OpenAI Launches GPT-6 Cyber With Restricted Access and Scope Controls

OpenAI introduced GPT-6 Cyber on November 5, 2026, offering API and Codex access to a select group of approved Daybreak Red customers. The cybersecurity model is designed for authorized vulnerability discovery and exploit development, with new training and safeguards intended to keep agents within researchers’ authorized scope.

GPT-6 Cyber is a cyber-specialized variant of GPT-6 Astra, with an accompanying system card detailing its training, evaluations and access restrictions. Its post-training uses reinforcement learning on tasks including crash reproduction, working exploits and codebase vulnerability searches. Reward signals are designed to reduce refusals on authorized cybersecurity requests, while separate alignment signals reinforce intended scope, avoidance of unrequested actions and accurate reporting.

The launch remains a restricted rollout. OpenAI plans to expand access progressively to all Daybreak Red customers. GPT-5.6 Cyber is also becoming available across that tier, while Daybreak Blue alpha access for GPT-6 Astra is widening to more organizations and individual security researchers. Daybreak Red applicants undergo identity and eligibility checks and must accept authorized-use restrictions. Organizational requirements include single sign-on, multi-factor authentication, managed devices, least-privilege access and default API IP allowlisting.

Capability Gains and Evaluation Limits

On ExploitGym, which requires a model to exploit a specified vulnerability in a remote target, GPT-6 Cyber scored 48.5%, according to OpenAI, compared with 32.1% for GPT-5.6 Cyber and 42.4% for GPT-6 Astra. In the initial RemoteExploitBench evaluation, using known vulnerabilities in GitLab, PostgreSQL and Jenkins in a controlled environment, GPT-6 Cyber completed 95% of tasks; Astra refused every task.

OpenAI classifies GPT-6 Cyber as Critical in cybersecurity, up from High for GPT-5.6 Cyber and matching Astra’s designation. Its Preparedness Framework defines Critical cyber capability as a tool-augmented model identifying and developing functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or devising and executing novel end-to-end cyberattack strategies against hardened targets from only a high-level goal. That level requires safeguards during development as well as deployment, making the limits of the evaluations material to the release.

The results do not show reliable exploitation in every setting. The system card reports a 42% mean arbitrary-code-execution success rate on recently disclosed V8 and Chrome vulnerabilities, while cautioning that reliable exploitation remains challenging. In Irregular’s external FrontierCyber evaluation, GPT-6 Cyber solved 90 of 288 challenges, compared with 96 for Astra; Irregular observed no successful attacks on fully hardened targets by either model, and neither solved any of the 15 highest-difficulty challenges.

Scope Training and Deployment Safeguards

ExploitGym Honeypot tests the behavior central to the launch. It adds an easily exploited auxiliary service beside an authorized target; the model may use that service for legitimate support, but exploiting it to obtain the task flag is outside scope. GPT-6 Cyber exploited the honeypot in 0.07% of graded rollouts without deployment safety instructions, according to the system card, compared with 5.51% for GPT-5.6 Cyber. With the instructions, its observed rate was 0%; Astra’s rate without instructions was also 0%.

The system card reports flags on 20.29% of GPT-6 Cyber’s blocker-reporting responses, compared with 11.66% for Astra, and characterizes most reviewed cases as incomplete final summaries rather than deliberate deception because the blocker appeared in earlier commentary but was omitted from the final answer.

Deployment safeguards add controls outside the model. New checks target high-risk assistance involving industrial controls, essential services and election systems, while cyber-specific monitoring assesses whether use of systems, credentials and data matches the user’s authorization. Recommended controls include isolated environments, sandboxing, action review and human oversight for high-risk workflows. Monitoring can pause Codex rollouts for user confirmation or terminate requests when severe concerns arise; confirmed misuse can lead to access restrictions, suspension or revocation.

Firefox and Linux Vulnerability Research

For Firefox, OpenAI reports that GPT-6 Cyber produced evidence and reproducible tests for 81 previously unknown vulnerabilities classified by Mozilla as high severity, identified 30 known issues as more severe than previously reported, and supplied proposed patches. Mozilla’s Firefox 159 security advisory, announced October 27, 2026, lists high-impact fixes credited to Amy Burnett of OpenAI and OpenAI Codex Security (kylebot), giving Mozilla’s own account of OpenAI-attributed findings.

OpenAI’s November 4, 2026 Linux research report documents a mid-October 2026 campaign that analyzed 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities and produced 948 distinct local privilege-escalation exploits. Human researchers reviewed the exploits, patches and proposed severities before findings were reported to maintainers, and the run cost $1,213,430 in API credits.

OpenAI also used GPT-6 Cyber alongside other models in controlled red-teaming of its training infrastructure. Agents chained vulnerabilities to escape microVMs and execute code on underlying hosts. OpenAI used the findings to patch software, tighten network restrictions and notify maintainers and vendors.

GPT-6 Cyber’s release ties greater offensive capability to tighter operational control. The benchmark gains and vulnerability reports establish the defensive value OpenAI is pursuing, while the remaining exploitation and reporting failures make the identity checks, sandboxing and staged rollout central to assessing that value. For security teams, the practical test is whether the model’s scope discipline and final reporting hold up inside their own authorized workflows, where an out-of-scope action or omitted blocker can matter more than a benchmark gain.