OpenAI introduced GPT-6 Cyber on November 5, 2026, giving the cyber-specialized model a Critical cybersecurity capability rating under its Preparedness Framework. The company says it improves vulnerability discovery, exploit development and authorized security testing, including work that uncovered 81 previously unknown high-severity Firefox vulnerabilities. Those are OpenAI’s reported findings. The announcement also connects the model to previously disclosed Linux exploit research.
The immediate access distinction matters: this is not a general ChatGPT or open API rollout. GPT-6 Cyber sits behind Daybreak Red, OpenAI’s access tier for advanced, authorized security work. Customers need Daybreak Red approval, separate approval for GPT-6 Cyber, and organizational controls covering identity, authentication and API access.
For security teams, the release creates two questions: what additional work can the model perform, and what must an organization have in place to use it? OpenAI’s published benchmarks address the first. Its system card and Daybreak documentation provide the more consequential details for the second.
Daybreak Red Is the Access Gate
OpenAI’s Daybreak access documentation separates general model use, Daybreak Blue and Daybreak Red. These are access and safeguard arrangements, not interchangeable names for the same product.
| Access level | What it provides | GPT-6 Cyber access |
|---|---|---|
| Standard mainline model use | General-purpose models with standard safeguards, including support for code review, threat modeling and patching | No |
| Daybreak Blue | Reduced refusals on supported mainline models for approved defensive security work | No |
| Daybreak Red | Advanced authorized workflows, including exploit development, penetration testing and controlled vulnerability research | Requires separate GPT-6 Cyber approval |
Daybreak Red membership alone does not automatically unlock GPT-6 Cyber. OpenAI’s documentation explicitly lists additional model approval. It also says approval alone does not activate reduced-refusal behavior: Daybreak must be enabled through the applicable workspace or API project controls.
The GPT-6 Cyber system card lists these access requirements:
- Identity verification and restrictions on permitted use.
- Single sign-on, or SSO, for organizational authentication.
- Multi-factor authentication, or MFA.
- API IP allowlisting, which limits API access to approved network addresses.
- Automated safety review, with Private Safety Processing generally required for API customers using Zero Data Retention.
That last condition deserves attention. A Zero Data Retention arrangement should not be read as an exemption from safety review. OpenAI describes a separate processing requirement for that situation; teams need to account for both their data-handling obligations and the model’s access conditions.
Daybreak also has a firm boundary around downstream use. The help center states:
Do not enable Daybreak for customer-facing applications, downstream product traffic, or third-party access.
An organization approved to conduct its own security work therefore cannot assume it may expose that access through a public application or pass it along to customers.
I’d treat these requirements as deployment prerequisites, not account settings to sort out after choosing the model. SSO, network allowlists, project configuration and safety processing can require coordination across a security team, an identity administrator and whoever manages the API organization.
OpenAI says its broader goal is to expand Daybreak to organizations of every size, independent researchers and open-source maintainers. That ambition should be kept separate from current eligibility: GPT-6 Cyber remains a separately approved Daybreak Red model.
What GPT-6 Cyber Is Trained to Do
GPT-6 Cyber is a specialized variant of GPT-6 Astra, according to its system card. Its additional training targets work such as:
- Finding vulnerabilities in codebases.
- Reproducing crashes.
- Developing working exploits.
- Performing authorized web penetration tests.
- Helping produce and validate fixes.
OpenAI says it uses reinforcement learning on these tasks, training the model to try different approaches, recognize mistakes and refine its work. Separate training signals aim to reduce refusals on authorized cybersecurity requests while reinforcing scope restrictions and accurate reporting.
Those are two distinct changes. One concerns whether the model can solve a difficult security problem. The other concerns whether it will proceed with a legitimate request involving techniques that general-purpose AI models may decline.
