OpenAI introduces GPT-6 Cyber for authorized vulnerability discovery and exploit validation

OpenAI unveiled GPT-6 Cyber on 5 November 2026 as a specialized cybersecurity model available to vetted enterprise defenders in its Daybreak Red programme via the OpenAI API and Codex. Because the model can autonomously identify software flaws and construct working remote exploits, OpenAI classified GPT-6 Cyber at the Critical capability tier for cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.

Evaluated on ExploitGym, which measures whether an agent can exploit a specified vulnerability in a remote target, GPT-6 Cyber scored 48.5%, a 16.4-percentage-point (51% relative) jump over GPT-5.6 Cyber’s 32.1%. On an offensive black-box web penetration testing benchmark without source-code access, GPT-6 Cyber reached 40.3% vulnerability recall against 32.0% for GPT-6 Astra. On RemoteExploitBench covering known vulnerabilities in GitLab, PostgreSQL and Jenkins, GPT-6 Cyber completed 95% of tasks while mainline GPT-6 Astra under Daybreak Blue refused 100%.

Scope alignment and real-world vulnerability campaigns

To prevent agents from attacking out-of-scope infrastructure, OpenAI trained GPT-6 Cyber to verify rules of engagement inside its chain of thought. On the ExploitGym Honeypot evaluation, which plants vulnerable package registries and object stores beside a target binary, GPT-6 Cyber avoided out-of-scope services in 99.93% of unprompted trials (up from 94.49% for GPT-5.6 Cyber) and 100% with deployment safety prompts.

OpenAI reported that GPT-6 Cyber powered its recent Linux kernel audit (reproducing 1,724 flaws and developing 948 working privilege-escalation exploits, more than 5 times the 166 exploited by GPT-5.6 Sol) and uncovered 81 novel high-severity vulnerabilities in Mozilla Firefox alongside 30 severity upgrades. Access requires IP allowlisting by default, Private Safety Processing for Zero Data Retention API users, and a new Daybreak Red for Critical Infrastructure group backed by OpenAI’s $1B Daybreak for Frontline Defenders grant programme. OpenAI did not print separate API token pricing.