Back home

GPT-6 Cyber

x+web 0.92
Visit source

Intro

GPT-6 Cyber is a specialized cybersecurity research model launched by OpenAI on 2026-11-05. Announcement: https://openai.com/index/introducing-gpt-6-cyber ; system card: https://deploymentsafety.openai.com/gpt-6-cyber .

It targets authorized vulnerability discovery, exploit validation and patch development. It succeeds GPT-5.6 Cyber and beats the mainline GPT-6 Astra on most cyber tasks.

Official highlights:

  • ExploitGym: 48.5% (vs 32.1% for GPT-5.6 Cyber, ~51% relative gain);
  • Web pentest recall: 40.3% (vs 32.0% for GPT-6 Astra);
  • RemoteExploitBench: 95% completed, while GPT-6 Astra with Daybreak Blue refused all tasks;
  • Real-world: helped develop 948 Linux privilege-escalation exploits and found 81 previously unknown high-severity Firefox vulnerabilities (many already fixed by Mozilla);
  • Scope discipline: avoided out-of-scope services in 99.93% of tests without its deployment prompt, 100% with it;
  • Rated Critical in cybersecurity under the Preparedness Framework (up from High).

Available first to select Daybreak Red customers, expanding to all approved Daybreak Red customers in coming weeks; Cisco, Calif and CodeRabbit already use it.

Explain

What it is

GPT-6 Cyber is not a general chat model but a GPT-6 variant trained for offensive and defensive security research: understanding software, finding bugs, writing working exploits and helping draft patches.

The Daybreak program

OpenAI's Daybreak is its cybersecurity access program:

  • Daybreak Blue: verified defenders use mainline models with fewer unnecessary refusals to validate vulnerabilities and fixes;
  • Daybreak Red: deeper exploit development and authorized pentesting with GPT-6 Cyber.

In the API, access_programs.cyber selects the program; identity verification, SSO/MFA and API IP allowlisting are required.

Why it matters

  • The first model OpenAI itself rates Critical in cybersecurity — autonomous bug-finding and exploit writing has reached a new tier;
  • Pitched as an aligned security agent: stronger, yet more reliable at staying within authorized scope;
  • Big implications for hourly-billed security firms, open-source maintainers and red teams.

Limits & risks

  • Vetted customers only; regular developers can't just call it;
  • Most numbers are OpenAI self-reported benchmarks;
  • High dual-use risk; access control and monitoring are preconditions for deployment.

Usage

Who it's for

  • Enterprise security teams, red teams and pentest firms;
  • Open-source maintainers needing large-scale code audits (OpenAI plans to broaden Daybreak);
  • Researchers studying AI cyber-capability evaluation and the Preparedness Framework.

How to get access

  1. Read https://openai.com/index/introducing-gpt-6-cyber and the system card;
  2. Apply to Daybreak Red via OpenAI (org identity verification, SSO/MFA, IP allowlist);
  3. Once approved, set access_programs.cyber in the Responses API and select GPT-6 Cyber;
  4. Without approval, use Daybreak Blue with GPT-6 Astra for code review and vulnerability triage.

Advertisement