OpenAI introduced GPT-6 Cyber on 5 November, a model built to find software flaws and prove they can be exploited. OpenAI’s own Preparedness Framework now rates it Critical for cybersecurity, where GPT-5.6 Cyber was rated High. Access starts with a small group of approved customers, and the company spends as much of its launch post on keeping the model inside its rules as on what it can break.

The capability jump is large on OpenAI’s own tests. ExploitGym hands a model a known flaw on a remote machine and asks for a working exploit. GPT-6 Cyber scored 48.5%, GPT-5.6 Cyber managed 32.1%, and the gap is what OpenAI calls a 51% relative gain. On a new web penetration test where the model has no source code, it recalled 40.3% of the vulnerabilities, where GPT-6 Astra, one of OpenAI’s mainline models, reached 32.0%. A third new benchmark, RemoteExploitBench, uses known flaws in GitLab, PostgreSQL, and Jenkins. GPT-6 Astra, running with the Daybreak Blue defender settings, refused every task. GPT-6 Cyber finished 95% of them.

Outside the lab, the headline result is Firefox. OpenAI researchers used the model to find 81 previously unknown high-severity bugs in the browser, a codebase that earlier frontier models had already been pointed at. OpenAI adds that 30 known Firefox issues were worse than first reported, and Mozilla has shipped fixes for many of them. Brian Grinstead, a distinguished engineer at Mozilla, called it “a world-class model for cyberdefense.” The Linux work covered here yesterday, 948 working exploits, ran on the same model, and OpenAI also cites a critical flaw in Brotli, a compression library that ships with Node.js, that could allow remote code execution.

Staying in scope is the harder problem. An offensive agent that wanders into a system nobody authorized is a liability for the lab and the customer alike, so OpenAI built a test it calls ExploitGym Honeypot, drawing on what it describes as “the Hugging Face incident.” The model works a tough exploitation task in a sealed environment, sitting beside support services such as a package registry that are deliberately easy to break and would hand over the answer. It has to work out that touching them is forbidden. With no safety prompts added at deployment, GPT-6 Cyber avoided the decoys in 99.93% of runs, while its predecessor managed 94.49%. Add the prompts and the new model never strayed. OpenAI quotes one reasoning trace: “We should only target binary/server.”

OpenAI designed the honeypot, chose the decoys, and graded the result, so a model that has learned this particular trap may still miss a different one. The earlier model strayed in roughly 5.5% of runs.

Access runs through Daybreak, OpenAI’s security program. Daybreak Blue gives verified defenders fewer refusals for validating fixes, and Daybreak Red, the tier that carries GPT-6 Cyber through the API and Codex, covers deeper exploit work and sanctioned testing. Red API users get IP allowlisting by default plus credential-compromise monitoring, and OpenAI added cyber-specific misalignment monitoring and a Private Safety Processing mode. It says it sees more attempts to misuse its models, including groups trying to distill them. A $1 billion grant program is meant to subsidize access for government agencies and operators of essential services.

Rob T. Lee, the chief AI officer at the industrial security firm Dragos, supplied the launch’s bleakest note. His team put a frontier model into a simulated power plant with almost no instructions, and it found two zero-days in engineering software that manages protective relay data. “The skill floor is dropping for the reconnaissance and vulnerability research needed before an attack,” he said.

Mozilla’s 81 bugs surfaced in a codebase that earlier models had already combed through, so any project last scanned with an older model generation should be treated as unscanned.

Reported by OpenAI on 5 November 2026.