Industry Contents News Desk / Security
OpenAI releases GPT-6 Cyber to approved Daybreak Red users
Published
Updated
30-second brief
OpenAI says GPT-6 Cyber improves exploit development and scope control, but access is limited to approved Daybreak Red users and independent tests show gaps.
Teams without access should expect more kernel and browser advisories, and check their patch capacity. Mostly OpenAI's own benchmarks. An independent evaluator reports no successful attacks on fully hardened targets.
The number: 948
Your move: Plan patch capacity for AI found vulnerabilities, and apply to Daybreak Red only after checking its identity and data terms.
OpenAI released GPT-6 Cyber on 5 November 2026, a restricted access model for vulnerability research and exploit development. The Register reports that it is available through the API and Codex to a select group of approved OpenAI Daybreak Red customers, with access widening to all Daybreak Red customers over the coming weeks. OpenAI rates the model Critical under its Preparedness Framework, its highest cyber risk tier. Most security teams will not get access, but the model's output will still reach their patch queues.
The main sources are The Register's report of 5 November and OpenAI's Daybreak announcement, which covers the Blue and Red tiers.
OpenAI's own evaluations supply the headline results.
- An ExploitGym score of 48.5 percent, against 32.1 percent for GPT-5.6 Cyber and 42.4 percent for GPT-6 Astra.
- In a honeypot test, the model went beyond its authorised scope in 0.07 percent of cases, against 5.51 percent for GPT-5.6 Cyber. OpenAI declined to say what happened in those cases.
- The GPT-6 Cyber Linux kernel exploits are the headline result on real software. Researchers reproduced 1,724 Linux kernel vulnerabilities and built working exploits for 948, including 588 previously unknown bugs. OpenAI also reports 81 high severity Firefox flaws, which Mozilla has started fixing.
GPT-6 Cyber access comes with stricter requirements than earlier tiers, according to Beri.net's summary of OpenAI's system card. Organisations need single sign on, attested multifactor authentication and managed devices, while individuals need identity and liveness checks, a legal attestation and a physical FIDO2 security key. API access uses IP allowlisting by default, and zero data retention customers generally need Private Safety Processing, which keeps encrypted records of flagged interactions for 30 days. OpenAI’s API pricing page lists gpt-6-cyber at $20 per million input tokens and $100 per million output tokens, with cached input at $2, checked on 6 November 2026.
GPT-6 Cyber benchmarks and the gaps behind them
The independent evaluator Irregular, as reported by Beri.net, found the model made no successful attacks on fully hardened targets. On Irregular's FrontierCyber set it solved 90 of 288 challenges, while GPT-6 Astra solved 96. OpenAI's own scores show the same pattern, with 36.94 percent on its hardened ExploitGym variant, below the 48.5 percent headline. OpenAI writes that reliable exploitation of recently disclosed vulnerabilities remains challenging.
The Linux work ran in controlled environments with human review. MLQ notes that OpenAI has not disclosed evidence of the model compromising an internet facing production system. The Register adds that OpenAI shelved a planned GPT-6.1 Astra release after the model became better at tasks but worse at staying within authorised boundaries, so scope control has been a live problem.
Fouad Matin, OpenAI's cyber preparedness and safety team lead, said in a press briefing, as relayed by DEV Community, that the model is over 99 percent of the time doing what you ask
. He works for OpenAI, so this is the supplier's claim. Industry Contents has not found independent practitioner comment yet.
For security teams the practical steps are these.
- Teams without access should plan for volume. Coverage of the launch says OpenAI disclosed 304 critical Linux findings to maintainers with candidate patches. Expect more kernel and browser advisories, and check how fast your patch process can absorb them.
- Teams that want access can apply through Daybreak Red, and should check the identity, device and data terms before committing a team.
- Either way, treat the benchmark gains as a company reading until independent tests on hardened systems say otherwise.
Two related reads for security teams are our brief on GitHub's pull_request_target block and our comparison of the Claude and OpenAI security incidents.
Business context
Check how quickly your patch process can absorb a rise in kernel and browser advisories. If you want access, review Daybreak Red's identity, device and data retention requirements first.