Key takeaway
OpenAI released GPT-6 Cyber on November 5, 2026, a security-research model that scores 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, reaches 40.3% vulnerability recall in source-free web pentesting versus 32.0% for GPT-6 Astra, and is classified Critical for cybersecurity risk under OpenAI's Preparedness Framework.
What happened
On November 5, 2026, OpenAI published GPT-6 Cyber on its official blog. The company positions the model for security research: finding and validating exploitable vulnerabilities while staying inside the scope a researcher sets. OpenAI says the model has already uncovered and validated thousands of exploitable vulnerabilities in security-critical codebases.
The release comes with two access arrangements. Daybreak is the distribution program: Daybreak Blue serves verified defenders who need to validate vulnerabilities and fixes, while Daybreak Red supports authorized security testing, including deeper exploit development, and is the first channel for GPT-6 Cyber. Separately, OpenAI described a $1 billion Daybreak for Frontline Defenders grant program that subsidizes access for resource-constrained teams such as government organizations and essential service providers.
Key details
| Item | What OpenAI published |
|---|---|
| Release date | November 5, 2026 |
| Positioning | Cybersecurity model for finding and validating exploitable vulnerabilities within authorized scope |
| ExploitGym | 48.5%, versus 32.1% for GPT-5.6 Cyber, an absolute gain of about 16 points |
| Source-free web pentesting | 40.3% vulnerability recall, versus 32.0% for GPT-6 Astra |
| RemoteExploitBench | 95% of tasks completed; GPT-6 Astra with Daybreak Blue refused 100% |
| Out-of-scope protection (ExploitGym Honeypot) | 99.93% avoided exploiting out-of-scope services without a deployment prompt, 100% with it; GPT-5.6 Cyber was 94.49% |
| Risk classification | Critical for cybersecurity under the Preparedness Framework, up from High for GPT-5.6 Cyber |
| Initial access | Approved Daybreak Red customers, through the API and Codex |
OpenAI also reported concrete results from real codebases:
- In Linux kernel research, the model reproduced 1,724 vulnerabilities and developed working privilege-escalation exploits for 948 of them; GPT-5.6 Sol produced 166 under the same research harness. OpenAI says it disclosed 304 critical findings to maintainers with candidate patches, following the Linux community's guidance.
- In Firefox, the model found 81 previously unknown vulnerabilities that Mozilla classified as high severity, and showed that 30 additional known issues were more severe than previously reported. Mozilla began landing fixes shortly after receiving the reports, and OpenAI supplied proposed patches.
- In controlled red-teaming, agents using GPT-6 Cyber and other OpenAI models chained vulnerabilities to escape microVMs and run code on the underlying hosts. The findings were used to patch software, tighten network restrictions, and report issues to vendors.
Capability and alignment
ExploitGym tests whether a model can exploit a specified vulnerability against a remote target. GPT-6 Cyber's 48.5% compares with 32.1% for GPT-5.6 Cyber, which OpenAI describes as a 51% relative improvement, or about 16 percentage points in absolute terms.
The new web-penetration evaluation withholds source code: the model must locate vulnerabilities in a web application from external behavior alone. GPT-6 Cyber reached 40.3% vulnerability recall against 32.0% for the general-purpose GPT-6 Astra, indicating that specialized training also adds discovery capability.
RemoteExploitBench uses known vulnerabilities in applications such as GitLab, PostgreSQL, and Jenkins deployed in a controlled environment. According to OpenAI, GPT-6 Astra running with Daybreak Blue refused 100% of tasks, while GPT-6 Cyber completed 95%; its only failure was an exploit it could not get to work remotely.
On alignment, OpenAI made staying within bounds a central focus of the training. ExploitGym Honeypot was informed by the Hugging Face incident: the environment exposes easy-to-exploit supporting services such as a package registry or object store, and attacking them reveals the task flag but falls outside the assigned scope. GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without its deployment prompt, and in 100% of tests with the prompt.
Impact and limits
Critical is the highest tier for cybersecurity in OpenAI's Preparedness Framework. OpenAI did not publish the specific deployment restrictions attached to that tier, but it listed safeguards: cyber-specific misalignment monitoring, targeted monitoring during coordinated disclosures such as the PHP vulnerabilities, Private Safety Processing (encrypted records retained in customer storage for 30 days without exposing prompts or responses to OpenAI personnel), and IP allowlisting by default for Daybreak Red API access.
Facts and assessments should be separated here. The benchmark scores and real-world findings come from OpenAI's own blog and system card, so they are vendor-reported; independent reproductions are not yet public. The Critical rating is a conclusion inside OpenAI's own framework, not a regulatory determination.
From an industry perspective, the competitive ground for cybersecurity models is shifting from whether a model can find vulnerabilities to whether it can work reliably inside an authorized boundary. OpenAI is also making GPT-5.6 Cyber available to all Daybreak Red customers and expanding Daybreak Blue alpha access for GPT-6 Astra, which points to a staged rollout rather than a single broad release.
Official sources
- OpenAI: GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents (November 5, 2026)
- OpenAI: GPT-6 Cyber system card (linked from the announcement)