While the advancements in all AI models bring benefits for cyberdefense, they also bring dual-use risks, meaning they could be used for malicious purposes as well as defensive ones, the company said in a Wednesday (Dec. 10) blog post.
Demonstrating the advancements of AI models, the post said that in capture-the-flag challenges, the assessed capabilities of OpenAI’s models improved from 27% on GPT-5 in August to 76% on GPT-5.1-Codex-Max in November.
“We expect that upcoming AI models will continue on this trajectory; in preparation, we are planning and evaluating as though each new model could reach ‘High’ levels of cybersecurity capability, as measured by our Preparedness Framework,” OpenAI said in its post. “By this, we mean models that can either develop working zero-day remote exploits against well-defended systems, or meaningfully assist with complex, stealthy enterprise or industrial intrusion operations aimed at real-world effects.”
To help defenders while hindering misuse, OpenAI is strengthening its models for defensive cybersecurity tasks and creating tools that help defenders audit code, patch vulnerabilities and perform other workflows, according to the post.
The company is also training models to refuse harmful requests, maintaining system-wide monitoring to detect potentially malicious cyber activity, blocking unsafe activity, and working with red teaming organizations to evaluate and improve its safety measures, the post said.
Advertisement: Scroll to Continue
In addition, OpenAI is preparing to introduce a program in which it will provide users working on cyberdefense with access to enhanced capabilities in its models, testing an agentic security researcher called Aardvark, and establishing an advisory group called the Frontier Risk Council that will bring together security practitioners and OpenAI teams, per the post.
“Taken together, this is ongoing work, and we expect to keep evolving these programs as we learn what most effectively advances real-world security,” OpenAI said in the post.
PYMNTS reported in November that AI has become both a tool and a target when it comes to cybersecurity.
The PYMNTS Intelligence report “From Spark to Strategy: How Product Leaders Are Using GenAI to Gain a Competitive Edge” found that 77% of chief product officers using generative AI for cybersecurity said it still requires human oversight.
For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.
