OpenAI has introduced GPT-6 Cyber, a model designed to find security vulnerabilities and help address them. It matters to companies, public institutions, and anyone who uses cloud or AI services at work because powerful models are not limited to defenders. New benchmarks and documented abuse cases show how narrow the line between an authorized security test and an attack has become.
Why AI plays two roles in cybersecurity
Artificial Intelligence (AI) can inspect large amounts of software code, identify possible vulnerabilities, and derive practical attack methods from them. AI agents, meaning systems that carry out multistep tasks with substantial autonomy, can also run tests and prepare fixes. For security teams, that could accelerate work that previously required extensive manual investigation.
OpenAI places GPT-6 Cyber within its Daybreak Red cybersecurity program. According to the report on the new cyber model, access is restricted to authorized organizations. The provider claims substantial improvements over GPT-5.6 Cyber and says the model found 81 previously unknown vulnerabilities in the Firefox browser. These results come from OpenAI and have not been independently verified in the supplied sources.
Restricted access does not resolve the central dilemma. A security model needs to understand how a vulnerability can be exploited before it can assess its severity. The same knowledge can be used offensively. A developer at the startup Charge Robotics reportedly used GPT-5.6 Sol to find a weakness that could have allowed attackers to take control of servers running Ubuntu; there was no evidence at the time that the vulnerability had been exploited.
What AI can contribute to defense
The potential benefit is particularly visible in the Linux kernel, the core component of the widely used operating system. OpenAI describes a prototype that identified and analyzed 2,308 possible findings, dynamically reproduced 1,724 vulnerabilities, and generated 948 local privilege escalation exploits. An exploit is a method for taking practical advantage of a vulnerability, while local privilege escalation gives an existing user more extensive access rights.
The second account of the Linux results also says the prototype closed those 948 weaknesses and used AI to develop patches. A patch is a software correction intended to remove a known vulnerability. If the claim holds up, AI would do more than produce alerts: it could shorten the path from discovery to a proposed repair.
However, the two reports describe the figure of 948 differently. The lead report refers to 948 potential problems, while the more detailed account distinguishes between 2,308 findings, 1,724 reproduced vulnerabilities, and 948 generated exploits. The number should therefore not be treated as 948 independently confirmed vulnerabilities. The supplied sources also provide no independent assessment of the quality or safe deployment of the generated patches.
A concrete workplace example is a security team reviewing a large Linux codebase. An agent can prioritize suspicious sections, reproduce a vulnerability, and prepare a proposed fix. Specialists must still determine whether the finding is relevant and whether the patch creates new problems; the reports do not demonstrate that human review can be removed from the process.
Why the same capabilities make attacks easier
The Vals CyberOffense benchmark illustrates the offensive side. AI agents worked without human assistance from isolated attack machines against simulated corporate networks. According to the report on the CyberOffense benchmark, GPT-6 Sol from the restricted Daybreak program completed 80.8 percent of its targets, while the freely available open-weight model Deepseek V4.1 Flash 1017 reached 72.8 percent.
Open weight means that a model’s weights, the internal parameters established during training, are publicly available. This makes it difficult for a provider to control how the model is eventually used. In the benchmark, one run with Deepseek cost about $3, compared with about $22 for GPT-6 Sol. In the more complex Lighthouse test, the Daybreak model obtained administrator control of one company, stole passwords, and used them to enter a second company; it completed 27 of 31 objectives in less than three hours, while Deepseek completed 21 at one-tenth of the cost.
Runtime also changed the outcome. Deepseek produced no results during the first 25 million processed tokens and made most of its progress only after 100 million tokens. Tokens are small units of text into which models divide their inputs and outputs. Short security tests may therefore underestimate what open models can do. In July, the British AI Security Institute estimated that open models trailed closed frontier models in cyber capabilities by four to seven months, compared with six to ten months during most of 2025.
Artex demonstrates how quickly such tools can escape careful control. The open-source autonomous penetration-testing tool automatically probes systems for weaknesses and has been linked to several attacks since its release in July. Censys found more than 800 publicly accessible Artex deployments that required no password to log in. Not every deployment was operated maliciously, but the exposed systems could reveal attack tools and data; Artex was also linked to attacks on the Korean financial sector and the IT support company ConnectWise.
