OpenAI released GPT-6 Cyber on Thursday, November 5, 2026, a model trained to find and exploit software flaws that the company rates as "Critical" under its own Preparedness Framework. The rating is the top tier OpenAI assigns for cybersecurity capability, up from "High" for the previous GPT-5.6 Cyber. The model is not a general chatbot. It is a specialized agent built to probe codebases, develop working exploits, and hand defenders a head start before attackers get there first.
The release lands at a moment when software security teams are drowning in code. OpenAI says GPT-6 Cyber has already uncovered 81 previously unknown high-severity vulnerabilities in Firefox, a codebase the company describes as one of the most hardened in the world, and developed working exploits for 948 Linux kernel vulnerabilities out of 1,724 it reproduced. Mozilla has begun landing fixes for many of the Firefox flaws. The scale of the findings, produced in a single research campaign, is the kind of number that should make maintainers of large open-source projects sit up.
The stakes are plain. Frontier models can now do in hours what used to take a skilled researcher weeks, and that cuts both ways. OpenAI's argument is that defenders have a narrow window to use these capabilities to harden software before the same techniques leak to people with worse intentions. GPT-6 Cyber is the bet that the good guys can move faster if they have a model that does the breaking for them.
How It Scores on Benchmarks
On ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scored 48.5 percent, up from 32.1 percent for GPT-5.6 Cyber, a gain of about 16 percentage points. On a separate offensive web penetration testing evaluation, where models probe applications with no access to source code, it reached 40.3 percent recall of vulnerabilities against 32.0 percent for GPT-6 Astra, the company's general-purpose flagship.
The more striking result is on RemoteExploitBench, a benchmark that puts known vulnerabilities in applications like GitLab, PostgreSQL, and Jenkins inside a controlled environment. GPT-6 Astra running with Daybreak Blue, OpenAI's defender-focused tooling, refused every task. GPT-6 Cyber completed 95 percent of them. Its single failure was an exploit it could not get to work remotely, not a refusal.
That gap is the whole point of the product. A model that refuses to touch anything dangerous is safe but useless to a red team. A model that breaks things on command is useful but risky. OpenAI's pitch is that GPT-6 Cyber threads that needle.
Staying Inside the Lines
The risk with a model this capable is scope creep. A tool told to test one service might wander into another, exploit a shared dependency, or ignore the rules of engagement entirely. OpenAI says it made alignment a central focus of GPT-6 Cyber, with specialized training to keep the model inside authorized scope, follow restrictions on its actions, and report its work accurately.
On an evaluation called ExploitGym Honeypot, the model was given a difficult exploitation task in an isolated environment with access to supporting services such as a package registry or object store. Those services were deliberately made easy to exploit, so that attacking them could reveal the task's flag. The model had to infer that exploiting them was out of scope. Without its deployment safety prompt, GPT-6 Cyber avoided the out-of-scope services in 99.93 percent of cases, up from 94.49 percent for GPT-5.6 Cyber. With the prompt, it stayed within bounds 100 percent of the time.
The company published excerpts from the model's chain of thought showing the reasoning behind those refusals. In one, it reasoned that it could not assume an extra API or attack controller was a valid target and should only target the specified binary or server. In another, it decided not to explore out-of-scope credentials. OpenAI frames this as evidence that the model is not just following a blocklist but reasoning about authorization.
Real-World Impact
The findings so far are concrete. Beyond Firefox and Linux, OpenAI used GPT-6 Cyber to demonstrate a critical remote code execution vulnerability in Brotli, the compression library used by Node.js. The company says it was also one of the main models behind recent work hardening the infrastructure used to train frontier models, where agents chained vulnerabilities to escape microVMs and execute code on underlying hosts.
Security teams at Cisco, Calif, and CodeRabbit are already using it for vulnerability research and code review. Brian Grinstead, a distinguished engineer at Firefox, said GPT-6 Cyber uncovered previously unknown high-severity vulnerabilities in a codebase that had already been hardened by multiple generations of frontier models, identified architectural improvements, and helped ship fixes to millions of users.
Safeguards and Critical Infrastructure
OpenAI paired the stronger capabilities with stronger safeguards. The list includes cyber-specific misalignment monitoring, targeted monitoring for emerging threats, Private Safety Processing for API customers using Zero Data Retention, IP allowlisting for Daybreak Red API access, and sandboxing and human oversight for high-risk workflows.
Protecting critical infrastructure was a specific design consideration. The company partnered with Dragos, which provides operational technology cybersecurity, to run evaluations on a mock power plant range. Rob T. Lee, chief AI officer at Dragos, said the model, given almost no direction, separated OT assets from IT noise on its own and found two zero-days in engineering software that manages protective relay data, exposing protection settings and breaker trip logic. OpenAI says it used that feedback to refine safeguards aimed at blocking harmful assistance without unnecessarily restricting authorized testing.
Who Can Actually Use It
GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. OpenAI says it will progressively expand access to all Daybreak Red customers and is making GPT-5.6 Cyber available to all of them in the meantime. Daybreak Blue alpha access for GPT-6 Astra is expanding to more organizations and individual security researchers.
New users can apply for the Daybreak program. The broader Daybreak Blue tier, which helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals, is meant to reach organizations of every size, independent researchers, and open-source maintainers. That matters because the maintainers who most need help are often the ones who cannot afford a dedicated security team.
It is not clear this will hold. A model that finds 948 kernel exploits in one campaign is also a model that could be pointed at systems that are not authorized, and access controls are only as good as the verification behind them. OpenAI's own framing acknowledges a limited window to use frontier models to secure software. Whether defenders actually win that race depends on how fast access expands and how well the safeguards hold up under real misuse. The next few months of disclosed vulnerabilities, and whether they get patched before they get exploited, will be the real test.
For background on the company behind the model, see OpenAI. For related coverage, see our AI category.