OpenAI unveils cyber model with unprecedented hacking skills
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Sarah Grillo/Axios
OpenAI's researchers used the company's latest cyber model to take advantage of nearly 1000 security flaws in the popular Linux operating system — a piece of extensively vetted software that underpins much of the world's digital infrastructure.
Why it matters: AI is making it possible to uncover and test security weaknesses at a scale that could overwhelm companies' ability to fix them before hackers strike.
Driving the news: OpenAI released GPT-6 Cyber Thursday to a subset of verified users, saying the model has reached its highest rating, "critical," for cybersecurity capabilities.
- The company is also expanding its Daybreak program to give more organizations, independent researchers and open-source software maintainers access to its cyber models.
- OpenAI said it is creating a new access level for critical infrastructure operators to conduct authorized security testing on their systems.
Zoom in: OpenAI used the new model to build an automated system that could find security flaws in the Linux kernel, test whether they could be used to break into systems and propose fixes.
- During testing, the system identified 1,724 security flaws and found ways to use 948 of them to gain administrator-level access to Linux systems for about $1.2 million in API credits.
- At least 10 of the techniques the model used were previously unknown, according to OpenAI. Human researchers reviewed the Linux findings before reporting vulnerabilities and proposed fixes to maintainers.
- The model also uncovered 81 previously unknown, high-severity flaws in Mozilla's Firefox browser.
The big picture: The new findings and cyber model come amid growing fears about hackers using AI tools to target water systems, food storage and financial systems at unprecedented speeds.
- Security pros expect that open-source models will soon match frontier models' ability to find these bugs, giving defenders a short window to find and patch as many of these flaws as possible.
What to watch: Whether security teams can use these same AI capabilities to fix vulnerabilities faster than hackers can take advantage of them.
Go deeper: AI uncovers massive flaw in web's foundational code
