Skip to main content

GPT-6 Cyber: A Look at OpenAI's New Cybersecurity Model

OpenAI’s new security model is trained to stay within the scope researchers set. Here’s how it performs and who can use it.
Josef Waples
Josef Waples

Create Your Free Account

Practice and track your progress.

Continue with GoogleBy continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.

OpenAI has released GPT-6 Cyber, which promises two things:

  • it's better at finding and fixing vulnerabilities
  • has better alignment

How good is it? For the first point, it scores 48.5% on ExploitGym. For perspective, GPT-5.6 Cyber scored 32.1%, so that's greater than a  50% improvement. 

For the second point, it avoided hitting out-of-scope targets in 99.93% of tests without its deployment prompt, and 100% with it. (OpenAI set up scenarios that included services the model was told not to attack, then checked whether it would stay away.)

In this article, I'll walk through what GPT-6 Cyber is, how it performs, what it has found in real codebases, the safeguards around it, and how security teams can get access.

What Is GPT-6 Cyber?

GPT-6 Cyber is a cyber-permissive version of GPT-6. "Cyber-permissive" means the model is built to say yes to offensive security requests, like finding vulnerabilities and writing exploits. General-purpose models are by design much more likely to refuse such offensive security requests. This is why GPT-6 is only for verified defenders working in authorized environments. 

Another thing: GPT-6 Cyber is designed to run as an agent. Given a target, it can read and probe software, identify weaknesses, write working exploits to prove they're real, and then it will propose patches. The model is now the top tier of OpenAI's Daybreak security program, and for verified users, it is available through the API and Codex.

GPT-6 Cyber Benchmarks

OpenAI uses a system called the Preparedness Framework to rate how dangerous a model’s abilities could be in risky areas like cybersecurity. Each model gets a risk level, and a higher level means OpenAI needs more in the way of safeguards and access controls.

Based on its evaluation results, OpenAI moved GPT-6 Cyber's risk rating from High to Critical. This tells us that OpenAI believes misuse could do serious damage. That’s why it’s only available to approved Daybreak Red customers.

OpenAI also built two new evaluations for this release:

Benchmark

What it tests

GPT-6 Cyber

Comparison

Web pentesting

Finding vulnerabilities in web apps without source code access

40.3% recall

32.0% for GPT-6 Astra

RemoteExploitBench

Exploiting known vulnerabilities in apps like GitLab, PostgreSQL, and Jenkins

95% of tasks completed

GPT-6 Astra refused 100%

On RemoteExploitBench, GPT-6 Cyber's only apparent failure was a task where it understood the vulnerability but couldn’t make the exploit work against the target over the network.

Alignment: Staying Within Scope

GPT-6 Cyber stayed within authorized scope in 99.93% of honeypot tests without any safety prompt, and 100% with its deployment prompt. That compares with 94.49% for GPT-5.6 Cyber.

If you don't know, in security, a honeypot is a decoy system designed to look like an easy target. With the tests, OpenAI planted deliberately vulnerable services next to the real task and checked whether the model would stay on target. Apparently, it did, almost all the time. 

We can think about this as scope: Scope matters because a security agent that wanders is a big liability. OpenAI doesn't want its models attacking unrelated services or ignoring the rules of engagement, not after the much-talked-about OpenAI HuggingFace incident. 

OpenAI shared excerpts of the model's chain of thought:

Can't assume extra API or attack controller not target. We should only target binary/server.

GPT-6 Cyber's chain-of-thought

Real-World Results

GPT-6 Cyber found serious bugs in code that’s already been looked at for years. (Although these numbers come from OpenAI itself.)

TargetWhat it foundResult
Linux kernelWorking exploits for 948 bugs5x more than GPT-5.6 Sol; 304 critical bugs reported
Firefox81 new high-severity bugsMozilla has shipped many fixes
BrotliA critical compression flawProved remote code execution in apps like Node.js

The Firefox result is, in my opinion, the most interesting one. Brian Grinstead, an Engineer at Firefox, noted that the browser entered 2026 as "one of the world's most hardened and scrutinized codebases," already tested with multiple generations of frontier models. GPT-6 Cyber still found new high-severity bugs and suggested architectural improvements.

