OpenAI’s GPT-6 Cyber ups the ante on vulnerability discovery

Publisher excerpt From CSO Online

OpenAI is introducing GPT-6 Cyber, a restricted access model that the company calls its most capable and aligned cybersecurity model yet, “built to help security researchers identify and validate exploitable vulnerabilities, assess their impact, and harden potential patches before they’re released.” OpenAI researchers said they used GPT-6 Cyber to find 81 previously unknown high-severity vulnerabilities in Firefox and develop working exploits for 948 Linux kernel vulnerabilities, including 588 previously unknown vulnerabilities. Mozilla has begun releasing fixes, and Linux findings are being reported with candidate patches for maintainer review. In a sample of 166 exploits, OpenAI’s researchers identified 10 exploitation techniques that the company says appeared novel, meaning external kernel exploitation experts reportedly had not seen them before, and that could enable someone with local access to obtain root privileges. Highlighting what it called stronger alignment and safeguards, OpenAI said that GPT-6 Cyber “was trained to stay within authorized scope, respect restrictions, and report results accurately.” In its ExploitGym Honeypot evaluation, the model went beyond the intended scope in only 0.07% of cases, compared with 5.51% for GPT-5.6 Cyber. More bugs, new exploitation paths Chris Hughes, VP of security strategy at Noma Security, believes the Firefox findings suggest a deeper reservoir of vulnerabilities in mature software than defenders may have anticipated. “Mozilla says GPT-6 Cyber surfaced high-severity Firefox bugs after multiple generations of frontier models had already hardened that code,” Hughes told CSO. “If that holds up, the long tail of vulnerabilities in mature software is deeper than most of us assumed, which is the same ‘vulnpocalypse’ pressure many have been discussing this year.” Beyond that, the 10 novel techniques might point to how AI models could not only unearth more vulnerabilities but also create new exploitation paths, according to Rob T. Lee, the new chief AI officer at industrial cybersecurity company Dragos, which recently partnered with OpenAI. “That could mean a few things, but that’s interesting to me as it could reveal models can create new exploitation paths,” Lee told CSO. “Adding new TTPs and exploitation paths will make detection more complex.” (Rob T. Lee just joined Dragos, which is run by company founder and CEO Rob M. Lee.) The promise of security at agent speed During a press call to discuss GPT-6 Cyber, OpenAI’s representatives argued that models can help validate exploitability, investigate alternative attack paths, harden patches, and assist with patch deployment. They described the goal as security operating at “agent speed.” OpenAI researcher Eric Wallace said the goal was to “validate the potential exploitability of vulnerabilities at scale” and prioritize the most consequential flaws. He also emphasized testing fixes against alternative routes of exploitation, noting that “one…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.