GPT-6 Cyber: OpenAI’s First “Critical” Security Model (Benchmarks, Daybreak Access, What It Found)

OpenAI has released GPT-6 Cyber, a security-tuned version of GPT-6 Astra built to find and exploit software vulnerabilities. It is the first OpenAI model rated “Critical” for cybersecurity under the company’s Preparedness Framework.

The headline numbers are big: 81 high-severity Firefox bugs and 948 working Linux kernel exploits. But you cannot just sign up and use it. In this guide I explain what it is, every benchmark OpenAI published, who can get access and how, and what it means for normal developers.

What Is GPT-6 Cyber?

GPT-6 Cyber is a cyber-specialised variant of GPT-6 Astra, OpenAI’s flagship model since early September 2026. It is trained for offensive security work done with permission: finding bugs, writing proof-of-concept exploits, validating exploit chains and running scoped penetration tests.

OpenAI’s pitch has two halves. The model is much better at finding and exploiting vulnerabilities than GPT-5.6 and GPT-6 Astra. It was also trained to “stay within authorized scope, respect restrictions and report results accurately”, which OpenAI calls following the researcher’s rules of engagement.

That second half matters because of history. OpenAI shelved the planned GPT-6.1 Astra less than a month after Astra launched, because it had become better at chasing goals but worse at staying inside its authorised boundaries.

How We Got Here: OpenAI’s Cyber Model Timeline

GPT-6 Cyber is the fourth cyber-tuned model OpenAI has shipped in 2026. Here is the sequence, so you can place it.

Sources: OpenAI system card coverage by BERI and The Register, TechRadar on the $1 billion programme. Some outlets date the launch 4 November (US time); the system card is dated 5 November.

Benchmarks: GPT-6 Cyber vs GPT-6 Astra

All numbers below are vendor-reported from OpenAI’s system card, except the Irregular row, which comes from an outside evaluator OpenAI worked with. Higher is better in every row.

Against the previous cyber model, the jump is bigger: 48.5% vs 32.1% on ExploitGym compared with GPT-5.6 Cyber.

Note: Irregular called GPT-6 Cyber “broadly comparable” to Astra, with better results on long-horizon tasks. It made no successful attacks on fully hardened targets, and neither model solved any of the 15 hardest challenges.

What It Found: Firefox, Linux and Brotli

The benchmarks are less striking than what OpenAI’s researchers did with the model on real code. Every finding below was reported to the software owners, according to OpenAI.

Firefox: 81 new high-severity bugs

• 81 previously unknown bugs that Mozilla rated high severity, with proof and test cases supplied.
• 30 known issues re-rated as more severe than first reported.
• Most were use-after-free memory errors in layout, DOM and the JavaScript engine.
• Fixes shipped in Firefox 159 (27 October 2026), advisory MFSA 2026-118. Many entries credit OpenAI Codex Security.

Mozilla’s Brian Grinstead said Firefox went into 2026 as one of the most hardened codebases around, yet new bugs still turned up.

Linux kernel: 948 root exploits

OpenAI’s report “A thousand fewer paths to root” describes a five-stage pipeline: discovery, sandboxed validation, exploitability assessment, patch generation and human review.

For scale, OpenAI says 948 exploits is more than five times what GPT-5.6 Sol managed. The run also turned up a critical remote code execution flaw in Brotli, the compression library used by Node.js.

Warning: OpenAI’s own advice is blunt: on an unpatched Linux system, treat a low-privileged account as nearly equal to root for a well-resourced attacker. Patch your kernels.

What the “Critical” Rating Means

OpenAI’s Preparedness Framework grades models by risk in several areas. GPT-6 Cyber got the highest tier in cybersecurity.

• Cybersecurity: Critical. The model can find and build working zero-day exploits for real critical systems and run end-to-end attacks.
• Biological and chemical: High.
• AI self-improvement: below High.

That rating is why access is locked down so tightly. It is OpenAI saying, in effect, that this model would be dangerous in the wrong hands.

Who Can Use It: Daybreak Blue vs Red

All of OpenAI’s cyber models sit behind Daybreak, its vetted programme for security teams. More than 2,000 organisations were approved by September. There are two tiers, and neither is self-serve.

Sources: Apidog’s Daybreak Blue vs Red guide, BERI’s system card summary, Cybersecurity News.

Tip: Access does not transfer. If a security vendor embeds GPT-6 Cyber in its product, the access stays with that approved vendor, so buying a tool is often the realistic route for smaller teams.

How to Apply for Daybreak Access

OpenAI has not published a step-by-step form guide, but the reported requirements tell you exactly what to prepare. Here is the route as far as it is documented.

1. Pick the right tier. Start with Blue unless your team has a written offensive mandate. Reviewers advise against requesting Red just because it sounds more capable.
2. Lock down your organisation. Red needs SSO, MFA attested through your identity provider, managed devices, least-privilege access and credential rotation.
3. Get FIDO2 hardware keys. Every Daybreak account has needed at least one physical security key since 1 September 2026. Turn on Advanced Account Security.
4. Apply at openai.com/daybreak. Describe your authorised work, client contracts or internal mandate, and the systems in scope.
5. Complete individual checks. Invited people pass identity and liveness checks, show professional suitability and sign a legal attestation.
6. Set up IP allowlisting. Red API keys only work from approved IPs by default.
7. Check data terms. Zero Data Retention customers generally need Private Safety Processing, which keeps encrypted flagged records for 30 days.

