On Thursday 5 November 2026, OpenAI announced GPT-6 Cyber, a model built to search code for vulnerabilities, develop working exploits to prove them, and propose patches.
It is not publicly available. Access runs through the API and Codex to a select group of approved customers in Daybreak Red, OpenAI's tier for authorised penetration testing, exploit development and red-team work. The company plans to widen it to all Daybreak Red customers.
The reason for the restriction is the rating. OpenAI classified GPT-6 Cyber as Critical for cybersecurity under its Preparedness Framework, the highest tier it has, up from High for GPT-5.6 Cyber. By its own assessment, this is the most dangerous cyber model the company has built.
OpenAI's framing pairs the two halves: the model is "far more reliable staying within the boundaries researchers set." Capability went up, and so, it says, did restraint.
The numbers
Benchmark | GPT-6 Cyber | Comparison |
|---|---|---|
ExploitGym, exploit development | 48.5% | GPT-5.6 Cyber 32.1%, GPT-6 Astra 42.4% |
Black-box web pentest, recall | 40.3% | GPT-6 Astra 32.0% |
SEC-Bench Pro | 87.0% | 85.4% |
RemoteExploitBench | 95% of tasks | Astra with Daybreak Blue refused all |
FrontierCyber | 90 of 288 | 96 of 288 |
Scope adherence, no safety prompt | 99.93% | GPT-5.6 Cyber 94.49% |
Two of those rows deserve more attention than the headline 48.5%.
FrontierCyber went the wrong way. 90 out of 288, against 96 for the comparison model. On the hardest real-world discovery and exploitation benchmark in the set, the specialised cyber model did worse than the general-purpose one. That is in OpenAI's own published figures and it has gone almost entirely unmentioned in coverage.
Scope adherence is the claim the whole release rests on. In a controlled test, OpenAI gave the model an authorised target plus deliberately vulnerable services that were out of scope. Without a safety prompt, GPT-6 Cyber stayed in bounds 99.93% of the time, against 94.49% for its predecessor. With the prompt, 100%.
That is a roughly 79-fold reduction in boundary violations. It is also, still, 0.07% rather than zero, and the general-purpose GPT-6 Astra scored 0% on the same test. The specialised model is better behaved than the last specialised model, and marginally worse behaved than the generalist.
What it found
The capability claims are backed by work on real code, not just benchmarks.
Firefox. 81 previously unknown high-severity vulnerabilities, with Mozilla having already shipped many of the patches.
The Linux kernel. A mid-October campaign described in a report titled A thousand fewer paths to root. The pipeline selected 5,034 audit targets, around 7% of the kernel, produced 2,308 candidate findings, reproduced 1,724, and built 948 working local privilege escalation exploits. The comparable earlier run with GPT-5.6 Sol produced 166.
OpenAI disclosed 304 critical findings with patches, and says the agents used at least 10 exploitation techniques that were new to its researchers and to outside experts who reviewed a sample.
Brotli. The model found CVE-2026-111497, rated CVSS 9.2. That is the flaw CISA added to its Known Exploited Vulnerabilities catalogue on 27 October, and the one we covered as being embedded in 91% of cloud environments.
The cost. The Linux campaign consumed $1,213,430 in API credits, roughly $1,279 per working exploit. That figure is the most useful number in the whole release, and I will come back to it.
One caveat, stated well by one analysis: "The distinction between a candidate finding and a validated vulnerability is material." 2,308 candidates became 1,724 reproductions became 948 exploits. Human review and controlled environments sat at every stage, and OpenAI has not disclosed evidence that the model independently compromised an internet-facing production system.
The alignment claim, examined
The scope-adherence number is doing enormous work in this release. It is the reason OpenAI feels able to ship a model it rates Critical.
Three things are worth holding onto.
It is a benchmark, not a deployment. The honeypot test is a controlled environment with a known in-scope target and known out-of-scope decoys. Real engagements are messier, scope is often ambiguous, and nobody has yet reported how the model behaves when an authorisation boundary is genuinely unclear rather than deliberately marked.
The gain is real and the residual is not zero. 0.07% of trials is small. Across the volume of runs a large penetration testing firm would generate, it is not nothing, and the consequence of a single out-of-scope exploitation against a client's systems is legal rather than statistical.
Alignment and access control are different controls, and only one is being tested here. The model's restraint is measured. The vetting of who gets into Daybreak Red is not published. If the access tier is the real safeguard, as the Critical rating implies, then the thing protecting everyone is a customer approval process nobody outside OpenAI can evaluate.
That is the same structural position Anthropic's Cyber Verification Program is in, and the same question applies to both: when the published evidence shows the model will do the work, the control that matters is who is let in.
Why this is the story
Strip away the benchmarks and one fact remains. A company assessed its own model as posing critical cyber risk, and released it.
That is not hypocrisy. The argument is coherent: defenders are outnumbered, vulnerability research does not scale with human effort, and 81 Firefox flaws plus 948 Linux exploits plus the Brotli bug are a concrete contribution to everyone's security. Cisco is already using it. Mozilla has shipped patches because of it.
The $1,279 per exploit figure is what makes it real. Working privilege escalation exploits used to require a skilled researcher and weeks. They now cost about the price of a laptop, per exploit, at volume. Defenders get that economics. So does anyone else who obtains comparable capability, whether through a vetted tier, an open-weight model with its guardrails stripped, or a stolen API key.
The question this release poses is not whether GPT-6 Cyber is dangerous. OpenAI has answered that, in writing, with its own highest rating. The question is whether a vetting process is a sufficient control for a capability that cheap, and nobody has published enough for anyone outside the company to judge.
For defenders in the meantime, the practical implication is unchanged and uncomfortable: the interval between a flaw existing and a working exploit existing is now priced, and it is falling. OpenSSH reached the same conclusion from the other direction last week when it abandoned long disclosure embargoes.
