Dominic Williams links OpenAI’s GPT-6 Cyber launch to case for tamperproof backend systems

DFINITY founder Dominic Williams has used OpenAI’s launch of GPT-6 Cyber to renew his call for organisations to move backend software to tamperproof infrastructure, arguing that conventional software security can leave businesses exposed to attacks.

Responding to OpenAI’s announcement, Williams said a potential problem arises when customers can examine the security of open-source software developed or used by a company. That access, he argued, could allow them to identify weaknesses and potentially use them to attack the organisation.

His proposed solution is to move backend code to a network such as the Internet Computer (ICP), where software runs across a decentralised infrastructure rather than relying on conventional servers and databases.

The comments followed OpenAI’s November 5 announcement of GPT-6 Cyber, a model designed to identify and validate software vulnerabilities while following the boundaries set by security researchers.

OpenAI said the model had helped identify 81 previously unknown high-severity vulnerabilities in Firefox and develop working exploits for 948 Linux kernel vulnerabilities. It also reported a score of 48.5 per cent on its ExploitGym benchmark, compared with 32.1 per cent for its predecessor, GPT-5.6 Cyber.

The company said GPT-6 Cyber had been designed to improve its ability to stay within authorised testing boundaries. In one evaluation, it avoided exploiting services outside the assigned scope in 99.93 per cent of tests without deployment safety prompts, rising to 100 per cent when those prompts were included.

The model is initially available through OpenAI’s API and Codex to a select group of approved Daybreak Red customers. OpenAI plans to expand access to other Daybreak Red customers over time.

Williams’ response points to a broader question raised by increasingly capable AI security tools: as software vulnerabilities become easier to identify and exploit, how should organisations protect the systems that support their services?

The Internet Computer uses independently operated network nodes and replicated execution to protect application state and the integrity of authorised updates. Its architecture is intended to reduce dependence on conventional cloud infrastructure and centralised control over backend systems.

However, tamperproof execution does not automatically make an application free of security flaws. The Internet Computer’s own developer documentation states that vulnerabilities in application code and weaknesses in access controls remain the responsibility of developers.

The distinction matters as organisations assess whether decentralised infrastructure can address risks that increasingly capable AI tools may expose. Williams is advocating ICP as one approach to reducing the scope for backend tampering, while OpenAI’s announcement highlights the growing role of AI in both finding software weaknesses and helping security teams fix them.