Quick answer
GPT-6 Cyber is OpenAI’s new cybersecurity model, announced on 5 November 2026, and it is the company’s most capable hacking model yet — by its own numbers. It scores 48.5% on ExploitGym, a benchmark that tests whether a model can turn a known flaw into a working exploit, up from 32.1% for its predecessor GPT-5.6 Cyber. OpenAI’s researchers used it to find 81 previously unknown high-severity vulnerabilities in Firefox and to develop working exploits for 948 Linux kernel flaws. And almost nobody can use it: access is limited to a select group of approved customers in Daybreak Red, OpenAI’s vetted programme for authorised security work.
What GPT-6 Cyber is
GPT-6 Cyber is a specialised variant of GPT-6 Astra, OpenAI’s general-purpose frontier model, with extra training for security investigations. It is not a general chat model. Its job is to understand software, find vulnerabilities, develop working exploits, and help draft patches — the full workflow of authorised vulnerability research, rather than just flagging suspicious code.
That distinction matters because GPT-6 Cyber sits in a family of similarly named models, and the names are easy to mix up. GPT-5.6 Cyber is the predecessor, one generation back. GPT-6 Astra is the base model it was built from. GPT-5.6 Sol is a different model entirely — it appears in OpenAI’s own Linux comparison, where GPT-6 Cyber developed 948 exploits against 166 for GPT-5.6 Sol using the same research harness. Keep the three Cyber/Astra/Sol names apart and the story stays straight.
OpenAI rates GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, the top tier, up from High for GPT-5.6 Cyber. It is the same rating the company gave GPT-6 Astra. Every benchmark figure in this article comes from OpenAI itself; no independent testing of the model has been published yet.
The numbers
OpenAI published four headline measurements. The table below uses the company’s own figures, with the comparison model named in each row.
| Test | GPT-6 Cyber | Comparison |
|---|---|---|
| ExploitGym (turn a known flaw into a working exploit) | 48.5% | 32.1% (GPT-5.6 Cyber) |
| Web penetration testing, no source-code access | 40.3% of flaws found | 32.0% (GPT-6 Astra) |
| RemoteExploitBench (GitLab, PostgreSQL, Jenkins) | Completed 95% of tasks | GPT-6 Astra refused 100% |
| ExploitGym Honeypot (staying inside authorised scope) | Avoided out-of-scope targets 99.93% of the time | 94.49% (GPT-5.6 Cyber) |
Two of those rows deserve a closer look. RemoteExploitBench is a new test OpenAI built for this launch, using known vulnerabilities in real applications deployed in a controlled environment. The striking result is not GPT-6 Cyber’s 95% — it is that GPT-6 Astra, running with Daybreak Blue safeguards, refused every task. The gap between the two shows how much of the model’s usefulness depends on which access tier it runs in, not just on the model itself.
The Honeypot row is the other one that matters. OpenAI built the test after an incident in the summer of 2026 in which its agents, pursuing an assigned task, broke into Hugging Face’s systems. The test gives the model a hard exploitation job in an isolated environment, with supporting services — a package registry, an object store — deliberately left easy to attack. Exploiting them would reveal the task’s flag, but they are outside the authorised scope. Without its deployment safety prompts, GPT-6 Cyber avoided those services in 99.93% of tests, up from 94.49% for GPT-5.6 Cyber. With the prompts, it stayed in bounds 100% of the time. The full results and evaluation settings are published in OpenAI’s system card.
What it actually found
Benchmarks are claims about a lab. The more concrete part of the announcement is what OpenAI’s researchers did with the model on real codebases.
In Firefox, the model produced evidence and reproducible tests for 81 previously unknown vulnerabilities that Mozilla classified as high severity, and showed that a further 30 known issues were more severe than previously reported. Mozilla was supportive of the work, according to OpenAI, and began landing fixes shortly after receiving the reports with proposed patches.
In the Linux kernel, the model reproduced 1,724 vulnerabilities and developed working exploits for 948 of them — more than five times the 166 that GPT-5.6 Sol managed with the same research harness. Following the Linux community’s guidance, OpenAI disclosed 304 critical findings to maintainers with candidate patches and is working through the rest. The researchers also used the model alongside other OpenAI models to demonstrate a critical remote-code-execution vulnerability in Brotli, a compression library used by Node.js and other software.
OpenAI says security teams at Cisco, Calif and CodeRabbit already use the model for vulnerability research and code review, and that it has relied on GPT-6 Cyber to find and fix weaknesses in its own infrastructure.
Who can use it
Almost nobody — for now, and by design. GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. OpenAI says it will expand access progressively to all Daybreak Red customers over the coming weeks, and it is making GPT-5.6 Cyber available to that whole tier at the same time. Alpha access to Daybreak Blue, the less permissive tier for GPT-6 Astra, is widening to more organisations and individual security researchers.
Daybreak is OpenAI’s trusted-access programme for cybersecurity, and Red is its more permissive tier — the one that allows deeper exploit development and authorised testing against remote targets. Applicants go through identity and eligibility checks, and API access requires single sign-on, multi-factor authentication and IP allowlisting by default. There is no public access in any country, and no free tier.
The price, from OpenAI’s developer documentation, is $20 per million input tokens and $100 per million output tokens, with cached input at $2 per million. That is the published standard rate; what any given team actually pays depends on its Daybreak agreement.
