OpenAI Launches GPT-6 Cyber for Vulnerability Research
November 8, 2026 · 2 min read
Also published in Русский, Italiano, Español, Türkçe, Indonesia, Français, Svenska, Polski, עברית, हिन्दी, Norsk, العربية, Português (Brasil)
OpenAI has released GPT-6 Cyber, an artificial intelligence model designed for cybersecurity to find and verify exploitable vulnerabilities. The model is currently available via API to approved Daybreak Red customers.
In performance tests on ExploitGym, which evaluates attacks on remote targets, GPT-6 Cyber achieved a score of 48.5 percent, an increase from the 32.1 percent recorded by GPT-5.6 Cyber. For web penetration testing without source code, the model reached a recall of 40.3 percent, compared to 32.0 percent for GPT-6 Astra. On RemoteExploitBench, which utilizes vulnerabilities in Jenkins, PostgreSQL, and GitLab, the model succeeded in 95 percent of tasks, while GPT-6 Astra on Daybreak Blue rejected all tasks.
Based on these results, OpenAI has categorized GPT-6 Cyber as Critical for cybersecurity under its Preparedness Framework, raising it from the High level assigned to GPT-5.6 Cyber. To ensure alignment, the model was trained to follow constraints, stay within authorized boundaries, and report results accurately. In ExploitGym Honeypot tests, where easy targets were placed outside the work scope as traps, GPT-6 Cyber avoided attacking those services 99.93 percent of the time without a deployment safety prompt, up from 94.49 percent for GPT-5.6 Cyber. This rate reached 100 percent when the prompt was used.
OpenAI research teams used the model to discover 81 previously unknown high severity vulnerabilities in Firefox, several of which Mozilla has already patched. The model also reproduced 1,724 vulnerabilities in the Linux kernel, created 948 functional exploits, and reported 304 Critical vulnerabilities to maintainers with suggested patches. Security teams from CodeRabbit, Calif, and Cisco have also adopted the model for code review and vulnerability research.
To prevent misuse, OpenAI has implemented monitoring to ensure model actions match user permissions. IP allowlisting is now the default for Daybreak Red API access, and API customers using Zero Data Retention are generally required to use Private Safety Processing. Additionally, OpenAI created the Daybreak Red for Critical Infrastructure group for approved teams to test essential systems, working with Dragos to evaluate and improve safeguards. OpenAI plans to expand access to GPT-6 Cyber to all Daybreak Red customers soon and is currently making GPT-5.6 Cyber available to all Daybreak Red clients.