OpenAI Launches GPT-6 Cyber: What the New Security Model Can Do

OpenAI launched GPT-6 Cyber on November 5, 2026, a specialized version of GPT-6 Astra built specifically for offensive-security research. The model is rated "Critical" for cybersecurity under OpenAI's Preparedness Framework, the company's highest risk tier, and is available only through the API and Codex to a small group of vetted customers in OpenAI's Daybreak Red program. OpenAI says the model roughly matches or exceeds many professional penetration testers on vulnerability-discovery and exploit-development tasks, which is why it has restricted who can use it rather than shipping it broadly.

What is GPT-6 Cyber?

GPT-6 Cyber is a fine-tuned, specialized variant of GPT-6 Astra that OpenAI trained to perform better at finding vulnerabilities, writing exploit code, and chaining bugs together into working attack paths. It is the direct successor to GPT-5.6 Cyber, which OpenAI released earlier in 2026 as part of its broader Daybreak cybersecurity initiative. Unlike a general-purpose chat model, GPT-6 Cyber is not meant for consumers at all — OpenAI is positioning it as a tool for authorized security researchers, red teams, and large organizations' internal offensive-security units.

The model sits alongside, but separately from, the consumer- and enterprise-facing side of the GPT-6 family. Readers who want the broader picture of how OpenAI has staged that rollout can see our earlier coverage of the GPT-6 release and its free-tier access rules and of what GPT-6 Astra does and who can access it.

Release date and who can actually use it

OpenAI announced GPT-6 Cyber on November 5, 2026. Rather than a general release, access is gated behind Daybreak Red, OpenAI's restricted tier for customers conducting authorized vulnerability research, exploit validation, and penetration testing. To join Daybreak Red, organizations must go through identity verification, account-security requirements, usage monitoring, and legal declarations about how the model will be used. OpenAI has also said hardware security keys are mandatory for Daybreak accounts.

At launch, GPT-6 Cyber is reachable only through the API and through Codex, OpenAI's coding agent — there is no ChatGPT front-end access. OpenAI says it plans to widen access to the rest of its Daybreak Red customer base "in the coming weeks," and is simultaneously making the older GPT-5.6 Cyber available more broadly within that same group. No firm date has been confirmed for access beyond current Daybreak Red members, and OpenAI has not said when, or whether, a defensive-only or more broadly licensed version might follow.

Why OpenAI rated it "Critical"

OpenAI's Preparedness Framework is the company's internal system for scoring how much risk a model's capabilities pose in categories like cybersecurity, biological and chemical weapons, and model autonomy, and for triggering specific safeguards once a model crosses a threshold. GPT-5.6 Cyber was rated "High" for cybersecurity — serious, but below the framework's top tier. GPT-6 Cyber is rated "Critical," OpenAI's highest designation, which is why it has shipped with the tightest access controls of any Daybreak model to date rather than a standard API rollout.

In practice, a Critical cybersecurity rating means OpenAI's own evaluations found the model capable enough at offensive tasks — finding and weaponizing software vulnerabilities — that broad, unrestricted access was judged too risky without additional safeguards such as Daybreak Red's vetting, monitoring, and hardware-key requirements.

The benchmark numbers: ExploitGym scores

OpenAI's own evaluations center on ExploitGym, an internal benchmark that tests whether a model can exploit a specified vulnerability in a remote target. According to OpenAI's launch materials and system-card figures reported by multiple outlets, GPT-6 Cyber scored roughly 48.5% on ExploitGym, compared with about 32.1% for GPT-5.6 Cyber and about 42.4% for GPT-6 Astra running with Daybreak Blue access (the defender-focused tier, not the model's default public configuration).

These figures are OpenAI's own self-reported evaluation results. As of this writing, no independent lab — such as a third-party red-teaming group or academic benchmark auditor — has published a replication of the ExploitGym scores, so the numbers should be treated as vendor-reported rather than independently confirmed. It's also worth noting that OpenAI has reportedly removed the roughly six-hour time limit it previously imposed on ExploitGym runs for these newer models, which means the comparison to older scores may not be perfectly like-for-like.

ExploitGym itself is an OpenAI-built evaluation, not a third-party or community standard like some other security benchmarks. It is designed to measure whether a model, given a known vulnerability in a target system, can actually produce a working exploit against that target rather than just describing the bug in the abstract — a distinction OpenAI and outside security researchers generally treat as a meaningfully harder and more operationally relevant test than simple vulnerability description or classification. A model that merely explains a flaw is far less dangerous, and far less useful to a defender doing validation work, than one that can demonstrate exploitability end to end. That is the specific capability jump OpenAI says justifies both the Critical rating and the restricted rollout.

OpenAI's scope-adherence claims

Beyond raw capability, OpenAI also publicized figures on what it calls scope adherence — whether the model stays within the specific target and task it's authorized to test, rather than wandering into exploiting other, unauthorized systems it encounters during a security engagement. On an internal "Honeypot" variant of ExploitGym designed to test this, OpenAI reported that GPT-6 Cyber stayed within its authorized scope in 99.93% of runs without a deployment safety prompt, rising to 100% with that prompt active. OpenAI reported GPT-5.6 Cyber's equivalent figure at roughly 94.49% without the safety prompt — meaning it strayed out of scope in a little over 5% of cases, versus roughly 0.07% for GPT-6 Cyber.

This is, again, a vendor-reported, self-administered test, not an independently audited result, and OpenAI has not published details of what happened in the small remaining share of out-of-scope runs. Treat it as OpenAI's own characterization of the model's behavior under its own test conditions rather than a verified safety guarantee.

What is Daybreak Red?

