OpenAI's GPT-6 Cyber: one model to find vulnerabilities, write exploits and suggest patches

What OpenAI announced

According to The Decoder, OpenAI is introducing GPT-6 Cyber, a model built to find security vulnerabilities in software, develop exploits and suggest patches. According to OpenAI, the model has already found 81 previously unknown vulnerabilities in Firefox and developed 948 working exploits in the Linux kernel, which the company describes as significantly more than its predecessor. These figures come from the vendor and have not been independently verified in this report.

Why one model plays two roles

The same capability that locates a flaw can also exploit it. For security teams, this means an offensive tool can also serve defense. The key metric becomes the time between discovery and patching, not merely whether a weakness exists.

How to prepare testing and patching

A company that wants to use such tools should start with four steps:

1. Set up a test environment isolated from production, where exploits can run safely.
2. Define who may access the model and for which tasks, and log all actions.
3. Establish a patching workflow: a named owner for each finding, a deadline and a priority based on business impact.
4. Review every suggested patch through code review and regression tests before it reaches production.

The pitfalls are concrete. An automatically generated fix may address a symptom rather than the root cause and introduce new defects. An exploit that works in a lab does not equal full risk in a live system, but skipping impact assessment creates false confidence.

Regulatory context in the EU

In the European Union, vulnerability handling obligations stem from the NIS2 Directive, which requires essential and important entities to apply risk management measures, including vulnerability handling and disclosure. Companies should check whether using a tool of this kind requires additional safeguards and document their testing to demonstrate control over the process. The exact scope of obligations depends on the entity's status and should be confirmed with legal counsel.

Summary

Tools such as GPT-6 Cyber blur the line between attack and defense. Companies gain faster vulnerability detection, but only if they combine testing, access control and patching processes that keep pace with the discoveries.

Lub System helps B2B companies implement AI, automation and IT solutions end-to-end - from strategy to deployment. See our services or get in touch to discuss your case.