OpenAI released GPT-6 Cyber on 5 November 2026, a version of its GPT-6 Astra model trained specifically for authorized cybersecurity work: finding exploitable vulnerabilities, validating them, and helping teams fix them — while staying inside the scope researchers set. It is initially available through the API and Codex only to a select group of approved customers in Daybreak Red, OpenAI's program for offensive-style security work such as penetration testing and red teaming, with access expanding over time.

The numbers OpenAI reports are striking. On ExploitGym, a benchmark testing whether a model can exploit a specified vulnerability, GPT-6 Cyber scores 48.5%, up from 32.1% for GPT-5.6 Cyber — a 51% relative improvement. In black-box web penetration testing it reached 40.3% vulnerability recall versus 32.0% for GPT-6 Astra, and it completed 95% of tasks on OpenAI's new RemoteExploitBench. OpenAI now classifies the model as Critical for cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.

The research behind the launch is the part that made headlines. OpenAI says its researchers used the model to reproduce 1,724 Linux kernel vulnerabilities and develop working local privilege-escalation exploits for 948 of them in a controlled environment, and to identify 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity. A companion research post published a day earlier, "A thousand fewer paths to root," describes the autonomous discovery-to-patch pipeline behind the Linux work.

The gating is the point. The same capability that finds real flaws could be abused, so OpenAI pairs the release with identity verification, API IP allowlisting, cyber-specific monitoring and human oversight — and a $1 billion Daybreak for Frontline Defenders grant program to subsidize access for resource-constrained defenders. Most readers cannot use GPT-6 Cyber today, and that is deliberate: OpenAI is selling aligned capability to vetted defenders first, and the test will be whether that gate holds while the capability keeps improving.

Sources