OpenAI GPT-6 Cyber Model Released for Vulnerability Research

OpenAI released GPT-6 Cyber on November 5, 2026. The model is a specialized variant of GPT-6 Astra built for authorized vulnerability discovery, exploit development, web pentesting, and patch assistance.

OpenAI GPT-6 Cyber Performance on Exploit Benchmarks

The new model scores 48.5 percent on ExploitGym, a benchmark that measures exploitation of specified vulnerabilities in remote targets. This marks a rise from 32.1 percent for GPT-5.6 Cyber and 42.4 percent for the base GPT-6 Astra. On a web pentesting benchmark that supplies no source code, GPT-6 Cyber reaches 40.3 percent recall compared with 32.0 percent for Astra.

Researchers also tested the model on RemoteExploitBench. GPT-6 Cyber completed 95 percent of tasks while the base Astra refused every request. Internal tests showed that GPT-6 Cyber reproduced 1,724 Linux kernel vulnerabilities and produced working local privilege escalation exploits for 948 of them. Of those exploits, 588 addressed previously unknown issues.

OpenAI researchers disclosed 304 critical Linux findings along with candidate patches to the relevant maintainers. The same team identified 81 previously unknown high-severity Firefox vulnerabilities that Mozilla has rated high severity, with many fixes already released.

Safety Controls and Access Restrictions

GPT-6 Cyber avoids out-of-scope exploitation in 99.93 percent of ExploitGym Honeypot tests without deployment prompts and in 100 percent of tests when prompts are supplied. The model adds new checks that block activity involving critical infrastructure. OpenAI rates the model Critical under its Preparedness Framework, the highest tier, because it can identify and develop functional zero-days in hardened real-world systems.

Access begins with select approved customers in the Daybreak Red tier. These customers may use the model through API and Codex for pen testing and exploit development. OpenAI plans to expand availability to all approved Daybreak Red customers over the coming weeks. GPT-5.6 Cyber will also open to the full tier. Daybreak requires identity verification and legal attestations confirming authorized use only.

Background and Planned Rollout

GPT-6 Cyber is the fourth cyber-specific model OpenAI has released in 2026. Training included dedicated alignment work alongside capability improvements to address scope violations observed in earlier agents. The company has already used the model internally to harden its own infrastructure.

Further rollout will include progressive expansion of Daybreak access, with a Blue alpha tier for defensive work planned for GPT-6 Astra. Approved security teams at organizations such as Mozilla, Cisco, and Palo Alto Networks are expected to begin testing the model in the near term. OpenAI notes that defenders currently hold a limited window to apply frontier models before wider proliferation occurs.