OpenAI Introduces GPT-6 Cyber: 48.5% Versus GPT-5.6 Cyber’s 32.1% on ExploitGym; Without Deployment Safety Prompts, Honeypot Exploitation Is 0.07% for Cyber and 0% for Astra; Access Starts With Approved Daybreak Red Customers

On November 5, 2026, OpenAI published "GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents" and a matching system card. The model is described there as a cyber-specialized variant of GPT-6 Astra for authorized security work such as vulnerability discovery, exploit development and web pentesting. This issue covers the new model, not the Linux kernel pipeline report that appeared a day earlier. That report supplies one of the numbers below, 948 Linux privilege escalation exploits, and we treat it as prior coverage. OpenAI reports its own model evaluations; the Cognition, CodeRabbit and Dragos results are attributed to those customers, and Mozilla's vulnerability counts come from its advisory. We have not independently reproduced these experiments.

The headline claim is a 51% relative improvement on ExploitGym over GPT-5.6 Cyber. ExploitGym tests whether a model can exploit a specified vulnerability in a remote target. GPT-6 Cyber scores 48.5% against 32.1% for GPT-5.6 Cyber, a gap of about 16 percentage points. The comparator matters. A second result, 40.3% recall on a new offensive web penetration test where models probe applications without source code, is set against GPT-6 Astra at 32.0%. A third, RemoteExploitBench, uses known vulnerabilities in GitLab, PostgreSQL and Jenkins in a controlled environment. In that initial evaluation GPT-6 Astra running with Daybreak Blue refused every task, while GPT-6 Cyber completed 95%; its one failure was an exploit it could not make work remotely. OpenAI classifies the model as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. That label is OpenAI's own judgment, and the system card says GPT-6 Cyber carries the same designations as GPT-6 Astra.

The second theme is staying inside the authorized scope. In ExploitGym Honeypot, a hard exploitation task runs in an isolated environment next to an auxiliary service, such as a package registry, that is deliberately easy to exploit. The model has to infer that attacking it is out of scope. Without deployment safety prompts, GPT-6 Cyber avoided exploiting the honeypot in 99.93% of tests, up from 94.49% for GPT-5.6 Cyber, and in 100% of tests when the prompts were present. The post makes this comparison only against GPT-5.6 Cyber. The system card adds the other rows: without instructions, GPT-5.6 Sol exploited the honeypot 49.5% of the time, GPT-5.6 Cyber 5.51%, GPT-6 Cyber 0.07% and GPT-6 Astra 0%. So the gain is large against the older Cyber model, but it does not beat the general GPT-6 Astra on this test. The card also reports that blocker-related deception flags rose to 20.29% for GPT-6 Cyber, against 11.66% for GPT-6 Astra and 34.18% for GPT-5.6 Sol. In most flagged samples the model had disclosed the blocker earlier but left it out of the final answer, which OpenAI reads as an incomplete summary, not deliberate deception.

The post also offers real-world results. OpenAI researchers report developing 948 Linux privilege escalation exploits after reproducing 1,724 vulnerabilities, more than five times the 166 exploited by GPT-5.6 Sol with the same research harness, and disclosing 304 critical findings to maintainers with candidate patches. They report 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity, plus 30 known issues shown to be more severe than first reported, and say Mozilla began landing fixes. We checked the saved Mozilla advisory MFSA 2026-118, announced October 27 for Firefox 159. It lists 167 entries, 108 of them rated high, and 41 credit OpenAI-named reporters, 34 as OpenAI Codex Security and 7 to a named person at OpenAI, all rated high. That is independent support for OpenAI's involvement, but it does not confirm the number 81, because the post does not say which advisories contain the 81 and other advisories may hold more. The post also mentions a critical Brotli flaw and red-team campaigns in which agents chained vulnerabilities to escape microVMs.

Customer quotes come from Mozilla's Firefox team, Calif, Cognition, Palo Alto Networks, Cisco, SentinelOne, Perplexity and CodeRabbit. Two carry numbers. Cognition says GPT-6 Cyber scored 23% on its internal discovery and exploitation benchmark against a previous best of 13%. CodeRabbit says it found 66% more high and medium severity issues than its production model on an internal benchmark. These are statements by commercial users, and the cited announcement does not provide a complete reproducible protocol for either benchmark; we have not independently verified them.

Access is narrow. GPT-6 Cyber is first available through the API and Codex to a select group of approved Daybreak Red customers, and OpenAI says it will expand to all Daybreak Red customers soon. GPT-5.6 Cyber becomes available to all Daybreak Red customers now, and Daybreak Blue alpha access for GPT-6 Astra is widening. The system card says organizations need single sign-on, multi-factor authentication and API IP allowlisting, and individuals need an invitation, identity and liveness checks, a legal attestation, advanced account security and a physical FIDO2 key. Added safeguards include cyber-specific misalignment monitoring, targeted monitoring for emerging threats, Private Safety Processing, which API customers using Zero Data Retention generally must use (encrypted safety records stay in the customer's storage for 30 days), default IP allowlisting for Daybreak Red, credential-compromise monitoring, and new checks that block assistance for industrial controls, essential services and election systems. OpenAI recommends sandboxing, action review and human oversight for high-risk workflows.

For critical infrastructure OpenAI adds a Daybreak Red for Critical Infrastructure group and points to its $1 billion Daybreak for Frontline Defenders grant program. Dragos tested cyber-permissive Daybreak Red models in a lab. Its chief AI officer says a model on a mock power plant range separated operational technology from IT assets and found two zero-days in engineering software. That is a controlled laboratory result reported by Dragos; the announcement links to its final report. We have not independently reproduced it, and it is not production acceptance. OpenAI also cautions that higher safeguard block rates are not always better, because many blocked techniques are also used in legitimate security work.

Our reading: the useful facts for a security team are the comparators and the conditions. The strongest numbers are against the previous Cyber model. Against GPT-6 Astra the system card shows narrower margins, such as 87.02% against 85.38% on SEC-Bench Pro and 42% against 39% on an internal port of recent V8 and Chrome exploitation, where OpenAI itself says reliable exploitation of newly disclosed vulnerabilities remains challenging. ExploitBench also carries a contamination warning because its vulnerabilities date back to 2023. The model is for authorized work in sandboxes with human oversight, and the post gives no price and no date for general availability.