Is GPT-6 Cyber Safe? The Dual-Use Problem

Any tool that helps defenders find a bug can help attackers. 

Most of the safeguards are what you'd expect: gated access, misuse monitoring, and recommended sandboxing for risky workflows.

Reading between the lines of the release, it seems like OpenAI is actually worried about two things in particular:

  • Stolen access, not just bad users. Daybreak Red API access requires IP allowlisting by default. A leaked API key on its own isn't enough to use the model.
  • Distillation. OpenAI says it's seeing more attempts to distill its models, meaning training a cheaper copy on their outputs. A copy of a Critical-rated cyber model would come with none of these safeguards.

Zooming out, critical infrastructure is the real test. Dragos, a security firm that specializes in industrial systems, tested a permissive Daybreak Red model on a mock power plant and gave it almost no instructions. The model separated the industrial equipment from ordinary IT systems on its own, then found two zero-days in software that manages protective relays, the devices that trip breakers when something goes wrong.

How to Access GPT-6 Cyber

GPT-6 Cyber is initially available only to a select group of approved Daybreak Red customers, through the API and Codex. OpenAI plans to expand it to all Daybreak Red customers soon.

Daybreak is OpenAI's trusted-access program for security work, and it has tiers matched to how risky the work is:

Tier

Model

What it's for

Mainline models

GPT-6 Astra

Code review, vulnerability triage and patch development, with standard safeguards

Daybreak Blue

GPT-6 Astra (alpha, expanding)

Verified defenders validating vulnerabilities and fixes with fewer unnecessary refusals

Daybreak Red

GPT-6 Cyber, plus GPT-5.6 Cyber for all Red customers

Deeper exploit development and authorized security testing, including against remote targets

Daybreak Red for Critical Infrastructure

GPT-6 Cyber

Approved OT/ICS defenders testing critical systems, with misalignment safeguards kept on

New users and organizations can apply for Daybreak. If you do want access, the route depends on who you are. (Applying, of course, doesn't guarantee access.)

  • Organizations: Apply for Daybreak. Expect identity checks and a legal attestation that your testing is authorized.
  • Individual researchers: Register interest in Daybreak Blue via this form.
  • Under-resourced defenders: Governments, utilities, nonprofits and open-source maintainers can apply for subsidized access.
  • Security vendors: Join the Daybreak partner program to build the models into your products.
  • US government: Daybreak Red is available in AWS GovCloud.

Final Thoughts

Most of us never think about the code behind our browsers, banks, and power grids. But models like GPT-6 Cyber are a sign that the hunt for weaknesses in that code is about to speed up, by both those who want to patch things and by those who want to do damage.

If the reported results hold up, bugs that sat unnoticed for years will likely be found faster going forward. But security has always been a race between finding flaws and fixing them. 

Josef Waples

Author

Josef Waples

I'm a data science editor with contributions to research articles in scientific journals. I'm especially interested in linear algebra, statistics, R, and the like.

GPT-6 Cyber FAQs

What is GPT-6 Cyber?

GPT-6 Cyber is OpenAI's specialized cybersecurity model, built to find and validate exploitable vulnerabilities and help develop patches while staying within the scope a researcher authorizes.

How is GPT-6 Cyber different from GPT-6 Astra?

GPT-6 Astra is a general-purpose model that refuses many offensive security tasks. GPT-6 Cyber is cyber-permissive for approved users and outperforms Astra on most cyber tasks, even when Astra doesn't refuse.

Can anyone use GPT-6 Cyber?

No. It's limited to approved Daybreak Red customers via the API and Codex, with wider Daybreak Red access planned. Organizations and researchers can apply through OpenAI's Daybreak program.

Why is GPT-6 Cyber rated Critical?

OpenAI classifies it as Critical in cybersecurity under its Preparedness Framework because of its ability to develop working exploits, including against remote targets. GPT-5.6 Cyber was rated High.

How does OpenAI prevent misuse of GPT-6 Cyber?

Through gated access, misalignment and threat monitoring, Private Safety Processing, mandatory IP allowlisting for Daybreak Red API access and checks that block high-risk activity against critical infrastructure.

Topics

OpenAIArtificial Intelligence

Related

See More →