OpenAI Launches a Model Built to Find Zero-Days as CISA Warns of Gunra Ransomware Targeting VPNs
A look at the last 24 hours in cybersecurity: OpenAI opens gated access to an AI model trained for exploit development, and a six-agency advisory details how Gunra ransomware bypasses MFA through compromised VPN gateways.
OpenAI on August 10 introduced GPT-5.6-Cyber, a version of its GPT-5.6 Sol model trained specifically to find zero-day vulnerabilities and build exploit chains, aimed at cutting down the refusals that have frustrated security researchers trying to use general-purpose models for legitimate offensive work. The model is only available through Daybreak Red, a vetted, identity-verified tier of OpenAI's cybersecurity access program launched alongside a lower-restriction Daybreak Blue tier intended for defensive work such as vulnerability discovery, code review, and incident response.
On OpenAI's own internal benchmark tracking willingness to help with exploit-chain development, authentication bypass, and privilege escalation, GPT-5.6-Cyber completed 95% of requests, compared with 1.5% for the safeguarded general-purpose model and 2% through Daybreak Blue. OpenAI said its researchers used the model against Chrome's V8 JavaScript engine and found two previously unknown vulnerabilities that could be chained together to escape the sandbox, since patched by Google and tracked as CVE-2026-15903. The company also said the model identified vulnerabilities in a mobile operating system and a database, along with more than 400 privilege-escalation issues elsewhere. Starting September 1, OpenAI is requiring hardware security keys on all individual Daybreak accounts as one of several new safeguards accompanying the release.
For SOC and MDR teams, the practical read has less to do with this specific model than with the trend it represents: as AI-assisted vulnerability discovery gets faster and more capable on both the offensive and defensive sides, the gap between disclosure and real-world exploitation is likely to keep shrinking. Patch timelines that used to be adequate may not stay that way for long.
Separately, the FBI, CISA, the Department of Defense Cyber Crime Center, the NSA, the U.S. Secret Service, and South Korea's National Police Agency jointly published a #StopRansomware advisory on Gunra, a double-extortion group derived from leaked Conti source code that has grown into a structured ransomware-as-a-service operation since early this year. According to the advisory, Gunra affiliates get initial access primarily by exploiting known flaws in internet-facing VPN gateways and firewalls, including FortiOS and FortiProxy authentication-bypass vulnerabilities tracked as CVE-2024-55591 and CVE-2025-24472. In one documented case, the actors used a compromised SSL-VPN administrative account to reconfigure a victim's VDI portal authentication flow to accept an attacker-controlled one-time code, sidestepping MFA entirely rather than trying to defeat it directly. From there, affiliates have used Impacket tooling to move laterally over SMB, dump credentials from domain controllers, and pivot toward identity infrastructure.
The advisory's central point is one worth repeating: MFA alone isn't sufficient protection for edge infrastructure without file-integrity monitoring, conditional access controls, and alerting on configuration changes to VPN and identity systems. Gunra's playbook didn't defeat multi-factor authentication through brute force or a novel bypass technique — it simply reconfigured what the authentication system was willing to accept, which is exactly the kind of change that goes unnoticed without monitoring built specifically to catch it.