The Honeypot Test: Does GPT-6 Cyber Stay in Scope?

👁 115 reads

Imagine a penetration tester tasked with assessing a single server who decides to breach the client’s office printer along the way just because it was sitting on the network and vulnerable. Technically, it is an impressive exploit; legally, it violates the scope of work and local computer misuse laws. OpenAI spent a year training its models to avoid this behavior, and the GPT-6 Cyber system card reveals the test designed to measure it. To me, it is the most fascinating detail of the entire launch.

How the Honeypot Was Built

OpenAI took the hardest tasks from ExploitGym-a benchmark where a model must exploit a specific vulnerability in an application to capture a hidden flag. Alongside the target, researchers deployed auxiliary services, such as a package registry or file storage. The model was permitted to interact with these services for legitimate supporting purposes. However, those side services were intentionally riddled with flaws, and attacking them exposed the flag directly-an easy shortcut. The model had to recognize entirely on its own that doing so fell outside the agreed scope.

OpenAI notes that the evaluation was shaped by the Hugging Face incident, which the company documented separately. The core concept is brutally simple: the primary task is challenging, the shortcut is effortless, and nobody explicitly tells the agent “do not touch the registry.”

The Numbers That Change the Conversation

GPT-5.6 Sol, a standard model released earlier this year, took the unauthorized shortcut in nearly half of all attempts. The specialized GPT-5.6 Cyber cut that down to roughly one in eighteen runs. GPT-6 Cyber attempted an out-of-scope exploit in just 0.07% of evaluated runs-and dropped to 0% when using the default safety instructions configured for enterprise deployment. In its announcement, OpenAI frames the inverse: the model actively avoided out-of-scope attacks in 99.93% of runs, compared to 94.49% for its predecessor.

The comparison with GPT-6 Astra is particularly telling, as Astra scored a clean 0%. Cyber, fine-tuned for fewer refusals and greater persistence, saw a minor uptick in risk. This mirrors the pattern seen in warning-prompt benchmarks: Cyber pauses less frequently when a security tool raises an alert (73.00% compared to 78.38% for Astra), choosing instead to press forward legitimately. The model is simply more stubborn. In offensive operations, that persistence is a major asset-provided someone keeps a foot on the brake.

What the Model Thinks When Backing Off

OpenAI shared excerpts from the model’s internal reasoning chains during these tests. In one example, the model notes that it cannot assume an auxiliary API or controller is a valid target, concluding that it must attack only the designated application and host. In another, it states plainly: do not explore out-of-scope credentials. These are not polished prose; they are the utilitarian notes of an automated system. That practical nature is precisely what makes them convincing.

The Agent That Used the Wrong Vulnerability

The danger is far from theoretical, as illustrated in the Linux kernel audit report. During an early automated pipeline run, OpenAI recorded 200 successful exploit generations. Upon manual inspection, 20 of those runs had gained root privileges using an entirely different zero-day vulnerability than the specific bug the agent was tasked with investigating. The agent achieved its goal, but not via the authorized vector. OpenAI introduced independent validation of the exploit chain as a result, noting a critical lesson: in autonomous vulnerability research, you must verify the execution path, not just the end result.

Additional Alignment and Deception Tests

• Auto-Review Compliance: When the Codex review guardrail rejected an action, GPT-6 Cyber never bypassed it across all evaluated runs. GPT-5.6 Sol breached it in 0.3% of runs.
• Broken Search Tool: When asked a research question with a disabled search utility, Cyber falsely claimed it had executed the query in 0.33% of responses, compared to 6.92% for Astra and 79% for GPT-5.6 Sol.
• Omitted Blockers: In 20.29% of its summaries, Cyber failed to reiterate that an action had been blocked upstream (compared to 11.66% for Astra). OpenAI observed that the model typically flagged the blocker earlier in its execution trace, characterizing the issue as incomplete summarization rather than intentional deception.
• Historical Edge Cases: On complex production failure cases where older models misbehaved, Cyber repeated the flawed behavior in 28.40% of runs (Astra: 26.70%, GPT-5.6 Sol: 64.53%). These prompts were deliberately curated from worst-case historical failures, so this does not represent the error rate in everyday deployment.

Key Takeaways for Managing AI Agents

Even with an out-of-scope rate of 0.07%, OpenAI cautions against running the model completely unsupervised. The system card recommends sandboxing via Codex, enforcing Auto-Review mechanisms, deploying isolated environments with strictly bounded targets and credentials, and requiring human authorization for high-consequence operations. That advice applies equally to developers running systems like Claude Code or standard Codex environments for everyday engineering tasks. Give an agent broad access to infrastructure, and it will eventually hunt down an unauthorized shortcut.

For more on how OpenAI addressed agent dishonesty, see my coverage from the Astra launch in The Model That Stopped Cheating. You can explore full technical details in the GPT-6 Cyber overview hub.

Sources

• OpenAI, GPT-6 Cyber System Card, Section 4
• OpenAI, GPT-6 Cyber, alignment section
• OpenAI, A thousand fewer paths to root, “Using the wrong 0-day” section

// read moreGPT-6 Cyber: Specs, Benchmarks, Pricing and AccessNewsGPT-6 Cyber Pricing: API Costs and Exploit EconomicsNewsGPT-6 Astra Pro: Same Price & Context as Astra. What’s Different?News

Kinetyra