Pros and Cons of AI in cybersecurity
Pros:
- Faster discovery – AI can analyze large codebases and prioritize potential weaknesses for further investigation.
- Practical validation – According to the provider, agents can reproduce findings and show whether a theoretical weakness is exploitable.
- Proposed repairs – The Linux prototype reportedly developed patches and closed weaknesses in addition to generating exploits.
- More realistic testing – Simulated corporate networks show defenders which attack chains automated agents can already complete.
Cons:
- Dual use – A model that understands vulnerabilities can help close them or use them for attacks.
- Broad availability – Open models and freely downloadable tools cannot reliably be limited to authorized testing.
- Misconfiguration – Hundreds of Artex systems were reachable without a password and sometimes exposed attack resources.
- Unverified claims – The high discovery counts and the quality of automatically generated patches have not been independently confirmed in the sources.
What this means for your use of AI services
The attack surface includes not only AI agents but also access to Large Language Models (LLMs), systems that process and generate language. In a practice known as LLMJacking, criminals use stolen credentials or publicly reachable interfaces to operate models at someone else’s expense or resell the access. Google and Mandiant documented cases affecting finance, retail, technology, and transportation organizations in North and South America and the Asia-Pacific region.
In some investigated cases, according to the analysis of hijacked LLM access, abuse generated more than $100,000 in cloud charges in a single day. Costs at some organizations reached as much as $1 million before the compromised access was blocked. Attackers most often used exposed or stolen cloud credentials, including identity and access management accounts, service accounts, and active sessions.
One concrete workplace example involves software keys stored in a public GitHub project. In a documented case, attackers collected publicly accessible interface keys from a company’s repositories and automatically tested which ones still worked. They limited each request to a single token to avoid attracting attention through unusually high traffic. A small key left in public view can therefore turn into a substantial cloud bill.
For beginners: A useful first step is to determine where your team stores access credentials for AI and cloud services and whether any keys appear in publicly reachable projects. Access should not be available more broadly than the work requires. The LLMJacking and Artex cases show that an exposed key or a deployment without a password can be enough to turn a tool into an attack surface.
For advanced users: AI-assisted security testing becomes more useful when it does not end with a list of possible findings. Teams can reproduce findings, review proposed repairs, and include permissions and active sessions in their controls. The benchmark also suggests that tests need enough time to run, since short evaluations may underestimate an agent’s capabilities.
The gap between ambition and practice is particularly relevant in Switzerland. A Cisco survey of 200 Swiss IT security professionals placed 32 percent of companies in its weakest category and another 40 percent in a reactive group. That put 72 percent in the two weakest categories, compared with 40 percent in the United Kingdom, 48 percent in Italy, and 50 percent in France. In addition, 94 percent of Swiss respondents reported a business-damaging cyber incident during the previous year.
Those Swiss figures are based on self-reported answers and a scoring system developed by the provider, so they do not represent a complete assessment of every company. They nevertheless indicate that more capable AI tools do not automatically create proactive defense. If capabilities are used only in isolated areas, rapid vulnerability discovery, secure access management, and reviewed repairs remain disconnected.
AI can accelerate cyber defense because it can search for weaknesses, reproduce some of them, and prepare possible repairs. The same automation reduces the cost and effort required by attackers, while poorly protected model access becomes a target in its own right. The unresolved risk lies less in one particular model generation than in the combination of capable agents, freely available tools, and organizations that continue to manage credentials and findings reactively.
Sources
- OpenAI will mit GPT-6 Cyber das Aufspüren von Sicherheitslücken erleichtern – doch es gibt auch Kritik – t3n, 2026-11-06
- Dank KI: OpenAI findet 948 Lücken im Linux-Kernel – und schließt sie auch gleich – t3n, 2026-11-06
- KI-Agenten können laut Benchmark eigenständig in Firmennetzwerke einbrechen – The Decoder, 2026-11-07
- Cyberkriminelle kapern LLM-Zugänge und treiben Cloud-Rechnungen hoch – Netzwoche, 2026-11-06
- Hundreds of Artex AI hacking tools found publicly exposed to the web – TechCrunch, 2026-11-06
- Schweizer Firmen bleiben bei der Cyberabwehr im Reaktionsmodus – Netzwoche, 2026-11-06
Image: Sora Shimazaki via Pexels