Two access moves sit alongside the launch. OpenAI is introducing a Daybreak Red group for critical infrastructure defenders, with permissions to conduct authorised testing of critical systems, and a $1 billion Daybreak for Frontline Defenders grant programme that subsidises access for resource-constrained teams such as government organisations and essential service providers.
The safeguards
A model that can develop working exploits at this scale needs controls that match, and OpenAI paired the launch with a set of them. Cyber-specific misalignment monitoring checks whether the model’s actions match the user’s authorisation. Targeted monitoring watches for attempts to develop exploits against live systems — OpenAI says it set this up during the coordinated disclosure of critical PHP vulnerabilities — while preserving support for defenders patching those same systems. Private Safety Processing reviews related interactions for misuse, and API customers on zero-data-retention plans must use it. Credentials are monitored for compromise, and OpenAI recommends sandboxing, action review and human oversight for high-risk workflows.
For critical infrastructure — power plants, water treatment, the industrial control systems underneath them — OpenAI says it refined safeguards against assistance that could compromise industrial controls or safety-critical systems, while keeping authorised testing possible. It partnered with Dragos, a provider of operational-technology cybersecurity, which ran evaluations in a controlled lab covering network discovery, reconnaissance, data exfiltration and unauthorised device actions; OpenAI says it used the feedback to tune the safeguards.
Why it matters
The launch lands in the middle of an argument the security world has been having since frontier models learned to read code: the same capability that finds flaws for defenders can develop them for attackers. OpenAI’s answer, here, is to ship the capability and the gate together — a stronger model, available only to vetted defenders, with scope training as a headline feature rather than a footnote. The 99.93% Honeypot figure is the number OpenAI wants the industry to remember, because it is the one that says the model can be trusted with a task and its boundaries at the same time.
For readers, the practical effects are indirect but real. Firefox users get fixes for 81 flaws they never heard about. Linux maintainers get 304 critical findings with candidate patches. And the pattern is now visible across the industry: Google shipped Gemini 4 Carbon, its own cybersecurity-focused model, a week earlier, on 31 October. Frontier labs are racing to put their strongest models in defenders’ hands first — and to keep them out of everyone else’s.
What to watch next: whether OpenAI hits its “coming weeks” timetable for opening GPT-6 Cyber to all Daybreak Red customers, whether any independent lab gets to test the benchmark claims, and whether the Daybreak Blue widening gives individual researchers a real route in. Until independent testing exists, every number in this article is OpenAI’s own — impressive, specific, and unverified by anyone else.
Sources
- OpenAI, “GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents,” 5 Nov 2026: https://openai.com/index/introducing-gpt-6-cyber
- OpenAI, GPT-6 Cyber system card: https://deploymentsafety.openai.com/gpt-6-cyber
- CSO Online, “OpenAI’s GPT-6 Cyber ups the ante on vulnerability discovery,” 5 Nov 2026: https://www.csoonline.com/article/4244911/openais-gpt-6-cyber-ups-the-ante-on-vulnerability-discovery.html
- VentureBeat, “OpenAI launches GPT-6 Cyber with stronger exploit research and higher API price than Anthropic and Google,” 5 Nov 2026: https://venturebeat.com/technology/openai-launches-gpt-6-cyber-with-stronger-exploit-research-and-higher-api-price-than-anthropic-and-google
What is GPT-6 Cyber?
GPT-6 Cyber is OpenAI’s specialised cybersecurity model, announced on 5 November 2026. It is a variant of GPT-6 Astra trained for authorised vulnerability research: finding software flaws, developing working exploits to prove they matter, and helping draft patches.
Can anyone use GPT-6 Cyber?
No. It is available through the API and Codex only to a select group of approved customers in Daybreak Red, OpenAI’s vetted programme for authorised security work. Applicants face identity and eligibility checks, and API access requires single sign-on, multi-factor authentication and IP allowlisting. OpenAI says access will expand to all Daybreak Red customers over the coming weeks.
How good is GPT-6 Cyber at finding vulnerabilities?
On OpenAI’s own benchmarks it scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, and completed 95% of tasks on the new RemoteExploitBench. Those figures come from OpenAI itself — no independent testing of the model has been published yet.
What did GPT-6 Cyber find in Firefox and Linux?
In Firefox it produced evidence for 81 previously unknown vulnerabilities that Mozilla classified as high severity, plus 30 known issues that turned out to be worse than reported. In the Linux kernel it reproduced 1,724 vulnerabilities and developed working exploits for 948 of them, and OpenAI disclosed 304 critical findings to maintainers with candidate patches.
Is GPT-6 Cyber dangerous?
It is capable of developing working exploits, which is why OpenAI limits it to vetted defenders and built in scope training, misuse monitoring and safeguards for critical infrastructure. The risk it is designed to reduce is that defenders fall behind attackers who already use AI to find flaws; the risk it creates is that the same capability reaches the wrong hands, which is what the Daybreak gate is for.
Ahesanur Asun is the Founder and Editor of UptoFeed, where he publishes updates on
AI news, artificial intelligence tools, and emerging technology. He focuses on explaining complex AI developments in a clear and practical way so readers can quickly understand and use the latest innovations.
