OpenAI has launched GPT-6 Cyber, a specialised artificial intelligence model built to find software vulnerabilities, develop working exploits for testing, and help researchers fix flaws before attackers can use them. The company announced the model on 5 November, and gave it the highest cybersecurity rating in its own safety framework — "Critical" — a step up from the "High" rating assigned to its predecessor, GPT-5.6 Cyber.
Access is deliberately narrow. GPT-6 Cyber is available only to a select group of approved customers in Daybreak Red, OpenAI's programme for advanced authorised cybersecurity work, through the company's API and its Codex coding tool. The company says it will expand access to all Daybreak Red customers soon. The restricted rollout is the point: this is the most capable offensive-security model OpenAI has released, and it is being handed only to vetted defenders.
What GPT-6 Cyber can do
GPT-6 Cyber is a cyber-specialised variant of GPT-6 Astra, OpenAI's general frontier model, trained specifically for vulnerability research. According to OpenAI, it outperforms GPT-6 Astra on most cyber tasks, even when Astra does not refuse the request. The company published a series of benchmark results alongside the launch:
| Benchmark | GPT-6 Cyber | Comparison model |
|---|---|---|
| ExploitGym (exploiting a specified vulnerability in a remote target) | 48.5% | 32.1% for GPT-5.6 Cyber |
| Web penetration testing (recall of vulnerabilities, no source code access) | 40.3% | 32.0% for GPT-6 Astra |
| RemoteExploitBench (known flaws in GitLab, PostgreSQL, Jenkins) | Completed 95% of tasks | GPT-6 Astra with Daybreak Blue refused 100% |
| Staying within authorised scope (no deployment prompt) | 99.93% of tests | 94.49% for GPT-5.6 Cyber |
The ExploitGym result is a 51% relative improvement over GPT-5.6 Cyber, according to OpenAI. The RemoteExploitBench comparison is the more striking one: where the general-purpose model refused every offensive task outright, the cyber-specialised model completed nearly all of them. That gap is exactly why OpenAI built a separate model — and exactly why it is gating access.
What it found in real software
OpenAI says its researchers have already used GPT-6 Cyber against real, widely used code, with results that underline both its power and the stakes of who gets to use it.
- Linux kernel: in a controlled research campaign, the model reproduced 1,724 vulnerabilities and developed working exploits for 948 local privilege-escalation flaws — more than five times the 166 exploited by GPT-5.6 Sol using the same research harness. Moneycontrol reported that 588 of the 948 had not previously been identified. OpenAI said it disclosed 304 critical findings to Linux maintainers with candidate patches.
- Firefox: the model produced evidence for 81 previously unknown vulnerabilities that Mozilla classified as high severity, and showed that a further 30 known issues were more severe than previously reported. Mozilla has begun releasing fixes for many of them.
- Brotli: OpenAI researchers used GPT-6 Cyber alongside other models to develop and validate exploits for a critical vulnerability in the Brotli compression library, used by Node.js and other software, showing how the flaw could enable remote code execution in downstream applications.
Security teams at Cisco, Calif and CodeRabbit are already using the model for vulnerability research and code review, according to OpenAI, and the company says it has used it to harden its own infrastructure, including the systems used to train frontier models.
All of the benchmark figures and flaw counts in this article are OpenAI's own claims, published in its launch announcement and system card. No independent evaluator has yet verified them. That matters: the numbers describe what the model did in OpenAI's own tests, not what an outside lab has confirmed.
Staying inside the rules
The central risk with a model like this is scope: a cybersecurity agent that wanders outside its assigned target, probes unrelated services, or ignores a researcher's rules of engagement is a liability, not a tool. OpenAI says it made alignment a central focus of GPT-6 Cyber's training, teaching the model to stay within authorised scope, respect restrictions, and report its work accurately.
In a test designed around that risk — the ExploitGym Honeypot evaluation, informed by the Hugging Face incident — the model was given a difficult exploitation task in an isolated environment with deliberately easy-to-exploit supporting services. Attacking those services would have revealed the task's flag, but was outside the assignment. GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without its deployment safety prompt, and 100% of the time with it. GPT-5.6 Cyber managed 94.49% without the prompt.
