GPT-6 Cyber Raises Exploit Capability While Keeping Access Restricted

OpenAI released GPT-6 Cyber on November 5 as a specialized model for finding, validating and helping repair exploitable software vulnerabilities. It is not a general public release. Organizations must first qualify for the company’s Daybreak Red program and then receive separate approval for this model.

The access restriction matters because OpenAI classifies GPT-6 Cyber as Critical for cybersecurity under its Preparedness Framework. That label describes the level of capability observed in controlled evaluations. It does not mean the model is known to act maliciously, and it does not by itself establish how well the same results would transfer to every production environment.

A larger jump on exploit benchmarks

On ExploitGym, which asks a model to exploit a specified vulnerability in a remote target, OpenAI reports that GPT-6 Cyber completed 48.5% of tasks. GPT-5.6 Cyber scored 32.1%, making the new result 16.4 percentage points higher, or about a 51% relative improvement.

A separate black-box web penetration test measured 40.3% vulnerability recall for GPT-6 Cyber, compared with 32.0% for the general-purpose GPT-6 Astra. On a controlled remote-exploitation benchmark involving known flaws in applications such as GitLab, PostgreSQL and Jenkins, the cyber model completed 95% of assigned tasks, according to the launch report.

Key Number: GPT-6 Cyber completed 48.5% of ExploitGym tasks, compared with 32.1% for GPT-5.6 Cyber.

Linux and Firefox supplied real-world tests

OpenAI says its researchers used the model to develop 948 privilege-escalation exploits in Linux. That figure should not be read as 948 unique vulnerabilities: the company describes the output as exploits, and has not published a public, independently audited list that would support a one-to-one bug count.

The company also says the model helped identify 81 previously unknown high-severity Firefox vulnerabilities and generate candidate patches. Mozilla’s Firefox 159 security advisory independently credits multiple high-impact flaws to OpenAI researchers, including use-after-free, boundary-condition and privilege-escalation issues. The advisory corroborates that OpenAI-assisted research reached shipped fixes, although it does not independently verify the complete count of 81.

Mozilla says early access to frontier models helped Firefox ship more than seven times as many security fixes as during the same period in 2025. The browser maker also warns that faster discovery creates a harder patch gap: attackers may reverse-engineer a fix after code becomes visible but before most users install the update.

Alignment is part of the release claim

OpenAI tested whether the model would attack easy but out-of-scope services placed beside an authorized target. GPT-6 Cyber avoided those services in 99.93% of trials without its deployment safety prompt and in 100% with the prompt. The underlying system card reports a 0.07% out-of-scope exploitation rate in the first condition and zero in the second.

Those results are encouraging but narrow. A structured honeypot evaluation cannot cover every ambiguous authorization boundary, compromised instruction or real operational mistake. Daybreak Red therefore adds identity verification, use restrictions, stronger access controls and approval requirements rather than treating benchmark alignment as sufficient.

Before we overstate the result

A different distribution choice

The release creates a sharp contrast with Mistral’s decision to publish Large 4’s weights. GPT-6 Cyber pairs higher reported offensive capability with revocable, organization-level access. That limits independent testing and broad availability, but it also preserves a control point if misuse or new failure modes appear.

For defenders, the practical bottleneck may soon shift from finding bugs to validating, prioritizing and deploying fixes. NewTqnia’s coverage of the actively exploited Brotli flaw showed how one library issue can spread work across runtimes and Linux distributions. A model that discovers vulnerabilities faster only helps if maintainers and users can close that deployment gap.