OpenAI has built a model that writes working exploits better than its predecessor, and it is asking everyone to believe the same model will politely stay inside the lines. That is a lot of trust to place in a company’s own benchmark suite.
OpenAI announced GPT-6 Cyber on November 5, 2026, describing it as a cybersecurity model trained to find and validate exploitable vulnerabilities while respecting the scope researchers set. Some of the numbers are striking. Some of the framing deserves a raised eyebrow.
What the model can do
On ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scores 48.5%, up from 32.1% for GPT-5.6 Cyber. OpenAI also built a new web pentesting test where models probe applications without source code access. GPT-6 Cyber reached 40.3% recall of vulnerabilities, against 32.0% for GPT-6 Astra, the mainline model.
Then there is RemoteExploitBench, a new benchmark using known flaws in GitLab, PostgreSQL, and Jenkins in a controlled environment. GPT-6 Astra running under Daybreak Blue refused every task. GPT-6 Cyber completed 95%. Note that OpenAI designed this benchmark, and it measures exactly the thing the product is sold to do.
Based on these results, OpenAI classifies the model as Critical in cybersecurity under its Preparedness Framework, up from High. The company assigned that label itself.
Real-world results
OpenAI says its researchers used the model to develop 948 privilege escalation exploits in Linux and find 81 previously unknown high-severity vulnerabilities in Firefox. Mozilla has released fixes for many of them. Cisco, Calif, and CodeRabbit are named as users for vulnerability research and code review, and OpenAI says it used the model on its own infrastructure. In internal red-team campaigns, agents chained vulnerabilities to escape microVMs and execute code on host machines.
That last detail is worth sitting with. The tool that helps defenders is also demonstrably able to break out of sandboxes.
The scope problem
The biggest risk with an autonomous offensive agent is not that it fails. It is that it wanders into systems nobody authorized. OpenAI says it trained specifically against that, and points to ExploitGym Honeypot, an evaluation informed by the Hugging Face incident. The model gets a hard task in an isolated environment next to deliberately easy-to-exploit services, such as a package registry. Attacking them would reveal the flag. The model has to work out that doing so is out of scope.
Without deployment safety prompts, GPT-6 Cyber stayed in bounds in 99.93% of tests, up from 94.49%. With the prompts, 100%. Those are good figures. But 0.07% of a very large number of autonomous runs is not zero, and a honeypot in a lab is not a production network with messy credentials lying around. OpenAI also shares chain-of-thought excerpts where the model reasons about not exploring out-of-scope credentials. Reassuring, though a model’s written reasoning is not proof of what drives its behavior.
Access, tiers, and what it means for you
Access runs through Daybreak. Daybreak Blue is for verified defenders validating vulnerabilities and fixes, with fewer refusals. Daybreak Red allows deeper exploit development and authorized testing with GPT-6 Cyber. OpenAI says it wants to expand Daybreak to organizations of every size, independent researchers, and open-source maintainers. No pricing was given in the announcement.
The privacy angle is straightforward. Faster discovery of Linux and Firefox flaws is good for everyone who runs them. But the verification gate is the real control here, and the announcement says little about how identity checks work, what gets logged, or what happens to vulnerability data researchers feed into OpenAI’s systems. Unpatched findings routed through a single vendor are a juicy target themselves.
OpenAI says there is a limited window to use frontier models to secure software. That is true in both directions. Attackers get the same capability curve, and the system card is the only place to check the claims. Read it before taking the headline numbers at face value.