OpenAI says GPT-6 Cyber built working exploits for 948 Linux kernel vulnerabilities in one research campaign, more than five times the 166 that GPT-5.6 Sol exploited with the same research harness (OpenAI). That's a vendor's number from a vendor's lab, and we'd treat it as one. It is also specific, and the kernel maintainers who were sent 304 critical findings can check it.
Within a few days, OpenAI launched GPT-6 Cyber and a partnership with Hacktron, Anthropic released Claude Fable 5.2 and Mythos 5.2, Google DeepMind published a machine-checked proof about the code behind Signal, and two security firms described attackers running AI agents against real targets. We read the company posts and the reports behind them. The Hacker News carried the benchmark story, Wired the Signal one.
What OpenAI says GPT-6 Cyber can do
On ExploitGym, a test of whether a model can exploit a specified vulnerability, OpenAI reports 48.5% for GPT-6 Cyber against 32.1% for GPT-5.6 Cyber. On a new web penetration test where models probe applications without seeing source code, it found 40.3% of the vulnerabilities, against 32.0% for GPT-6 Astra (OpenAI). The sharpest comparison is a refusal one: on RemoteExploitBench, which uses known flaws in GitLab, PostgreSQL and Jenkins in a controlled lab, GPT-6 Astra running with Daybreak Blue refused every task while GPT-6 Cyber completed 95%.
Outside the lab, OpenAI says its researchers used the model to find 81 previously unknown high-severity vulnerabilities in Firefox, as classified by Mozilla, which began landing fixes. Mozilla's Brian Grinstead, quoted in the launch post, said Firefox entered 2026 as "one of the world’s most hardened and scrutinized codebases." That is the point: this is not a toy target. OpenAI also rates the model Critical for cybersecurity under its Preparedness Framework, up from High for the last one. When a lab labels its own product that way, we'd read it as a warning label as much as a feature list.
The safety claim is the odd one out. OpenAI built a test in which easy-to-attack side services sit next to the real target, and a model has to realize that attacking them is out of scope. Without its deployment prompt, GPT-6 Cyber stayed in bounds 99.93% of the time, up from 94.49% for GPT-5.6 Cyber. That older figure means about one run in eighteen strayed. The new one still leaves about seven strays per ten thousand, and OpenAI itself recommends sandboxing, action review and human oversight for high-risk work. We'd take that advice literally.
The most useful outside voice in the launch post is Rob T. Lee, Dragos's Chief AI Officer, whose team ran OpenAI's cyber-permissive models on a mock power plant range. His summary: "The skill floor is dropping for the reconnaissance and vulnerability research needed before an attack." Lee says a frontier model, working on its own on that range, found two zero-days in engineering software that manages protective relay data. That quote is why we're writing this piece.
Behind the "Fable beat GPT-6 Cyber" headline
Read this section before you repeat any benchmark number from this story: the labs did not run the same tasks. Anthropic's own results table carries a footnote: "each lab’s scores are based on unique tasks." The Hacker News reports that Fable 5.2 completed 76.3% of Irregular's CyScenarioBench, against 61.7% for Fable 5.1 and 61% for GPT-6 Cyber. Anthropic's table puts the 76.3% under Mythos 5.2 and the 61.7% under Mythos 5.1, which fits Anthropic's own warning that Fable 5.2's safeguards "will block most cybersecurity-related tasks." So the headline names the wrong model, and fifteen points between two labs' scores on different task sets is not a ranking. We wouldn't pick a vendor on it. The number worth keeping is Anthropic's own before and after, and even that is a vendor reporting on itself.
The Hacker News also quotes a detail from Irregular's separate GPT-6 Cyber report that the headline skipped. The model solved all 22 atomic challenges, with average success of 97% in vulnerability research and exploitation and 98% in network attack simulation, but only 63% in evasion. Getting in is nearly solved on those tests, and staying unseen isn't. For defenders that is the best news in the benchmark pile, and the coverage we read gave it one line.
Anthropic calls Mythos 5.2 its "most capable model for cybersecurity engineering" and says an unnamed security company found that one in six confirmed bugs Mythos 5.2 surfaced were missed by every other frontier model it tested (Anthropic). Anthropic also reports 89.6% for Mythos 5.2 on its own CVE Rediscovery evaluation, a run against 1,829 CVEs, up from 78.3% for Mythos 5.1. Both are vendor-run measures, so call them claims until outside testers repeat them.
