OpenAI limits GPT-6 Cyber launch to approved security customers

OpenAI’s announcement makes GPT-6 Cyber initially available through its API and Codex to selected approved Daybreak Red customers. Wider access within that program is planned. OpenAI presents the model as helping security teams find vulnerabilities, validate their impact and develop fixes, with training intended to keep its actions within the authorized task.

The Linux research shows what happens between a suspected flaw and a report to maintainers. Agents identify candidates, reproduce them in isolation, test their security impact and generate patches. Human researchers then review the exploit, proposed fix and severity before reporting. Early patches sometimes stopped the demonstrated attack while missing related variants, adding unnecessary code or introducing performance tradeoffs. OpenAI says iteration improved their quality; these remain candidate fixes for review.

The system card recommends isolated environments with explicit limits on targets, credentials, network access and permitted actions. For high-risk workflows, human operators should oversee agents so they can stop them. API users are advised to add checks before sensitive actions and stop execution when review fails or denies permission. The document also cautions against directly comparing older system-card scores with current results unless the older models appear in the current comparison, because evaluation methods change.

Source coverage: The Decoder.