OpenAI has introduced GPT-6 Cyber, a model it describes as built for cybersecurity work. Its main job is identifying vulnerabilities in software that could be exploited, and helping developers write fixes for them. OpenAI says the model is trained to stay within authorised scope, a design choice meant to keep it working inside the boundaries of a given security engagement rather than probing systems at will. The announcement positions the model as a specialised tool for security teams, not a general-purpose assistant. The launch extends OpenAI further into security tooling, an area where AI models are used both to defend systems and to attack them. Finding and patching vulnerabilities is slow, skilled work, so automating parts of it is an obvious use case. The scope constraint is the central claim. Its practical value depends on how the controls are enforced and verified, and the announcement description does not detail that. For Australian businesses and professionals, little changes immediately, since the tool is aimed at security teams rather than general staff. Organisations with in-house security teams or managed security providers may want to evaluate it once pricing and access terms are clear. Under the Privacy Act 1988, any security testing of systems holding personal information should be formally authorised and documented, and a breach that is likely to cause serious harm falls under the Notifiable Data Breaches scheme. Sending personal information to an overseas AI service may also raise cross-border disclosure obligations under Australian Privacy Principle 8. Treat the tool as dual-use: the same capability lowers the cost of attacks, so the practical step now is to keep patching disciplined.