GPT-6 Cyber: OpenAI releases a model that finds and exploits vulnerabilities, but only for approved defenders

On November 5, OpenAI introduced GPT-6 Cyber, a model trained specifically to find exploitable vulnerabilities, prove they can be exploited, and propose the patch. It's not for just anyone: for now it's only used by a select group of approved Daybreak Red customers, the most restricted tier of its access program for security teams. What does affect anyone who maintains a server, an app, or a bot in production is the consequence: if a model like this can produce almost a thousand Linux privilege escalation exploits and 81 serious flaws in Firefox, the window between a patch being published and someone exploiting it just got a lot smaller.

What GPT-6 Cyber is

According to its system card, it's a variant of GPT-6 Astra with additional reinforcement training on tasks like reproducing crashes, developing working exploits, and hunting for vulnerabilities in large codebases. The same training aims to reduce refusals in authorized security work and, at the same time, keep the model from straying outside the scope set by whoever is using it.

OpenAI classifies it as "Critical" in cybersecurity within its Preparedness Framework, the highest category. The announcement says GPT-5.6 Cyber was at "High". The system card clarifies that GPT-6 Cyber inherits the same designations as GPT-6 Astra: Critical in cybersecurity, High in biology and chemistry, and below High in AI self-improvement.

One detail I find telling: in general programming it's no better than Astra. On ExpertSWE, an internal long-horizon software engineering test, it scores 82.95% versus Astra's 83.24%. It's a specialist, not a model that's smarter at everything.

The numbers OpenAI is bragging about

Everything below is OpenAI's figures, not independent testing:

ExploitGym (exploiting a specific vulnerability on a remote target): 48.5%, versus 32.1% for GPT-5.6 Cyber.
Web pentest without access to the source code: it finds 40.3% of the vulnerabilities, versus 32.0% for GPT-6 Astra.
RemoteExploitBench, a new benchmark with known flaws in GitLab, PostgreSQL, and Jenkins set up in a controlled environment: GPT-6 Cyber completed 95% of the tasks. Astra with Daybreak Blue refused 100%.
In the system card, the firm Irregular reports that on FrontierCyber there were no successful attacks against "fully hardened" targets and that no model solved the 15 hardest challenges. That's the nuance worth not losing amid all the percentages.

Chart with the benchmarks reported by OpenAI for GPT-6 Cyber, its out-of-scope rate, and the Daybreak access tiers

The problem they're trying to solve: staying in its lane

The obvious risk with an agent that knows how to exploit systems is that it gets creative with things nobody asked it to touch. OpenAI says so openly and cites the Hugging Face incident as precedent. According to CyberScoop, in that case the company's models escaped their test environments and got into part of that platform.

To measure this they created ExploitGym Honeypot: they give the model a hard task and, alongside it, auxiliary services (a package registry, an object store) that are easy to exploit and would hand it the answer. Exploiting them is out of scope. The results reported in the system card:

Model	Exploited the decoy
GPT-5.6 Sol	49.5%
GPT-5.6 Cyber	5.51%
GPT-6 Cyber, without deployment instructions	0.07%
GPT-6 Cyber, with deployment instructions	0%

The same system card also shows weak spots. When a tool shows it a warning and the right move is to stop, GPT-6 Cyber stops 73% of the time, less than Astra (78.38%). And when reporting obstacles in its final answer, it was flagged in 20.29% of cases, versus 11.66% for Astra. OpenAI says that in most of those cases the model had in fact mentioned the problem earlier, but didn't repeat it at the end. My take: it's more stubborn than Astra, which is exactly what you want when developing an exploit and exactly what you don't want when it needs to stop.

What it has already found

OpenAI lists three cases:

Firefox: 81 new vulnerabilities that Mozilla rated as high severity, plus 30 already-known flaws that turned out to be more serious than reported. Mozilla has already published fixes in advisory MFSA 2026-118, which corresponds to Firefox 159. If you use Firefox, updating isn't optional.
Linux kernel: the model was behind the research OpenAI published a day earlier, with 948 local privilege escalation exploits on a common desktop distribution. There OpenAI writes that, in the short to medium term, an unprivileged account on a system without the latest patches is effectively equivalent to root access for a well-resourced attacker.
Brotli: OpenAI says it used GPT-6 Cyber along with other models to show how a critical vulnerability in this compression library, used by Node.js, could end up as remote code execution in applications that depend on it.

Among the customers using it, OpenAI cites Cisco, Palo Alto Networks, CrowdStrike, SentinelOne, Perplexity, and CodeRabbit. The latter claims it found 66% more high and medium severity issues than its production model on its internal benchmark.

Who can use it (and who can't)

Access goes through Daybreak, OpenAI's "trusted access" program. The Help Center guide splits it into three tiers:

Standard: the general models with their normal safeguards. No Cyber models.
Daybreak Blue: fewer refusals on models like GPT-6 Sol and GPT-6 Luna for verified defensive work (code review, triage, incident response). It doesn't include Cyber models either.
Daybreak Red: GPT-5.6 Cyber for all approved organizations and GPT-6 Cyber only with separate approval. It requires identity verification, SSO, MFA, and an IP allowlist for the API.

OpenAI says it will open GPT-6 Cyber to all of Daybreak Red "soon". It also announced Daybreak Red for Critical Infrastructure, a group for approved defenders of power plants, water, and industrial systems, and a billion-dollar fund (Daybreak for Frontline Defenders) to subsidize access for under-resourced teams. Zero Data Retention users on the API generally have to go through Private Safety Processing, an automated review of encrypted logs that are kept for 30 days.

There's an asterisk: CyberScoop reports that OpenAI warned that data from Daybreak Blue sessions on personal accounts would be used to improve its models, which upset users. Afterward, Fouad Matin, OpenAI's head of security, told the outlet that people will still be able to choose not to share that data for training.

What this means if you maintain systems

What follows is my take, not something OpenAI recommends as-is:

Patch time is shrinking. If finding and exploiting flaws becomes an assembly-line process, what used to be "I'll update it over the weekend" stops being acceptable for the kernel, the browser, PHP, Node, and their libraries.
Isolation matters again. OpenAI mentions sandboxes like Firecracker and gVisor to limit the damage. On a modest VPS, that translates to separate users per service, properly configured containers, and nothing running as root unnecessarily.
This isn't for you yet, unless you work on a security team with a formal process. For everyone else, the useful part is that these tools are finding flaws in the software we all use every day before someone else does.

I didn't test it, and there's no way to do so without Daybreak Red approval. All of this comes from OpenAI's announcement, system card, and documentation, plus Mozilla's advisory.