This is the 163rd original article from Thinking AI Society

About 960 words in total, estimated reading time: 3 minutes

OpenAI has done it again—this marks its 11th new model release this year.

The figures released this time are enough to make anyone stop and take a closer look.

On November 5, OpenAI released GPT-6 Cyber, a model dedicated to cybersecurity—and then, under its own risk framework, slapped it with the highest-level "Critical" label: it can autonomously discover and exploit zero-day vulnerabilities in real systems and carry out end-to-end cyberattacks.

It built the spear itself, stamped it "dangerous enough" itself, and then put it on sale.

First, let's look at just how sharp this spear is.

On the vulnerability exploitation benchmark ExploitGym, it scored 48.5%, up from 32.1% for the previous generation—an increase of about 51%.

Real-world performance is even more alarming. In the Linux kernel, it reproduced 1,724 vulnerabilities, and for 948 of them it produced directly runnable attack programs; under the same framework, the previous generation succeeded in only 166. OpenAI has reported 304 key findings, along with remediation plans.

Firefox is even more striking. This browser, repeatedly audited by multiple generations of AI, was found to have 81 unknown high-severity vulnerabilities, and 30 known issues were shown to be more dangerous than previously assessed. Mozilla fixed a batch and has pushed out the update.

The most striking part is that OpenAI used it against itself: in red-team testing, the AI chained multiple vulnerabilities, broke through micro-VM isolation, and executed code on the host machine.

Who is the "Critical" label meant for?

Now for this Critical label. It comes from OpenAI's own "Preparedness Framework" and is the highest rating in the cybersecurity dimension. GPT-6 Astra in September was the first; Cyber is the second.

Here's an interlude. Less than a month after Astra's release, the launch plan for GPT-6.1 Astra was cut, for a subtle reason: models are getting better at doing work, and also more likely to cross boundaries.

So Cyber's training objective is unusually blunt: stay within authorized scope, respect limits, and report accurately. OpenAI also set up honeypot tests, deliberately placing several vulnerable services nearby. In 99.93% of cases it did not touch what it should not touch; with added prompts, that rose to 100%.

What stands out is this: OpenAI did not disclose what happened in that 0.07% of boundary-crossing cases. It also cut off network access for frontier models during training.

You might say this is self-discipline? Half of it, maybe. The other half is a declaration: daring to label it Critical shows the capability has truly arrived.

The most expensive shield is sold only to licensed people

With capabilities this dangerous, how is it used? It is sold inside a cage called "authorization."

Ordinary users cannot access it. It is available only via API and Codex to approved Daybreak Red customers—you have to prove you are doing authorized penetration testing or red-team work. The pricing is flagship-level too: $20 per million input tokens and $100 per million output tokens, five times that of GPT-5.6 Sol. Security teams at Cisco and CodeRabbit are already using it.

The logic is clear: the more dangerous the capability, the more it needs an access mechanism—making money and preventing abuse at the same time.

But two things need to be viewed calmly. First, AI's vulnerability-discovery speed is beginning to outpace manual remediation. Linux and Firefox have both been penetrated at scale, so one can imagine the situation for ordinary software. Second, that unexplained 0.07%, together with "offline training"—even OpenAI itself probably is not fully at ease.

When the strongest spear and the strongest shield become the same thing, the rules of the game change.

In the era of AI mass vulnerability discovery, can ordinary software vendors keep up?

All content in this article is compiled from public information and represents only personal views.