"We're introducing GPT-6 Cyber, a major leap in security research: more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set." — OpenAI, launch announcement, 5 November 2026
Why access is restricted
GPT-6 Cyber is the first OpenAI model to reach the "Critical" tier for cybersecurity under the company's Preparedness Framework, its internal system for grading how dangerous a model's capabilities could be. The framework reserves "Critical" for capabilities that could identify and develop working exploits against hardened real-world systems — the kind of ability that is valuable to defenders and dangerous in the wrong hands.
OpenAI says it has paired the release with stronger safeguards:
- Cyber-specific misalignment monitoring — checking whether the model's actions match the user's authorisation.
- Targeted monitoring for emerging threats — for example, during the coordinated disclosure of critical PHP vulnerabilities, OpenAI set up monitoring for attempts to develop exploits against live PHP servers.
- Private Safety Processing — automated checks reviewing related interactions for misuse.
- Protection against stolen credentials — IP allowlisting for Daybreak Red API access by default, restricting requests to approved networks.
- Sandboxing and human oversight recommended for high-risk workflows, and new checks blocking high-risk assistance involving critical systems.
The company also says it has seen more attempts to misuse its models, including by malicious cyber actors and groups trying to distil them — attempts it says it is detecting and disrupting.
Defending critical infrastructure
Protecting power plants, water treatment facilities and the industrial control systems behind them was a key consideration in the release, OpenAI said. It announced a $1 billion Daybreak for Frontline Defenders grant programme to subsidise access for resource-constrained teams such as government organisations and essential service providers, and a new group within Daybreak Red for approved critical-infrastructure defenders, which allows authorised testing of critical systems while retaining safeguards against misuse.
OpenAI also partnered with Dragos, a provider of operational-technology cybersecurity, which ran evaluations in a controlled lab covering requests from network discovery through to unauthorised device actions. Feedback from Dragos was used to refine the safeguards, OpenAI said.
The dual-use question is unresolved. The same capability that lets a vetted team find and patch a flaw in Firefox or the Linux kernel would let an attacker find it first. OpenAI's answer is gating, monitoring and a phased rollout — but the model now exists, and the history of AI capability is that what is restricted today tends to become widely available tomorrow. The safeguards, not the announcement, are what will decide whether this release helps defenders more than attackers.
Frequently asked questions
What is GPT-6 Cyber?
A cyber-specialised variant of OpenAI's GPT-6 Astra model, trained to find software vulnerabilities, develop working exploits for authorised testing, and propose patches. It was announced on 5 November 2026.
Who can use it?
Initially, only a select group of approved Daybreak Red customers, through OpenAI's API and Codex. OpenAI says access will expand progressively to all Daybreak Red customers. It is not available to the general public.
What does the "Critical" rating mean?
It is the top cybersecurity tier in OpenAI's Preparedness Framework, up from "High" for GPT-5.6 Cyber. It reflects the model's assessed ability to find and develop working exploits against hardened real-world systems.
What has it actually found?
According to OpenAI, 81 previously unknown high-severity vulnerabilities in Firefox, and working exploits for 948 Linux kernel privilege-escalation flaws. Mozilla has begun releasing fixes for the Firefox issues, and 304 critical Linux findings were disclosed to maintainers with candidate patches.
Is the model safe to deploy?
OpenAI says it is safer than its predecessors at staying within authorised scope, citing 99.93% compliance in its honeypot test without a deployment prompt and 100% with one. The company still recommends sandboxing, action review and human oversight for high-risk work.
Key takeaways
- OpenAI launched GPT-6 Cyber on 5 November, its first model rated "Critical" for cybersecurity under its Preparedness Framework.
- It scored 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, and completed 95% of tasks on a new remote-exploitation benchmark where the general model refused them all.
- According to OpenAI, it found 81 previously unknown high-severity Firefox flaws and built working exploits for 948 Linux kernel vulnerabilities.
- Access is limited to vetted Daybreak Red customers, with IP allowlisting, misuse monitoring and a $1 billion grant programme for frontline defenders.
- All benchmark figures are OpenAI's own claims and have not yet been independently verified.
What to watch next: how quickly OpenAI expands Daybreak Red access, whether independent researchers can reproduce the benchmark results, and how quickly the 948 Linux findings and the remaining Firefox flaws are patched. The more consequential question is longer-term — whether a model this capable at finding flaws stays a defenders-only tool, or becomes the template for the next generation of offensive cyber capability.
