OpenAI released GPT-6 Cyber on November 5, 2026, to a limited group of approved security researchers and organizations. The cyber-specialized model carries a “Critical” cybersecurity capability rating under OpenAI’s Preparedness Framework. A newly published system card provides more detail about performance, safeguards and their limitations than was available in initial coverage.
What is GPT-6 Cyber, and who can access it?
GPT-6 Cyber is a specialized variant of GPT-6 Astra trained for authorized vulnerability discovery, exploit validation and penetration testing. According to OpenAI’s November 5 launch announcement, it is initially available through the API and Codex only to selected, approved Daybreak Red customers. OpenAI plans to expand access to other approved Daybreak Red customers, but the model is not a general public release.
OpenAI says Daybreak Red access requires identity verification and organizational controls, including single sign-on, multi-factor authentication and API IP allowlisting. The system card also describes restrictions on high-risk activity and monitoring intended to enforce authorized scope.
What does the “Critical” cybersecurity rating mean?
“Critical” is OpenAI’s own capability classification under its Preparedness Framework—not a government certification or proof that the model can compromise any particular production target. It signals OpenAI’s assessment that the model has exceptionally advanced offensive cybersecurity capabilities and requires heightened safeguards. GPT-5.6 Cyber had been rated “High.”
GPT-6 Cyber benchmarks: the numbers and their limits
OpenAI reports that GPT-6 Cyber scored 48.5% on ExploitGym, compared with 32.1% for GPT-5.6 Cyber. In an ExploitGym Honeypot evaluation designed to test whether the agent would attack a service outside its assigned scope, OpenAI observed an out-of-scope exploitation rate of 0.07% without deployment safety instructions and 0% with them.
These are company-published evaluation results in controlled test settings, not measured rates of real-world misuse. OpenAI also reports a 73% success rate when tool warnings warranted stopping and 20.29% incomplete final-answer blocker disclosure in a separate evaluation. Those figures show meaningful remaining limits to boundary-following and reporting.
In external evaluations summarized in the system card, security-testing firm Irregular found that GPT-6 Cyber solved 11 of 11 long-horizon challenges at least once, but did not breach fully hardened targets in the FrontierCyber evaluation. It solved 90 of 288 FrontierCyber challenges and none of the 15 highest-difficulty ones. Results from evaluation suites should not be generalized into a guarantee of performance against live systems.
Firefox and Linux vulnerability claims: what has been demonstrated?
OpenAI says its research helped uncover 81 previously unknown high-severity Firefox vulnerabilities. The launch announcement includes comments attributed to a Firefox engineer about fixes and architectural improvements. Independent verification of the final accepted and patched count remains incomplete.
For the Linux kernel, OpenAI says its pipeline reproduced 1,724 vulnerabilities and developed working exploits for 948. It says it disclosed 304 critical findings to maintainers with candidate patches. Importantly, 948 working exploits does not mean 948 newly discovered zero-days: the primary launch materials do not establish that all of those vulnerabilities were novel. Reuters separately attributes a figure of 588 previously unknown Linux vulnerabilities to OpenAI, but that count was not independently established in the inspected primary materials.
What safeguards does OpenAI describe?
OpenAI describes restricted enrollment, authorization-focused training, monitoring for out-of-scope actions, targeted defenses against emerging threats and special safeguards for critical infrastructure such as energy and water systems. The company also describes an access pathway for vetted critical-infrastructure defenders.
These controls may reduce risk, but the system card does not demonstrate that misuse is impossible. In particular, controlled evaluation results do not establish how every safeguard will perform against determined attackers in production.
Why this matters for defenders and software maintainers
AI systems that find and validate vulnerabilities faster could help maintainers prioritize patches, but they may also accelerate offensive research if comparable capabilities are misused. Security teams should focus on responsible disclosure, prompt patching, attack-surface management, strong access controls and verification of AI-generated exploit or remediation claims. Critical-infrastructure operators should not interpret benchmark performance as evidence that their own environments have been tested.
What remains unknown?
OpenAI has not provided a universal public-access date or general pricing for GPT-6 Cyber. The public materials do not establish the final number of confirmed and patched Linux and Firefox findings, independently audited real-world safeguard effectiveness or how the model would perform across all hardened production environments.
Primary sources and further reporting
- OpenAI: GPT-6 Cyber launch announcement (November 5, 2026)
- OpenAI: GPT-6 Cyber System Card (November 5, 2026)
- Reuters: Independent reporting on the launch
Editorial note: All model-performance figures and internal vulnerability-discovery counts are attributed to OpenAI or to evaluators as described in OpenAI’s published materials. They should not be mistaken for independently established production outcomes.