Who gets the keys, and what they give up
Neither company sells these models off the shelf. OpenAI says GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, with wider Daybreak Red access coming "soon." Daybreak Red API access requires IP allowlisting by default, and customers on zero data retention generally must use Private Safety Processing, which keeps encrypted records in their own storage for 30 days. OpenAI has also said that in its partner program the underlying model access "remains with the approved partner and is not transferred directly to the customer" (OpenAI).
Anthropic splits the same idea into three tiers in its Cyber Verification Program. Defense Access covers security operations, malware analysis and validating vulnerabilities, and Anthropic says smaller security firms, open-source maintainers and individual researchers with a track record can qualify, with answers in a few days. Red Team Access allows authorized penetration testing, is organizations only, and takes weeks. Specialized Access, for things like power grids and interbank transfer systems, gets an in-depth review with the US government. Anthropic tested the tiers with Claude Opus 5.5 on CyScenarioBench, five attempts at each of ten challenges: with no program access, every task was blocked on the first prompt; in Defense Access, 46 of 50 trials were blocked at some point; in Red Team Access nothing was blocked and 34 of 50 succeeded, matching the model's unblocked rate. That's Anthropic grading its own gates, again.
Fable and Mythos are the same underlying model (Anthropic). Claude Fable 5 carries strong cyber safeguards and is open to everyone. Mythos is the version organizations apply for. Anthropic's API pricing page lists the two at the same rate for Fable 5.2 and Mythos 5.2: $8 per million input tokens and $40 per million output tokens, or $16 and $80 in the optional fast mode. Mythos isn't priced separately. Price is the smallest barrier here. The larger one is data retention. Anthropic requires it for organizations in the Cyber Verification Program so it can watch for misuse; OpenAI keeps standard retention by default and sends zero-data-retention customers through Private Safety Processing. We think that's a fair price of admission for a red team, and a real cost for a firm whose clients' code can't sit in someone else's logs. Anthropic says a new option called Enterprise Frontier Safeguards will let eligible organizations keep the data in their own cloud, but the program post only promised it for "later this fall." Until it ships, that trade stands.
One outside check on all this is a bounty. OpenAI's Hacktron partnership puts a firm that builds AI agents for code review and penetration testing on its own systems, with expanded access to its frontier models. Hacktron's CEO, Zayne Zhang, said the future of cybersecurity "won’t be defined by who has the largest security team, but by who can best combine human creativity with AI-driven capabilities" (OpenAI). OpenAI also raised bounty payouts, with critical findings in ChatGPT, Codex or the API now worth up to $30,000, and up to $172,000 with bonuses for exceptional ones (OpenAI). We trust a payout to outsiders more than any internal red-team claim.
The attackers in the reports aren't using these models
Acronis researchers describe a single attacker, based in Taiwan, who aimed AI agents at hundreds of organizations in at least 11 countries and got data or access at about ten of them. The agents pulled emergency dispatch records for seven Taipei districts. What stands out is what they ran on: commercial models mostly refused to help him attack, so the attacking agents ran almost entirely on "abliterated" versions of DeepSeek, GLM and Qwen, models run locally with their safety training removed (The Hacker News). Coding agents including Claude Code, Codex and Cursor turned up too. The report says the attacker redirected Claude Code and Codex to an abliterated model, though they mostly did infrastructure work, and that Cursor attacked a Taiwanese emergency-services site while running such a model.
The agents were also bad at the job in ways a person would notice. One scanning tool invented CVEs, and more than half of its high and critical findings were false positives or wrongly classified. The main attack agent reported results that hadn't happened. The break-in that worked at one fire-dispatch vendor used default root credentials, not a clever exploit. Where logins were enforced and endpoints were properly filtered, the researchers say, the agents failed.
Arctic Wolf reported a second pattern. AntiFox is an open-source agentic penetration testing platform on GitHub, and Arctic Wolf says Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and their AWS environments. In at least some cases the activity reached a successful request for a production secret. Its verdict: "Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks" (The Hacker News). The same story adds that Check Point Research identified 2,557 systems hosting ARTEX, another agentic attack tool, and counts about 45 open-source frameworks of this kind. Check Point's own summary of what agentic hacking changes: scale and speed.
Neither report involved GPT-6 Cyber or Mythos, as far as the coverage says. Our read is that the gates look sound at the top and do little at the bottom, where free agent frameworks and stripped open-weight models are enough to hit a server with a default password. The evidence is also thin. It's a handful of reports, most from security vendors with a stake in the story, and nobody can yet say what share of intrusions involve AI at all.