The distinction is important for exploit development. A security researcher may need to demonstrate that a vulnerability is genuinely exploitable before a maintainer can assess its impact or verify a patch. That work can involve actions resembling an attack, even when it happens inside a controlled, authorized environment. Daybreak Red is designed to permit more of that workflow while retaining restrictions on targets and use.
What the Published Benchmarks Actually Show
OpenAI reports improvements across exploitation, web vulnerability discovery and remote exploit execution. Its launch announcement provides several comparisons, but they measure different things.
| Evaluation | Task being measured | GPT-6 Cyber | Published comparison |
|---|---|---|---|
| ExploitGym | Exploit a specified vulnerability in a remote target | 48.5% | GPT-5.6 Cyber: 32.1% |
| Offensive web penetration testing | Discover vulnerabilities by probing web applications without source code | 40.3% recall | GPT-6 Astra: 32.0% recall |
| RemoteExploitBench | Develop and use exploits against known vulnerabilities in controlled remote applications | 95% completed | GPT-6 Astra with Daybreak Blue refused 100% of tasks |
| ExploitGym Honeypot, without deployment safety prompts | Avoid exploiting out-of-scope supporting services | 99.93% | GPT-5.6 Cyber: 94.49% |
| ExploitGym Honeypot, with deployment safety prompts | Stay within authorized scope in the tested setup | 100% | No corresponding comparison supplied in the announcement |
These are OpenAI’s measurements, not independent benchmark results. They apply to the reported tasks, configurations and safeguards. The system card also warns that evaluation methods change over time, so older scores outside its current comparisons should not automatically be treated as directly comparable.
The ExploitGym gain is 16.4 percentage points
The move from 32.1% to 48.5% is an increase of 16.4 percentage points, or approximately 51% relative to the earlier score. Both descriptions are mathematically consistent, but they communicate different things.
The relative figure captures the size of the improvement over GPT-5.6 Cyber. The absolute score shows the remaining difficulty: GPT-6 Cyber still succeeds on fewer than half of the tasks in this particular evaluation. That is useful context for teams planning to rely on it for difficult exploit work.
The web penetration-testing result measures another skill. OpenAI reports 40.3% vulnerability recall for GPT-6 Cyber against 32.0% for GPT-6 Astra, an 8.3-percentage-point increase. Here, the model probes applications without access to their source code. This tests discovery from an application’s exposed behavior, unlike an evaluation that starts with a specified vulnerability.
The remote-exploit result mixes permission and capability
RemoteExploitBench uses known vulnerabilities in applications such as GitLab, PostgreSQL and Jenkins deployed in a controlled environment. OpenAI says GPT-6 Cyber completed 95% of tasks; its single reported failure involved an exploit it could not make work remotely.
GPT-6 Astra running with Daybreak Blue refused every task in the initial evaluation.
My reading is that this comparison is especially useful for understanding the access-tier distinction, but less useful as a clean measure of underlying model skill. A refusal is different from an unsuccessful technical attempt. The result shows that GPT-6 Cyber could complete most of these tasks under its permitted workflow, while the compared Astra configuration would not attempt them.
OpenAI separately says GPT-6 Cyber outperforms Astra on most cyber tasks even when Astra does not refuse. Keeping those two claims separate prevents a permissions difference from being mistaken for a pure capability measurement.
Why OpenAI Classifies It as Critical
OpenAI says its evaluations of software understanding, vulnerability discovery and working exploit development support a Critical cybersecurity classification, up from the High rating assigned to GPT-5.6 Cyber. The system card also states that GPT-6 Cyber has the same cybersecurity capability designation as GPT-6 Astra.
That second detail changes how the headline should be read. GPT-6 Cyber is more specialized, and OpenAI reports stronger performance on most cyber tasks, but the Critical designation is not unique to this model within the GPT-6 family.
Frequently Asked Questions
4 questions
1Can ordinary ChatGPT users access GPT-6 Cyber?
GPT-6 Cyber is restricted to Daybreak Red and requires separate model approval. A normal ChatGPT subscription or standard API account does not provide access.
