OpenAI Releases GPT-6 Cyber as CISA Warns on Cold Chain OT and Apple

Federal cybersecurity agencies and frontier artificial intelligence laboratories issued a coordinated wave of defensive tooling and critical-infrastructure advisories on Thursday, spanning automated vulnerability discovery, active Apple exploit remediation, industrial cold-chain protection, and post-quantum cryptography readiness.

OpenAI Deploys Critical-Tier GPT-6 Cyber to Daybreak Red Program

OpenAI launched GPT-6 Cyber for vetted security defenders enrolled in its trusted-access Daybreak Red program, marking the company's first model to cross into the "Critical" cybersecurity capability threshold on OpenAI's Preparedness Framework. Led by head of cyber preparedness Fouad Matin, the release restricts access to authorized vulnerability researchers, critical-infrastructure operators, and open-source maintainers conducting defensive audits and binary remediation.

On the ExploitGym offensive and defensive evaluation suite, GPT-6 Cyber achieved a 48.5% score, outperforming both GPT-5.6 Cyber (32.1%) and the flagship general-purpose GPT-6 Astra model (42.4%). In pre-release testing with Mozilla security engineers, GPT-6 Cyber identified 81 vulnerabilities across the Mozilla Firefox codebase. OpenAI also reported that scope-enforcement training reduced the model's out-of-bounds action rate on the ExploitGym HoneyPot benchmark to under 1%, down from roughly 5% on GPT-5.6 Cyber, ensuring autonomous scanning agents stay strictly within authorized network boundaries.

CISA Adds Apple CVE-2024-27834 to Known Exploited Vulnerabilities Catalog

In federal vulnerability enforcement, the Cybersecurity and Infrastructure Security Agency (CISA) added Apple improper authentication flaw CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) Catalog following confirmed evidence of active exploitation. Federal Civilian Executive Branch agencies are required to apply vendor patches or discontinue use of affected systems by CISA's remediation deadline under Binding Operational Directive (BOD) 26-04, and CISA urged private-sector enterprises to prioritize the update across managed endpoints.

Joint Federal Guidance Targets Industrial Cold-Chain OT and Post-Quantum Vendors

Addressing physical supply-chain resilience, CISA joined the FBI, the Department of Health and Human Services (HHS), the U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT) to release joint operational technology (OT) guidance for industrial refrigeration and cold-chain monitoring systems. The advisory warns that internet-exposed programmable logic controllers and temperature monitors protecting food, agricultural, and pharmaceutical inventories face authentication-bypass exploits and sabotage commands that force continuous heating or defrost cycles. The agencies recommended network segmentation, multi-factor authentication, and continuous telemetry aligned with Cross-Sector Cybersecurity Performance Goals (CPGs), BOD 26-04, and BOD 26-02.

Simultaneously, CISA partnered with the National Security Agency (NSA) and the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) to publish "Post-Quantum Questions to Ask Your Vendors". The joint guide provides chief information security officers and procurement teams with structured questions to audit software and hardware suppliers' cryptographic inventories and transition timelines for Post-Quantum Cryptography (PQC) before cryptographically relevant quantum computers (CRQCs) can break classical public-key encryption.