GPT-6 Cyber: exploit capability behind an approval gate

On November 5, OpenAI released GPT-6 Cyber: a cybersecurity-dedicated model trained to “find and validate exploitable vulnerabilities within researcher-defined scope”, supporting exploit development, vulnerability research, code review and patching. The most important sentence on the page is not in the benchmarks section but in the safety section: under OpenAI's own Preparedness Framework, the model rates **Critical** for cybersecurity — up from High for GPT-5.6 Cyber. That is the top tier of the official classification, meaning the capability itself is officially treated as a top-tier risk, and on the same page it arrives together with the whole arrangement of whether to open it and to whom.

The numbers on one table: 48.5% on ExploitGym against 32.1% for the predecessor GPT-5.6 Cyber — about 16 points, an official “roughly 51%” relative gain. Staying in scope is measured separately: ExploitGym Honeypot avoids out-of-scope exploitation 99.93% of the time without a deployment prompt (predecessor 94.49%), 100% with the prompt. Against a general model: a new web-pentesting eval reports 40.3% vulnerability recall versus 32.0% for GPT-6 Astra — a dedicated model against a general one; on RemoteExploitBench (GitLab, PostgreSQL, Jenkins ranges) GPT-6 Cyber completed 95% of tasks, the sole failure being an exploit that could not be triggered remotely, while Astra with Daybreak Blue refused 100% of tasks. Read that last row carefully: what was measured for Astra is refusal behavior, not capability.

Two customer-reported figures place it: on Cognition's internal benchmark GPT-6 Cyber scores 23% against a prior best of 13%; CodeRabbit reports finding 66% more high/medium-severity issues than their production model. All vendor- or customer-reported, none reproduced here; ExploitGym, RemoteExploitBench and the other new evals are OpenAI's own, and independent readings must wait until access widens.

The other half of this release is the gate. GPT-6 Cyber ships via API and Codex to “a select group of approved Daybreak Red customers” — Daybreak Red is OpenAI's vetted program for offensive-security research — then expands progressively to all Daybreak Red; the predecessor GPT-5.6 Cyber opens to all Daybreak Red users at the same time; Daybreak Blue alpha (running GPT-6 Astra) widens to more organizations and individual researchers. In other words: classified Critical, used behind approval — capability grading and access design advance in the same release, and that is the main impression the page leaves.

The gate's supporting mechanisms are written one by one on the page: the Daybreak Red API requires IP allowlisting by default; Zero Data Retention API customers generally must use Private Safety Processing — automated misuse checks reading encrypted records held 30 days in customer storage, with prompts and responses invisible to OpenAI staff; a new “Daybreak Red for Critical Infrastructure” group lets approved defenders test critical systems (power, water), with new checks blocking high-risk assistance involving them; and a $1 billion “Daybreak for Frontline Defenders” program subsidizes resource-constrained teams — government agencies and essential-service providers. The Dragos partnership runs controlled evaluations on a mock power-plant range, with feedback tuning the guardrails.

A useful comparison sits inside this site: when Google released Gemini 4 Carbon on October 28, access likewise began with “a subset of cyber defenders”, widened via the Fairwind Program, and left developers and consumers with only “soon”. Within one week, the two labs handed their strongest general model (Carbon, first on AA v5.0 at 59 (high) at announcement) and their sharpest attack capability (GPT-6 Cyber) to defenders before early adopters. A high score is not general availability — the same sentence, now seen a third time.

The heaviest part of the page is two real targets. Linux: officially, GPT-6 Cyber reproduced 1,724 vulnerabilities and built working exploits for 948 — GPT-5.6 Sol with the same harness managed 166, over five times fewer; following Linux community guidance, OpenAI disclosed 304 critical findings to maintainers with candidate patches, the rest still being fixed. Firefox: in one research campaign the model produced evidence and reproducible tests for 81 novel high-severity flaws and showed 30 known issues were worse than reported; after disclosure with proposed patches, Mozilla was receptive and began landing fixes quickly — that is advisory MFSA2026-118 (October 27, Firefox 159, rated high overall), where Amy Burnett (OpenAI) and “OpenAI Codex Security” receive credit across many CVEs.

The timeline is worth a second look: Mozilla's fixes shipped October 27, and OpenAI's model announcement came nine days later on November 5 — the patches reached the browser before the model's name did. Firefox users' protection does not depend on understanding this release: MFSA2026-118 covers roughly 150 CVEs, most rated high, each now issued its own CVE number under Mozilla's new policy.

Cost and context come via TechCrunch: the Linux campaign reportedly cost about $1.2 million, against the roughly $6 million in tokens OpenAI once spent exploring a fluid-dynamics problem; a hobbyist found the severe Ubuntu/Debian bug CVE-2026-109518 in about two hours using GPT 5.6 Sol through Daybreak Blue. The first shows a vendor treating bug-hunting as engineering worth paying for; the second shows how even the “weaker” models inside the vetted program change an individual researcher's starting point. Each figure keeps its own provenance: official numbers do not change ownership through press retelling, and press figures do not pose as official ones.

Put the week's three releases side by side and they guard against different things. OpenAI chose “dedicated model + approval gate” for GPT-6 Cyber: the capability is Critical and whoever uses it remains checkable; Google chose “general model + defenders first” for Carbon: the model is a general flagship and the gate opens to security practitioners first; Moonshot chose “open weights + removal at the data layer” for K3.1 Pro: anyone can download the 1.56TB of weights, but cyber training data was removed at both stages, dropping xdev-bench-hard from 90.5 on the unfiltered checkpoint to 81.0 for the release build — the safeguard lives in the weights, not at a gate.

TechCrunch's criticism concentrates on the gate side of the first two: Daybreak counts only thousands of professionals, so defenders' gate is narrow; Daybreak Blue is said to be “nerfed” — defenders' capability tightened; screening is weak, with entry requiring only a driver's-license upload; and the defense side argues frontier labs create patching workloads beyond defenders' resources, one researcher spending about $5,000 in subscriptions and tokens for a few exploits. The third kind draws criticism from the other end: attackers can use open weights with guardrails stripped (the community always produces fine-tunes with safeguards removed), and data removal only cuts the same pipeline's score by about 9.5 points — it does not delete the capability from the world.

For ordinary readers, three actionable facts: first, the Critical classification and the approval gate mean this capability is far from everyday use — neither ordinary ChatGPT users nor ordinary developers can touch it today; second, a defender path already exists — qualifying researchers can apply for Daybreak Blue (screened by ID upload) and resource-constrained teams can look into the $1B Frontline Defenders program; third, this round's results are already in your devices — Firefox 159 (MFSA2026-118) carries the 81-flaw fixes, no action required from readers, the update arrives on its own.