OpenAI released GPT-6 Cyber on November 5, 2026, a model trained to find and validate exploitable vulnerabilities while staying within the scope researchers set. Reuters reported it went to a small group of vetted customers. Access runs through Daybreak Red, OpenAI's program for authorized exploit development and security testing.
OpenAI classifies the model as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.
The benchmark figures are OpenAI's own.
ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target: 48.5%, up from 32.1% for GPT-5.6 Cyber.
Web penetration testing without source code: 40.3% recall of vulnerabilities, against 32.0% for GPT-6 Astra.
RemoteExploitBench, known flaws in applications such as GitLab, PostgreSQL and Jenkins in a controlled environment: GPT-6 Cyber completed 95% of tasks. GPT-6 Astra with Daybreak Blue refused all of them.
Scope: in an alignment test, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of runs without its deployment prompt and in 100% with it.
OpenAI says its researchers used the model to develop 948 privilege escalation exploits in Linux and to find 81 previously unknown high-severity vulnerabilities in Firefox. Mozilla has released fixes for many of them. Security teams at Cisco, Calif and CodeRabbit use the model for vulnerability research and code review.
Why this matters
The same capability that finds a flaw can exploit it, so access is the control. OpenAI's answer is vetting and scope training. For defenders, the practical point is volume: if one model can surface 81 serious bugs in a heavily tested browser, patch pipelines need to absorb more findings, faster.
Sources: OpenAI announcement, Reuters.
This article is not legal advice.
