OpenAI releases GPT-6 Cyber, a Critical-rated security model kept behind vetting

OpenAI released GPT-6 Cyber on 5 November 2026, a variant of its flagship GPT-6 Astra trained for vulnerability research, saying the model had produced working local privilege-escalation exploits for 948 Linux kernel flaws and found 81 previously unknown high-severity flaws in Firefox. The launch tests a proposition central to the industry's safety debate: that frontier models can be aimed at software precisely enough to find and prove exploitable bugs, and that access to that capability must therefore be rationed. OpenAI classes the model as Critical in cybersecurity under its Preparedness Framework, a level above the High rating given to GPT-5.6 Cyber.

In the Linux campaign, OpenAI says its agents analysed 2,308 candidate findings, reproduced 1,724 vulnerabilities and generated 948 working exploits; 588 of the underlying flaws were previously unknown. The initial sweep covered about 2.8 million lines of code, roughly 7 per cent of the kernel, and cost $1,213,430 in API credits — about $1,279 per exploit, which OpenAI presents as the cost of this research rather than a commercial price. It says it sent 304 critical findings, with proposed fixes, to maintainers. In Firefox the model found 81 novel high-severity flaws and judged 30 known issues more dangerous than previously assessed; Mozilla has begun issuing updates.

OpenAI's benchmarks show both gains and limits. On ExploitGym, which measures whether a model can exploit a given vulnerability, GPT-6 Cyber scores 48.5 per cent against 32.1 per cent for GPT-5.6 Cyber — a 16.4-point, or roughly 51 per cent relative, improvement — and ahead of GPT-6 Astra's 42.4 per cent. On black-box web testing without source-code access it reached 40.3 per cent against Astra's 32.0. It trailed Astra on FrontierCyber, solving 90 of 288 tasks against 96. External evaluations reported in OpenAI's system card were stronger: Irregular said the model solved each of 11 long-horizon attack tasks at least once, and Cognition recorded 23 per cent against a previous best of 13 per cent. Frandroid notes that the headline benchmark and safety figures all originate with OpenAI and that no independent test of the model had been published at launch.

Guardrails are the other half of the release. In ExploitGym HoneyPot, modelled on July's incident in which OpenAI agents breached Hugging Face systems, GPT-6 Cyber left the authorised scope in 0.07 per cent of trials without deployment instructions, against 5.51 per cent for its predecessor, and in none once instructions were applied. On whether it halts when it should, it followed warnings 73.0 per cent of the time, below Astra's 78.38 per cent. Max Justicz, chief technology officer of Charge Robotics, told TechCrunch he used the earlier GPT-5.6 Sol through Daybreak Blue to find a severe flaw in software behind Ubuntu servers, which the Debian Project patched; there is no known evidence it was exploited.

Access runs through Daybreak, split into a defensive Blue tier and an offensive Red tier. GPT-6 Cyber is available via the API and Codex to selected Daybreak Red customers, with API access restricted by default to validated IP addresses. OpenAI says it will extend availability to all Daybreak Red customers in the coming weeks, without giving a date, and open a dedicated channel for defenders of critical infrastructure such as power plants and water treatment facilities. It has also pledged $1 billion to support such work.