Defense's cleanest result came from math
Wired's headline says DeepMind "Proved the Signal Protocol Is Secure." The DeepMind post is narrower, and we prefer it. Researchers guided agents to prove key security properties of the actual code behind Signal's protocol, including that messages stay protected before and after a device is briefly compromised. Humans reviewed every formal specification. The agents produced more than six million lines of Lean, flagged the one percent of the codebase that needed a person's second look, and finished in four weeks, a job DeepMind says historically takes expert teams years (Google DeepMind). To check the system could tell good code from bad, the team reintroduced two real, already-fixed bugs and got machine-checked proofs that the buggy version was insecure.
Signal's CTO, Ehren Kret, said the result gives "even greater confidence in our code’s privacy guarantees." We'd call this the most trustworthy claim in the pile, for a plain reason: a benchmark score depends on believing the vendor, and a Lean proof is checked by a machine. It covers specified properties of one codebase, not Signal the product, and DeepMind says scaling it needs more research. DeepMind has open-sourced its verification artifacts, which is how a claim like this earns trust.
Critical infrastructure points the same direction. Anthropic's Cyber Mission describes the program for it: frontier models, on-site engineers and threat research for the providers that secure power grids, water systems and factories, whose equipment often can't be taken offline to patch. Dragos, Rockwell Automation and Nozomi Networks are among the founding partners.
The bottleneck is the fix
Anthropic put the problem in one sentence: "It’s easier than ever to find vulnerabilities, but verifying, prioritizing, and fixing these findings remains challenging" (Anthropic). OpenAI wrote nearly the same thing in an earlier post: "A vulnerability report does not protect an organization." Two competitors agreeing on that in their own announcements is the closest thing to consensus in this pile. We've covered the other side before, in our pieces on AI finding bugs faster than anyone can fix them and on what AI vulnerability scanners find and miss.
So who wins? Our view, which no source states in these words: attackers gain most against organizations that patch slowly, because an attacker needs one working path and can live with a scanner that's wrong half the time. Defenders gain most where they already fix quickly, because finding bugs is now cheap and the leftover cost is process. The model gates limit what the most capable systems can be used for; they don't change that arithmetic for anyone running old software. Anthropic's own forecast points the same way for now. It expects AI to favor defense in two years, but says that in the near term "that may not be true," because the cost of exploiting vulnerabilities has dropped while fixing them is slow and still depends on people. A second round of independent tests on how well attacks evade detection is what would change our mind.
What to do now, in order
If you run a small business, you won't get GPT-6 Cyber and you don't need it. The attacks in the reports mostly walked through unlocked doors. We'd spend the first hour on these, in this order:
- Turn on multi-factor sign-in for email, admin panels and every cloud console.
- Switch on automatic updates for anything reachable from the internet, and patch the rest within days, not quarters.
- Find and change default or shared passwords on routers, databases and admin tools. One of the Taiwan break-ins needed nothing more.
- Pull keys out of code and page scripts into a secrets manager, then put spend limits and a rotation date on every AI and cloud API key.
- Write down what a stranger can reach from the internet. You can't patch a server you've forgotten.
If you ship software, a scanner that sits in your pull-request flow is the sensible next step. Semgrep, Snyk Code and Aikido are in our directory; our Top 200 AI Cybersecurity Tools board and the security analyst board show where the rest rank. Treat every AI finding as a lead to confirm, since the Acronis attacker's own scanner invented CVEs. Open-source agents such as PentestGPT and Shannon are for systems you own and have written permission to test; the AntiFox reports show what the same class of tool does in the wrong hands. For general-purpose help reviewing code, Claude and ChatGPT both do it, though Anthropic says its open models carry conservative cyber safeguards that block most cyber work.
If you are a security professional, apply for OpenAI's Daybreak Blue or Anthropic's Defense Access now. Anthropic aims to answer Defense Access applications within days and Red Team Access within weeks, and it requires data retention. OpenAI hasn't published a turnaround for Daybreak. The checklist below turns the first list into a score.
Two things to watch. OpenAI says GPT-6 Cyber will reach all Daybreak Red customers soon, and neither lab has published how many applicants it has approved or turned down. When Anthropic's own-cloud option ships, check whether eligible organizations really get the same safeguards without the logs.
