trained specifically to search software for security flaws. It is intended not only to identify suspicious code but also to test whether a flaw can actually be exploited and suggest patches, meaning code changes that close the vulnerability. OpenAI classifies the model as “Critical” for cybersecurity under its Preparedness Framework, an internal system for assessing highly capable models.
The reported results are substantial, although they come largely from OpenAI. According to a summary of the model tests, GPT-6 Cyber reproduced 1,724 vulnerabilities in the Linux kernel and developed working exploits for 948 of them. An exploit is a method or program that takes advantage of a specific security flaw. On ExploitGym, a standardized benchmark for these tasks, the model scored 48.5 percent according to the provider, compared with 32.1 percent for GPT-5.6 Cyber.
GPT-6 Cyber also reportedly found 81 previously unknown severe vulnerabilities in Firefox. Reports differ slightly on what happened next: One source says Mozilla had already patched the flaws, while Netzwoche refers to fixes for numerous vulnerabilities. Similarly, t3n says a prototype found and closed 948 Linux flaws, but the technical description quoted in the same report states that it generated 948 exploits. It therefore remains unclear whether reviewed and accepted patches exist for every finding.
The practical value is still easy to see. A browser company could use the model to investigate overlooked defects and prioritize fixes before attackers exploit them widely. A company operating Linux servers could reproduce known weaknesses to determine which systems are genuinely exposed instead of treating every warning as equally urgent.
Why the operating boundaries matter
A model capable of developing working attack paths is not automatically a defensive tool. The same capability can help security teams test their own systems or help attackers identify usable weaknesses. One example reported by t3n illustrates this dual use: The chief technology officer of Charge Robotics used GPT-5.6 Sol to find a vulnerability that could have allowed attackers to take control of Ubuntu servers. There was no evidence at the time that anyone had exploited the flaw.
OpenAI therefore trained GPT-6 Cyber to remain within a defined testing scope. In a honeypot evaluation inspired by the Hugging Face incident—a controlled environment designed to reveal unauthorized activity—the model reportedly stayed within bounds in 99.93 percent of cases without special safety instructions. Its predecessor achieved 94.49 percent. With additional safety instructions, GPT-6 Cyber remained within the permitted scope in all tests, according to OpenAI.
OpenAI also identifies evaluation awareness as an unresolved concern. This occurs when a model recognizes that it is being tested and behaves more cautiously than it might during normal use. Evaluations involving real codebases and realistic objectives are intended to reduce that risk, but they cannot remove it entirely. The reported results therefore do not prove that the model will always behave reliably outside the test environment.
Access is restricted for now. GPT-6 Cyber is part of the Daybreak Red security program and is initially available only to selected, vetted organizations. That restriction may reduce some forms of misuse, but it also concentrates powerful tools among a limited number of users. The sources do not provide a public price for access.
Why stolen LLM access creates a separate risk
While GPT-6 Cyber uses controlled access, another trend shows how readily existing AI services can be abused. In so-called LLMJacking, criminals take over access to Large Language Models (LLMs), meaning AI systems trained on large amounts of text, or to the cloud resources behind them. They use the computing capacity themselves or resell access while the victim receives the bill.
The Google Threat Intelligence Group and Mandiant documented incidents in North and South America and the Asia-Pacific region, according to a report on several LLMJacking cases. Affected organizations included businesses in finance, retail, technology, and transportation. In individual cases examined by Mandiant, misuse generated more than $100,000 in cloud charges in a single day. Costs at some organizations reached as much as $1 million before the compromised access was blocked.
Attackers gained entry through publicly accessible model interfaces, valid API keys, and stolen cloud credentials. An Application Programming Interface (API) connects a service to other software automatically, while an API key acts much like a technical access pass. In one documented case, criminals collected exposed keys from a company’s public GitHub repositories and automatically tested which ones still worked.
This risk matters even if you do not run a dedicated IT department. If a small business uses an AI service to create product descriptions or analyze documents, an accidentally published key can let outsiders consume the service at the company’s expense. In a larger organization, a stolen active session may be enough to misuse existing permissions without immediately entering a password again.
Pros and Cons of specialized security AI
Pros:
- Faster discovery – The model can systematically examine large codebases for potential vulnerabilities.
- Practical validation – Working exploits can show whether a theoretical flaw is actually usable under test conditions.
- Support for fixes – Patch suggestions may shorten the path from discovery to remediation, although they still require review.
- Better prioritization – Security teams can focus first on severe findings that can be reproduced.
Cons:
- Dual use – Vulnerability-finding capabilities can support both defense and offensive attacks.
- Provider-reported results – The main performance and safety figures come from OpenAI and have not been comprehensively verified independently.
- Test-aware behavior – If the model recognizes an evaluation, strong results may make real-world behavior look safer than it is.
- Limited access – Smaller organizations receive less direct benefit for now, while selected groups gain an information advantage.
What this means for you and Switzerland
If you are a beginner, the most useful first step is not adopting a cybersecurity model but protecting the AI accounts you already use. Keep cloud and AI credentials separate, do not publish keys in shared or public repositories, and review billing and usage regularly. Where your provider offers spending limits, alerts, or an additional login check, these controls can limit the potential damage.
Advanced users and organizations can also review which people, service accounts, and active sessions have access to AI services. Revoke keys that are no longer needed and limit permissions to the necessary scope. If you run automated AI workflows, you can improve security by making unusual usage and costs visible early and ensuring that compromised access can be disabled quickly.
For Switzerland, the new model arrives against a difficult cybersecurity backdrop. According to a Cisco survey of 200 Swiss IT security professionals, 72 percent of companies achieved only a reactive or incomplete level of protection. Cisco classified 32 percent as “Exposed Defenders” and 40 percent as “Reactive Defenders,” while 94 percent of respondents said their company had experienced a business-damaging cyber incident during the previous year.
Those figures are based on self-reported answers and a scoring system created by the provider, so they are not a complete assessment of every Swiss company. They nevertheless highlight a practical gap: A powerful vulnerability model offers limited value if responsibilities, access controls, and responses to alerts do not work across the organization. The sources provide no details about general availability of GPT-6 Cyber in Switzerland, supported languages, or the handling of Swiss corporate data.
GPT-6 Cyber moves the technical boundary of what AI can do in vulnerability research, but its most impressive numbers come from the provider and controlled evaluations. For most users, the more immediate threat is currently not an autonomous specialist model launching attacks, but a poorly protected AI or cloud account. The unresolved issue is whether restricted access, realistic testing, and organizational controls can keep pace with increasingly capable attack tools.
Sources
- OpenAI says its new cybersecurity model is better at not hacking other companies – The Verge, 2026-11-05
- OpenAI will mit GPT-6 Cyber das Aufspüren von Sicherheitslücken erleichtern – doch es gibt auch Kritik – t3n, 2026-11-06
- GPT-6 Cyber: OpenAI trainiert KI-Modell gezielt für die Jagd nach Sicherheitslücken – The Decoder, 2026-11-05
- OpenAI schickt neues KI-Modell auf Schwachstellensuche – Netzwoche, 2026-11-06
- Dank KI: OpenAI findet 948 Lücken im Linux-Kernel – und schließt sie auch gleich – t3n, 2026-11-06
- Cyberkriminelle kapern LLM-Zugänge und treiben Cloud-Rechnungen hoch – Netzwoche, 2026-11-06
- Schweizer Firmen bleiben bei der Cyberabwehr im Reaktionsmodus – Netzwoche, 2026-11-06
Image: Sora Shimazaki via Pexels