OpenAI’s GPT-6 Cyber is a cybersecurity model trained to find and validate exploitable vulnerabilities while staying inside the scope researchers set. It posts large gains over GPT-5.6 Cyber on ExploitGym and scope-alignment tests, is rated Critical under OpenAI’s Preparedness Framework, and is already in use on real codebases such as Firefox and Linux. Access starts with approved Daybreak Red customers through the API and Codex, not the open ChatGPT product.
Key points
- GPT-6 Cyber scores 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, about a 51% relative gain, and stays within scope on ExploitGym Honeypot in 99.93% of tests without its deployment prompt and 100% with it.
- OpenAI classifies it as Critical in cybersecurity, up from High for GPT-5.6 Cyber.
- Real-world work so far includes 81 novel high-severity Firefox findings (Mozilla shipping fixes), 948 Linux privilege-escalation exploits developed versus 166 for GPT-5.6 Sol on the same harness, 1,724 vulnerabilities reproduced, and 304 critical disclosures with candidate patches.
- Daybreak Blue is for verified defenders with fewer unnecessary refusals; Daybreak Red is for deeper authorized exploit development and testing with GPT-6 Cyber.
- Access is gated: API and Codex for select approved Daybreak Red customers first, with wider Daybreak Red rollout planned; GPT-5.6 Cyber is opening to all Daybreak Red customers; Daybreak Blue alpha for GPT-6 Astra is expanding.
What did OpenAI ship in GPT-6 Cyber?
GPT-6 Cyber is a specialized security model, not a general chat upgrade. OpenAI says it is built to understand software, identify vulnerabilities, and develop working exploits in authorized settings, while following rules of engagement more reliably than earlier cyber models. It outperforms GPT-6 Astra on most cyber tasks even when Astra does not refuse the request.
The launch sits inside OpenAI’s Daybreak program. Mainline models such as GPT-6 Astra already cover code review, triage and patch work. Daybreak Blue helps verified defenders validate vulnerabilities and fixes with fewer blanket refusals. Daybreak Red unlocks deeper exploit development and authorized security testing with GPT-6 Cyber.
Early customers named in the announcement include Firefox, Calif, Cognition, Palo Alto Networks, Cisco, SentinelOne, Perplexity and CodeRabbit. Summarizing lightly: Firefox reported novel high-severity findings after heavy prior hardening; Calif called long-running exploit-development work a step change; Cognition and CodeRabbit both said it beat their previous internal security benchmarks; network and endpoint vendors described faster research and product hardening. OpenAI also says it used the model on its own training infrastructure after earlier microVM escape findings.
How do Daybreak Blue and Daybreak Red differ?
The split matters more than the model name alone. Blue is the defender lane with fewer unnecessary refusals. Red is the deeper offensive-research lane, still meant for authorized testing, and is where GPT-6 Cyber lands first.
| Daybreak Blue | Daybreak Red | |
|---|---|---|
| Who it is for | Verified defenders and security researchers | Approved customers doing deeper authorized security testing |
| Typical work | Validate vulnerabilities and fixes; fewer unnecessary refusals | Exploit development and authorized testing with GPT-6 Cyber |
| Model access now | Daybreak Blue alpha for GPT-6 Astra expanding | GPT-6 Cyber for select approved customers; GPT-5.6 Cyber to all Daybreak Red |
| Extra controls | Defender-oriented access | IP allowlisting by default; Critical Infrastructure subgroup for approved OT/ICS defenders |
If your team mainly needs to confirm findings and ship patches, Blue is the lane OpenAI is expanding for Astra. If you need authorized exploit development against in-scope targets, Red is the path, and GPT-6 Cyber is the model attached to it.
How do the benchmarks compare?
OpenAI published several cyber evaluations. Treat them as OpenAI’s own numbers, not third-party audits, but the gaps are large enough to matter for procurement conversations.
| Benchmark | What it measures | GPT-6 Cyber | Comparison |
|---|---|---|---|
| ExploitGym | Exploit a specified vulnerability in a remote target | 48.5% | GPT-5.6 Cyber 32.1% (~51% relative / ~16 pp) |
| ExploitGym Honeypot | Avoid out-of-scope services that would reveal a flag | 99.93% without deployment prompt; 100% with prompt | GPT-5.6 Cyber 94.49% without prompt |
| Web pen-test vuln recall | Find vulns in web apps without source access | 40.3% | GPT-6 Astra 32.0% |
| RemoteExploitBench | Working exploits against known remote apps in a controlled lab | Completed 95% | GPT-6 Astra + Daybreak Blue refused 100% |
| Preparedness | OpenAI cybersecurity risk tier | Critical | GPT-5.6 Cyber was High |
RemoteExploitBench uses known issues in apps such as GitLab, PostgreSQL and Jenkins in a controlled environment. OpenAI says GPT-6 Cyber’s only failure there was an exploit it could not get working remotely. Full methodology is in the GPT-6 Cyber system card.
