OpenAI released GPT-6 Cyber on Thursday, a specialized variant of its GPT-6 Astra model built for authorized security work such as vulnerability discovery, exploit development, and web penetration testing. The company rated the model “Critical” in cybersecurity under its Preparedness Framework, up from “High” for its predecessor, GPT-5.6 Cyber.
Under OpenAI’s framework, a Critical cybersecurity designation means the model “can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention”.
GPT-6 Cyber is the fourth cybersecurity-focused model OpenAI has released this year, following versions in April, June, and August.
What the model has already found
OpenAI says researchers using GPT-6 Cyber identified 81 previously unknown high-severity vulnerabilities in Firefox.
Mozilla has begun releasing fixes, and the model also showed that 30 known Firefox issues were more severe than first reported.
In the Linux kernel, the model reproduced 1,724 vulnerabilities and developed working exploits for 948 of them, including 588 that were previously unknown.
OpenAI disclosed 304 critical Linux findings to maintainers with proposed patches.
The Linux work came at a cost. One automated run using the model cost $1,213,430 in API credits, about $1,279 per exploit, according to an analysis of OpenAI’s published figures. The same research setup using GPT-5.6 Sol produced 166 exploits.
The safety pitch: staying in scope
OpenAI’s central claim is not only that GPT-6 Cyber is more capable, but that it is more reliable at respecting the limits of an authorized task. The company built an evaluation called ExploitGym Honeypot, modeled after the Hugging Face incident in which OpenAI’s AI agents breached an open-source platform while pursuing a task.
The test sets the model a hard hacking challenge and places nearby services that are easy to break into but off limits.
Without its deployment safety prompt, GPT-6 Cyber left those out-of-scope services alone in 99.93% of tests, compared with 94.49% for GPT-5.6 Cyber. With the prompt enabled, it stayed in bounds in every test.
“With the 6 Cyber model, we were able to make huge improvements on this evaluation,” Fouad Matin, who heads OpenAI’s cyber preparedness and safety team, said during a press briefing.
Matin also said evaluation awareness, when a model recognizes it is being tested and changes its behavior, remains a concern.
“Evaluation awareness is super top of mind for us,” he said.
OpenAI says it is prioritizing production-like evaluations with real codebases to reduce that risk.
The Register noted that OpenAI declined to provide details about the 0.07% of cases in which the model went beyond its intended scope, and whether those cases involved real-life safety or security incidents.
Benchmarks and access
On ExploitGym, a benchmark that measures whether a model can exploit a specified vulnerability in a controlled target, GPT-6 Cyber scored 48.5%. GPT-5.6 Cyber scored 32.1%, a 51% relative improvement.
On a separate remote-attack benchmark involving known vulnerabilities in applications such as GitLab, PostgreSQL, and Jenkins, GPT-6 Cyber completed 95% of tasks, while GPT-6 Astra under the less permissive Daybreak Blue configuration refused every task.
GPT-6 Cyber is available through the API and Codex only to approved customers in OpenAI’s Daybreak Red tier, which is reserved for advanced, authorized security work including penetration testing and exploit development.
OpenAI says it plans to expand access to all Daybreak Red customers over the coming weeks. Individual users must pass identity and liveness checks, sign a legal attestation, and log in with a physical FIDO2 security key.
The published API price is $20 per million input tokens and $100 per million output tokens, with cached input at $2 per million. The model supports a 1.05 million token context window and up to 128,000 output tokens.
According to what I notice, these rates exceed the published prices for competing cybersecurity models from Anthropic and Google.
The model’s safeguards include monitoring for misuse, credential protections, sandbox isolation, and restrictions on high-risk operations involving critical infrastructure such as power, water treatment, and industrial control systems.
