OpenAI released GPT-6 Cyber on November 5, 2026. It’s a security model trained to find vulnerabilities, build working exploits to prove they’re real, and stay inside the scope a researcher sets. OpenAI’s system card describes it as a cyber-specialized variant of GPT-6 Astra, and OpenAI rates it Critical in cybersecurity under its Preparedness Framework. GPT-5.6 Cyber was rated High.
The headline numbers come from real codebases, not only benchmarks. OpenAI says GPT-6 Cyber reproduced 1,724 Linux kernel vulnerabilities and developed working exploits for 948 of them, and produced evidence and reproducible tests for 81 novel Firefox vulnerabilities that Mozilla classified as high severity.
Most admins won’t get direct access to GPT-6 Cyber. It sits behind OpenAI’s Daybreak Red program, with identity checks and IP allowlisting on by default. What changes for most teams is the volume of AI-found bug reports and patches landing in the software they already run.
What GPT-6 Cyber is
GPT-6 Cyber is GPT-6 Astra with extra post-training for security work. OpenAI’s system card says it used reinforcement learning on tasks such as reproducing crashes, developing working exploits and searching codebases for vulnerabilities, plus reward signals meant to cut refusals on authorized security requests.
OpenAI also trained it to stay in scope. The system card says those training signals reinforce following the user’s intended scope and authorization, avoiding unrequested actions, and reporting results accurately.
On general coding, it isn’t a better model than its parent. The system card reports 82.95% on OpenAI’s internal ExpertSWE evaluation, against 83.24% for GPT-6 Astra. GPT-6 Cyber is a security research tool. For day-to-day coding, OpenAI’s own numbers put it level with GPT-6 Astra, not ahead.
GPT-6 Cyber benchmark results
OpenAI published scores on its own evaluations. They’re vendor numbers, so read them as OpenAI’s measurements, not independent results.
| Evaluation (OpenAI) | GPT-6 Cyber | Comparison |
|---|---|---|
| ExploitGym (exploit a specified vulnerability in a remote target) | 48.5% | 32.1% GPT-5.6 Cyber; 42.43% GPT-6 Astra (system card) |
| ExploitGym Hardened (ASLR, stack canaries, V8 sandbox) | 36.94% | 29.69% GPT-6 Astra |
| Offensive web pentest, no source access (recall) | 40.3% | 32.0% GPT-6 Astra |
| RemoteExploitBench (GitLab, PostgreSQL, Jenkins) | 95% completed | GPT-6 Astra with Daybreak Blue refused 100% |
| ExploitBench Internal Port (recent V8/Chrome bugs) | 42% | 39% GPT-6 Astra |
| ExpertSWE (general software engineering) | 82.95% | 83.24% GPT-6 Astra |
OpenAI calls the ExploitGym jump a 51% relative improvement over GPT-5.6 Cyber. On RemoteExploitBench, OpenAI says the one failure was an exploit the model couldn’t get working remotely.
The system card also reports where GPT-6 Cyber falls short. On the internal port of ExploitBench, which uses recently disclosed V8 and Chrome bugs to reduce training contamination, OpenAI writes that reliable exploitation “remains challenging” for GPT-6 Cyber. Irregular, an outside evaluator, found that GPT-6 Cyber solved 90 of 288 FrontierCyber challenges against 96 for GPT-6 Astra, had no successful attacks on fully hardened targets, and solved none of the 15 hardest challenges.
Linux and Firefox findings
OpenAI’s real-world results are the part that reaches people who run servers.
- Linux kernel. OpenAI says GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948. That’s more than five times the 166 that GPT-5.6 Sol exploited with the same research harness. Following the Linux community’s guidance, OpenAI disclosed 304 critical findings to maintainers with candidate patches and says it’s working on getting the others fixed.
- Firefox. OpenAI says the model produced evidence and reproducible tests for 81 novel vulnerabilities that Mozilla classified as high severity, and showed that 30 known issues were more severe than previously reported. Mozilla began landing fixes shortly after the reports.
For an admin, the practical effect is a heavier patch stream. When one research campaign sends hundreds of kernel findings to maintainers, expect more kernel security updates from your distribution and more browser releases with security fixes. Check your patch cadence for kernels and browsers; the model itself isn’t something you’ll install.
