OpenAI's new hacking model raises the stakes for British patching

OpenAI has released a model that its own safety rules class as capable of mounting end-to-end cyber attacks, and has chosen to hand it to only a vetted few. GPT-6 Cyber, unveiled on Thursday, is built to find flaws in software, write working exploits for them and suggest patches. Under OpenAI's Preparedness Framework, its internal scale for dangerous capabilities, it is rated Critical for cyber. That is the top tier, one step above the High given to its predecessor.

By OpenAI's account, the results are striking. Pointed at the Linux kernel, the core of the Linux operating system, the model reproduced 1,724 vulnerabilities and built working exploits for 948 of them. An earlier model managed 166 on the same set-up. These are "privilege escalation" exploits, meaning a way for someone with limited access to seize full control of a machine. OpenAI says it has disclosed 304 critical Linux findings to maintainers with proposed patches. It also says the model found 81 previously unknown high-severity flaws in Firefox, which Mozilla has begun fixing. These are the company's own figures and we have seen no independent verification.

Access is tightly limited. GPT-6 Cyber goes first to approved customers of Daybreak Red, the part of OpenAI's cyber programme for authorised offensive work such as penetration testing, and it is available only through the company's developer interface and its Codex coding tool. OpenAI has also announced a $1bn initiative to support security professionals who protect critical infrastructure such as power and water systems.

Why the restraint matters

The harder question is control. OpenAI reports that, without extra safety prompts, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93 per cent of tests, up from 94.49 per cent for its predecessor. The figure was 100 per cent with those prompts. It sounds reassuring, but a tiny failure rate matters when an automated tool performs thousands of actions. The company's caution is not new. The Register reports that OpenAI cancelled a planned GPT-6.1 release after that model became better at pursuing tasks but worse at staying within the limits it had been given.

Independent testing has found gaps before. When the UK's AI Security Institute evaluated OpenAI's GPT-5.5 earlier this year, it identified a universal jailbreak, a prompt that got round the safeguards on every malicious cyber query tested. A configuration issue then meant the Institute could not verify the final fixes. The same publication pointed readers to National Cyber Security Centre advice on preparing for a "vulnerability patch wave", the surge of fixes that follows when AI speeds up the discovery of bugs.

The British picture

That wave is the context for the NCSC's annual review, published on 3 November. The agency, part of GCHQ, judges it highly likely that AI-powered malware will feature in a ransomware attack on UK critical national infrastructure by 2028. Its companion assessment, Artificial intelligence and cyber intrusion, goes further for ordinary organisations. It says it is almost certain that many systems will still be vulnerable to AI tools that find and exploit weaknesses. Its chief executive, Richard Horne, put the cause bluntly: "For decades we have collectively got away with tech on the cheap."

The NCSC is not predicting science fiction. It still expects AI to prove a net positive for security. Other coverage of the review notes that attackers are expected to use AI mainly to improve existing operations rather than hand whole attacks to autonomous systems. The point is that AI did not create these weaknesses. It makes finding and using them cheaper and quicker.

For British businesses, the practical lesson is about speed and inventory, not about buying a new tool. If a critical patch takes a month to reach your systems, the window in which a flaw can be exploited is likely to shrink beyond what that routine can handle. Firms should know which software and suppliers they depend on, which systems are old enough to be hard to patch, and how quickly they can test and apply fixes. They should also ask their IT providers how they are preparing. GPT-6 Cyber will mostly be used by specialists, but defenders and attackers will increasingly have access to similar capability. The dull disciplines of patching, access control and backups are what the NCSC says still decide who copes.