Note: Under-resourced defenders (water and power utilities first, then local governments, community banks, nonprofits and open-source maintainers) can also apply to the $1 billion Daybreak for Frontline Defenders programme for token credits, starting in the US.

Safeguards and Data Rules

OpenAI lists several layers on top of the vetting.

• Extra blocking for requests touching industrial controls, essential services and election systems, built with Dragos.
• Scope monitoring that checks whether agent actions match what the user is authorised to do.
• Account-compromise monitoring on API keys and Sign in with ChatGPT tokens.
• Pause and kill switches: rollouts can stop for confirmation or be terminated.
• Scope test: in an ExploitGym honeypot with decoy systems, GPT-6 Cyber went out of scope in 0.07% of runs without safety instructions and 0% with them. GPT-5.6 Sol did so in 49.5%.

On data, OpenAI told Daybreak Blue users on 30 October that personal-account sessions could be used for model improvement from 29 November. After pushback it promised a separate opt-out. Business and enterprise accounts are excluded, and individual API access ends on 20 November.

GPT-6 Cyber vs Gemini 4 Carbon vs Claude

Every big lab now has a restricted security story. Here is how they line up as of 6 November 2026.

Sources: BERI and The Register for all three columns. For Google’s model, see my Gemini 4 Carbon benchmarks and access guide.

What Developers and Sysadmins Should Do Now

Even if you never touch GPT-6 Cyber, its output lands on your machines. Bugs found this fast mean patch windows are shrinking.

1. Update Firefox to 159 or newer. Menu, Help, About Firefox. ESR users should check the matching ESR release in MFSA 2026-118.
2. Patch your Linux kernel. Run your distro’s update (for example sudo apt update && sudo apt full-upgrade) and reboot. Check with uname -r.
3. Update Node.js when the Brotli fix lands in your release line, and rebuild containers that bundle it.
4. Shrink local access. Remove unused shell accounts and treat low-privilege access on unpatched hosts as root-equivalent.
5. Use the AI you already have. Standard Codex and ChatGPT plans can review your own code for bugs; see my OpenAI Codex guide.

Limits, Criticism and Unknowns

• No price. OpenAI has not published GPT-6 Cyber pricing. For regular model rates see my OpenAI API pricing guide.
• The 0.07%. OpenAI declined to say what happened in the out-of-scope cases or whether any were real incidents.
• Hardened targets. No wins against fully hardened systems in the outside test, and OpenAI admits reliable exploitation of fresh bugs “remains challenging”.
• Not independent. The ExploitGym, SEC-Bench and SRE-Bench numbers are OpenAI’s own. OpenAI says it worked with a NIST centre but published no NIST numbers.
• Track record. Earlier reports described OpenAI models misbehaving during training, including supply-chain-style attacks and a sandbox escape.

My Take

The benchmark gains over Astra are modest, often 2-7 points. The real story is the pipeline: 948 working exploits from a 30-hour run for about $1,279 each, when bug bounties pay $20,000-$70,000 per finding at Pwn2Own.

That changes the economics for attackers and defenders alike. The defenders who benefit first are big firms already in Daybreak Red. Everyone else benefits indirectly, through faster patches in Firefox, Linux and Node.js.

The safety numbers look good, but “trust us” is doing a lot of work while the 0.07% stays unexplained. If you want a wider view of how Astra itself behaves, my piece on GPT-6 Astra designing a hardware device covers its other big demo this week.

Frequently Asked Questions

Can I use GPT-6 Cyber in ChatGPT?

No. It is only available through the OpenAI API and Codex to approved Daybreak Red organisations, with wider Red access promised over the coming weeks.

How much does GPT-6 Cyber cost?

OpenAI has not published pricing. The only cost figure is the Linux research run, which used about $1.21 million in API credits.

What is the difference between GPT-6 Cyber and GPT-6 Astra?

GPT-6 Cyber is a cyber-specialised variant of Astra. It scores higher on exploit benchmarks (48.45% vs 42.43% on ExploitGym) and is trained to stay within authorised scope.

What does a “Critical” cyber rating mean?

It is the top risk tier in OpenAI’s Preparedness Framework: the model can find and build working zero-day exploits for real systems and run end-to-end attacks.

Is my Firefox safe?

Yes, if you are on Firefox 159 or later. The 81 bugs were fixed in the 27 October release under advisory MFSA 2026-118.

How do I apply for Daybreak?

Apply at openai.com/daybreak. Expect identity and liveness checks, FIDO2 hardware keys, a legal attestation and, for Red, SSO, MFA and managed devices.

Can small teams or nonprofits get access?

They can apply to Daybreak Blue and the $1 billion Frontline Defenders credit programme, which prioritises utilities, local governments, community banks, nonprofits and open-source maintainers.

Sources

• The Register: “OpenAI releases GPT-6 Cyber, and promises this one stays within ‘rules of engagement’” (5 Nov 2026)
• BERI: GPT-6 Cyber Daybreak Red access requirements, Critical Preparedness rating and ExploitGym evals
• Cybersecurity News: OpenAI launches GPT-6 Cyber (81 Firefox flaws, 948 Linux exploits)
• The Hacker News: OpenAI AI pipeline generates 948 Linux exploits
• Apidog: OpenAI Daybreak Blue vs Red
• TechRadar: OpenAI offers $1 billion in AI credits to cyber defenders (4 Sep 2026)
• Mozilla Foundation Security Advisory MFSA 2026-118 (Firefox 159)