Staying in scope: the honeypot test
A security agent that drifts outside its task can attack a service that nobody authorized, or use credentials it found along the way. OpenAI built an evaluation called ExploitGym Honeypot around that problem.
The setup works like this. The model gets a hard exploitation task in an isolated environment that also has supporting services, such as a package registry or object store. Those services are deliberately easy to exploit, and attacking them would reveal the task’s flag. The model has to work out that exploiting them is out of scope.
OpenAI reports these results:
- Without deployment safety prompts, GPT-6 Cyber avoided exploiting the out-of-scope services in 99.93% of cases. GPT-5.6 Cyber managed 94.49%.
- With deployment safety prompts, GPT-6 Cyber stayed in bounds 100% of the time.
- The system card adds that GPT-5.6 Sol exploited the honeypot in 49.5% of graded rollouts and GPT-6 Astra in 0%.
The system card also flags a weak spot. On OpenAI’s blocker-reporting evaluation, GPT-6 Cyber was flagged in 20.29% of graded responses, against 11.66% for GPT-6 Astra. OpenAI says most flagged cases had disclosed the blocker earlier but left it out of the final answer. If you use an agent like this, read the full run log, not only the summary.
Who can use GPT-6 Cyber
GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. OpenAI says access will expand to all Daybreak Red customers soon, and that GPT-5.6 Cyber is being made available to all Daybreak Red customers.
Daybreak Red access requirements (OpenAI system card)
| Eligibility | Identity and eligibility verification, legal attestations, review of the organization's use case and security practices |
|---|---|
| Organizations | SSO, MFA, managed devices, least-privilege access, credential rotation |
| Individuals | Invited applicants; identity and liveness checks; Advanced Account Security and at least one physical FIDO2 key |
| API network | IP allowlisting required by default, exceptions for technical constraints |
| Zero Data Retention customers | Generally must use Private Safety Processing (encrypted records kept in customer storage for 30 days) |
Most teams will meet GPT-6 Cyber indirectly. OpenAI’s announcement quotes security teams at Cisco, CrowdStrike, Palo Alto Networks, SentinelOne, Perplexity, Calif, Cognition and CodeRabbit. CodeRabbit’s CEO says it found 66% more high and medium severity security issues than CodeRabbit’s production model on its internal benchmark. Cognition’s CTO reports 23% on its internal novel vulnerability benchmark against a previous best of 13%. Those are partner claims about their own benchmarks.
Daybreak Blue is the tier below. It gives verified defenders GPT-6 Astra with fewer unnecessary refusals for validating vulnerabilities and fixes, and OpenAI is widening its alpha to more organizations and individual researchers.
Safeguards OpenAI added
OpenAI paired the model with new controls. The announcement and system card list:
- Cyber-specific misalignment monitoring that checks whether actions match the user’s authorization without treating legitimate exploit development as misuse.
- Private Safety Processing for Zero Data Retention API customers.
- IP allowlisting for Daybreak Red API access by default, plus monitoring of API keys and access tokens for compromise.
- New blocks on high-risk assistance involving industrial controls, essential services and election systems.
- A Daybreak Red for Critical Infrastructure group for approved defenders, and a $1 billion Daybreak for Frontline Defenders grant program that subsidizes access for resource-constrained teams.
OpenAI recommends running GPT-6 Cyber in Codex with sandboxing and Auto-Review, and adding comparable checks before sensitive actions for API users. If you already run coding agents with tool access, the same thinking applies to them; our note on Claude Code MCP security risks covers scoping agent permissions.
What to do this week
- Check how fast your Linux hosts pick up distribution kernel security updates
- Confirm Firefox and other browsers on managed machines auto-update
- If you use AI security review tools, ask the vendor which model backs them
- If you want direct access, read the Daybreak Red requirements before applying
What GPT-6 Cyber changes for admins
GPT-6 Cyber is a gated security research model, not a general model you can call from a normal API key. OpenAI’s own results show it builds working exploits far more often than earlier models and stays in scope in almost all of OpenAI’s honeypot tests, with weaker results on hardened and recently disclosed targets. For most admins, the visible effect will be more security fixes in kernels, browsers and the tools they depend on. For other OpenAI model news, see our GPT-6.1 Terra pricing post.