What real-world impact has OpenAI claimed so far?
Beyond benches, OpenAI reports several concrete research campaigns. Numbers below are from the announcement; they describe outcomes, not how to reproduce attacks.
- Firefox: 81 novel high-severity vulnerabilities, plus evidence that 30 known issues were more severe than previously reported. OpenAI says it sent reproducible tests and proposed patches; Mozilla has been landing fixes.
- Linux: 1,724 vulnerabilities reproduced and 948 privilege-escalation exploits developed, versus 166 by GPT-5.6 Sol on the same research harness. OpenAI says it disclosed 304 critical findings to maintainers with candidate patches.
- Brotli: Used alongside other OpenAI models to develop and validate exploits showing how a critical compression-library flaw could enable remote code execution in downstream apps.
- OpenAI infra: Used in controlled red-team work that previously found microVM escape paths; findings fed into patches and tighter network limits.
Customer quotes in the post stress long-running research, novel discovery in large codebases, and turning findings into fixes. Cognition reported 23% on an internal novel discovery and exploitation benchmark versus a previous best of 13%. CodeRabbit said it found 66% more high and medium severity issues than its production model on an internal review benchmark. Those are customer-reported internals, not public leaderboards.
Who can use GPT-6 Cyber, and what does it cost?
This is not a ChatGPT toggle. OpenAI says GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, with progressive expansion to all Daybreak Red customers planned. GPT-5.6 Cyber is being made available to all Daybreak Red customers. Daybreak Blue alpha access for GPT-6 Astra is expanding to more organizations and individual researchers.
Official model docs list the API id as gpt-6-cyber, with a 1,050,000-token context window, up to 922,000 input tokens and 128,000 max output tokens. Standard short-context prices on the model page are $20 per 1M input tokens, $2 per 1M cached input, and $100 per 1M output tokens. Cache writes are listed at $25 per 1M tokens for 30 minutes or $50 per 1M tokens for 12 hours. Daybreak Red API access defaults to IP allowlisting. New teams apply through Daybreak rather than flipping a public switch.
On Hacker News, early comments focused on access timing more than scorecards: why Daybreak Blue is still expanding slowly while high-impact CVEs keep landing, whether Blue alone is enough for defensive work, and whether labs are pacing public cyber capability ahead of unknown actors. The thread was short (item 50381590).
What safeguards and critical-infrastructure rules come with it?
OpenAI pairs the capability jump with tighter monitoring. Announced controls include cyber-specific misalignment monitoring, targeted monitoring for emerging threats, Private Safety Processing for related misuse checks (including for many Zero Data Retention API customers), credential-compromise monitoring, default IP allowlisting for Daybreak Red, and recommendations to keep high-risk workflows sandboxed with human oversight.
For critical infrastructure, OpenAI points to two tracks: the $1 billion Daybreak for Frontline Defenders grant program for resource-constrained teams, and a new Daybreak Red for Critical Infrastructure group for approved defenders who need authorized testing of critical systems. Safeguards were refined against assistance that could compromise industrial controls or safety-critical systems. Dragos ran OT/ICS lab evaluations with cyber-permissive Daybreak Red models; OpenAI says that feedback shaped the latest block rates. Higher block rates are not the goal by themselves, because many of the same techniques are needed for legitimate defense work.
What should security teams and builders do next?
- If you are already in Daybreak Red, ask your account team whether GPT-6 Cyber approval is open for your org, and confirm IP allowlisting and SSO/MFA requirements before wiring it into pipelines.
- If you mainly need triage, validation and patch help, watch the Daybreak Blue alpha expansion for GPT-6 Astra rather than waiting only on Cyber.
- Treat OpenAI’s real-world numbers as a signal to inventory high-value targets you already authorize for testing: browsers, kernels, compression libraries and your own training or agent infrastructure.
- Keep agent workflows sandboxed, scoped and human-reviewed. The alignment gains are large on OpenAI’s honeypot eval, but production rules of engagement still belong to your team.
- Critical-infrastructure defenders should look at Frontline Defenders funding and the Critical Infrastructure Red subgroup rather than generic API access.
Also trending the same day, covered only as context here: Google’s Gemini Omni 1.2 Flash video went generally available, Anthropic launched Claude Personal Finance via Plaid, and Meta is acquiring Conductor. Those are separate stories.
What should you watch next?
- When GPT-6 Cyber moves from select Daybreak Red customers to the full Red roster.
- How quickly Daybreak Blue alpha for GPT-6 Astra reaches individual researchers who only need defensive workflows.
- Independent third-party evals that re-run ExploitGym, web pen-test recall and RemoteExploitBench outside OpenAI’s harness.
- Whether Mozilla, Linux maintainers and other disclosure partners publish more detail on patch timelines and residual risk.
- Follow-on Dragos and other OT/ICS purple-team reports on whether the new critical-infrastructure safeguards stay useful without blocking authorized testing.