Daybreak Red is one half of OpenAI's two-tier Daybreak cybersecurity access program, which the company has been expanding since mid-2026. Daybreak Blue is aimed at defenders — security teams validating vulnerabilities and fixes with fewer unnecessary refusals from the model. Daybreak Red, by contrast, is meant for customers doing authorized offensive work: penetration testers, exploit developers, and vulnerability researchers operating under legal authorization from the systems' owners.

Because Daybreak Red grants access to a model OpenAI itself rates as carrying Critical cybersecurity risk, the program layers on identity verification, mandatory hardware security keys, usage monitoring, and contractual restrictions on how the model can be used. OpenAI has previously said it recommends isolated sandbox environments and tools like Codex's automated code-review mode when working with Daybreak Red models, and that API access defaults to requests coming only from pre-approved networks.

OpenAI has also folded a separate initiative, which it calls Patch the Planet, into the broader Daybreak push — a program developed with the security firm Trail of Bits and HackerOne that focuses on using AI-assisted research to work down the backlog of unpatched vulnerabilities in widely used open-source software. OpenAI has additionally pledged roughly $1 billion toward what it calls a Daybreak fund for frontline defenders, aimed at getting advanced defensive tooling to security teams that might not otherwise be able to afford or access it. GPT-6 Cyber's launch sits inside that larger push rather than standing alone: OpenAI's pitch is that gating the most capable offensive model behind Daybreak Red, while simultaneously funding and tooling defenders through Daybreak Blue and Patch the Planet, keeps the overall balance tilted toward defense even as the underlying capability becomes more powerful.

The predecessor's track record so far

OpenAI has pointed to concrete results from GPT-5.6 Cyber as evidence the Daybreak Red approach can find real bugs. The company has said the model identified two previously unknown vulnerabilities in the V8 JavaScript engine that could be chained to bypass V8's heap sandbox; Google fixed the underlying issue, which was later tracked as CVE-2026-15903 in the National Vulnerability Database. OpenAI has also said GPT-5.6 Cyber surfaced several vulnerabilities in a popular mobile operating system. GPT-6 Cyber doesn't yet have a comparable public track record, since it has only been available to a handful of approved customers since November 5.

How GPT-6 Cyber fits into the wider GPT-6 lineup

GPT-6 Cyber is a derivative of GPT-6 Astra rather than a standalone frontier model, which is consistent with how OpenAI has built its cybersecurity-specific models in the past: GPT-5.6 Cyber was likewise fine-tuned from a general-purpose Sol-generation model. For readers tracking the broader GPT-6 rollout — pricing, context windows, and how Astra compares with the Sol tier that preceded it — our explainer on GPT-6.1 Sol versus Astra pricing and access covers how the consumer and developer-facing side of the family has evolved, which is a useful contrast to the locked-down way Cyber is being released.

What hasn't been independently verified

It's worth being precise about what is and isn't confirmed here. The ExploitGym scores, the Critical risk classification's underlying evidence, and the 99.93%-versus-94.49% scope-adherence figures all come from OpenAI's own system-card disclosures and launch materials. OpenAI's Preparedness Framework process does include an internal Safety Advisory Group that reviews evaluation results before a model ships, but that is still an OpenAI-run process rather than an external audit. No outside academic lab, government body, or dedicated third-party red-teaming organization appears to have published its own replication of the GPT-6 Cyber benchmark results as of this writing.

That gap matters because the headline numbers — a roughly 16-percentage-point jump on ExploitGym, and a scope-adherence failure rate cut from about 5.5% to about 0.07% — are exactly the kind of figures a vendor has an incentive to present favorably. None of this means the numbers are wrong; OpenAI has a track record of publishing fairly detailed system cards and has pointed to concrete outcomes, like the V8 vulnerability its predecessor model surfaced, as real-world corroboration. But until an independent party verifies the specific GPT-6 Cyber figures, they should be read as OpenAI's characterization of its own model rather than as an externally audited result.

Why a Critical-rated cyber model matters

The jump from "High" to "Critical" is significant mainly because of what triggers it: OpenAI's framework reserves the top tier for capabilities the company judges could meaningfully change the offense/defense balance in a given domain if misused at scale. A model that can reliably find and chain exploits faster than most human researchers — even one gated behind vetting and monitoring — raises the stakes around how access controls, credential security, and insider-threat protections are enforced, since the restriction is a policy and account-security barrier rather than a technical one preventing the model's outputs from being misused once accessed.

At the same time, OpenAI's stated rationale for releasing it at all is defensive: the company has framed Daybreak broadly as a way to help security teams and researchers find and fix vulnerabilities before attackers with access to equally capable AI tools do. Independent security researchers have not yet had the opportunity to publicly test or critique GPT-6 Cyber's real-world behavior, since access remains limited to approved Daybreak Red accounts.

What happens next

OpenAI has said it plans to widen GPT-6 Cyber access to its full Daybreak Red customer base over the coming weeks, alongside broader availability of GPT-5.6 Cyber within that same group — but the company has not committed to a specific date, nor said whether access will ever extend beyond vetted Daybreak Red accounts to the general API. Expect OpenAI to publish further system-card detail and possibly updated benchmark figures as that rollout proceeds, and watch for whether any independent research group publishes its own evaluation of the ExploitGym and scope-adherence claims. For now, GPT-6 Cyber remains a narrowly distributed, tightly monitored tool rather than something most developers or security teams can try directly.

Written byTheo Park

Theo Park runs the AI desk at Pandromeda. He follows model launches from the frontier labs and the open-weight community, tracks the assistants and developer tools built on them, and explains what each release changes on pricing, capability and safety. His reporting leans on primary sources: model cards, technical reports, API documentation and the companies' own announcements.

More from Theo ParkAll AI coverage