OpenAI rates its new hacking AI a critical risk and limits who gets it

The short version

• OpenAI released an AI model built for security work. It finds weak spots in software, shows whether an attacker could use them, and drafts a fix.
• OpenAI now rates its hacking skill as "Critical", the top of its own risk scale. Only approved security teams can use it.
• A $1 billion grant program pays for access for government bodies and essential service providers.

What OpenAI released

OpenAI's new model is called GPT-6 Cyber. It is trained for one job: security research. It looks for flaws in software. Then it tries to prove that each flaw can really be used in an attack, and it suggests a repair.

It is a big step up from the previous version. OpenAI tested both on breaking into a target through a flaw that was already known. The new model succeeded 48.5% of the time. The older one managed 32.1%.

The real-world results are more striking. The model found 81 new, serious flaws in Firefox, the web browser. Firefox had already been heavily tested by earlier AI models. Mozilla, which makes Firefox, has already shipped fixes for many of them. It also built working attacks for 948 flaws in Linux, the software that runs most of the world's servers. We covered that earlier this week.

In another test, OpenAI set up well-known business software with known flaws. GPT-6 Cyber completed 95% of the attack tasks. OpenAI's everyday model refused every one of those tasks. In other words, its normal safety settings held.

Why OpenAI calls it critical

OpenAI grades its models on a risk scale. It moved this one to "Critical" for cybersecurity, up from "High" for the previous version. Put simply, OpenAI thinks it could do serious harm in the wrong hands.

So access is tight. At first, only a small group of customers in a vetted program, called Daybreak Red, can use it. It only works from company networks that have been approved in advance. OpenAI says it will widen access to all Daybreak Red customers soon.

There is a second risk. A security AI can wander off and attack systems it was never asked to touch. OpenAI trained this model to stay inside the agreed scope. To test that, it planted easy targets next to the real task, and attacking them was off-limits. The model left them alone in 99.93% of cases without special instructions. With those instructions, it stayed in bounds every time.

OpenAI also asked an industrial security firm to test its most permissive models on a mock power plant. With almost no guidance, the AI found two unknown flaws in the software that manages the plant's protective equipment. The firm's verdict was blunt. AI is lowering the skill needed to plan an attack on physical systems.

What it means for companies in Indonesia

The same tools that help defenders also help attackers. Expect more flaws to be found, and found faster. That shortens the time you have between a public warning and an attack.

This matters most for banks, telcos, and power and water operators. Many run older software that has never been tested this hard. AI testing will reach that software, whether you start it or someone else does.

OpenAI's grants target government bodies and essential service providers that lack budget. OpenAI has not said which countries qualify. If you run essential services in Indonesia, it is worth asking.

What to do next

• Cut the time it takes you to patch systems that face the internet. Treat new flaw warnings as urgent.
• Ask your security partners whether they already use AI to test your systems. Agree on the scope in writing first.
• If you run essential services, check whether you qualify for OpenAI's defender grants.
• Set rules before using any AI security tool. Approve its networks in advance, and have a person review what it does.