OpenAI Announces Security AI That Both Attacks and Fixes Vulnerabilities

OpenAI announced 'GPT-6 Cyber,' an AI model capable not only of automatically discovering software security vulnerabilities and generating attack code (exploits), but also of proposing fixes. Developed with specialization in the security field, this model differs in character from previous AI security tools in that it can simultaneously handle both offensive and defensive aspects.

Research on AI automatically identifying software bugs and vulnerabilities has been ongoing for some time. However, the effort to have a single model handle both the generation of code that produces real attacks and the proposal of modifications for defense represents a new stage in practical deployment. The reality of the cybersecurity field is that attackers and defenders must deeply understand each other's methods to implement effective countermeasures, and this 'integrated offense-defense' design reflects that philosophy.

According to results published by OpenAI, GPT-6 Cyber discovered 81 previously unknown vulnerabilities in the web browser 'Firefox.' Furthermore, in the Linux kernel (the core part of the OS), it generated 948 functional attack codes. Both figures represent a substantial increase compared to previous-generation models, demonstrating significantly improved capabilities in discovery and generation.

What these results indicate is that AI is surpassing the stage of merely 'pointing out theoretical vulnerabilities' and reaching a level where it can mass-produce code that can actually be exploited. While this becomes a powerful tool for security researchers to quickly identify system weaknesses, it simultaneously increases the risk if placed in the hands of malicious users. The integrated design of attack capability and fix proposals can be seen as one answer from OpenAI to this dilemma.

How such tools will be managed and provided going forward is an issue the entire industry cannot ignore. The decision of how far to open access to AI models with powerful attack capabilities—or conversely, how much to restrict it—directly connects to the question of how to balance technological advancement with safety assurance. The emergence of GPT-6 Cyber can serve as a catalyst for making discussions about that balance more concrete.

AI deployment in the security field is expected to expand further, with 'automation of vulnerability discovery' and 'accuracy of fix proposals' likely becoming the practical focal points. While GPT-6 Cyber's performance metrics serve as one reference point, the extent to which verification in real-world environments progresses will be the next point of attention. Both the tool's capabilities and how it is used require continuous monitoring.