OpenAI's GPT-6 Cyber finds software flaws, and only approved defenders can use it
On 5 November 2026, OpenAI announced GPT-6 Cyber, a model trained to find and prove exploitable software flaws while staying within the scope researchers set. OpenAI says it scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber. Access starts with a select group of approved Daybreak Red customers, through the API and Codex.
The short version
- 01GPT-6 Cyber scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, in OpenAI's own tests.
- 02OpenAI built working exploits for 948 Linux kernel flaws and found 81 new Firefox flaws that Mozilla rates high severity.
- 03OpenAI now rates the model Critical for cybersecurity under its Preparedness Framework, up from High.
- 04Only a select group of approved Daybreak Red customers can use it at first, with wider access promised soon.
- 05OpenAI pairs it with misuse monitoring and a $1 billion grant program for small defenders.
At a glance
| Status | Confirmed (OpenAI's own announcement) |
|---|---|
| Published | 5 November 2026 |
| Company | OpenAI |
| Model | GPT-6 Cyber |
| ExploitGym score | 48.5%, up from 32.1% for GPT-5.6 Cyber |
| Linux exploits | 948 working exploits from 1,724 reproduced flaws |
| Firefox | 81 new high-severity flaws, as classed by Mozilla |
| Access | Select approved Daybreak Red customers, API and Codex |
What is GPT-6 Cyber?
GPT-6 Cyber is an OpenAI model for security research. OpenAI describes it as trained to find and validate exploitable vulnerabilities while staying within the scope that researchers set.
OpenAI says it is a major step up from GPT-5.6 Cyber and beats GPT-6 Astra on most cyber tasks, even when Astra does not refuse the request.
How good is GPT-6 Cyber at finding flaws?
On ExploitGym, which tests whether a model can exploit a specified vulnerability, OpenAI says GPT-6 Cyber scores 48.5%, up from 32.1% for GPT-5.6 Cyber.
On a new web penetration test, it found 40.3% of vulnerabilities, against 32.0% for GPT-6 Astra. These are OpenAI's own evaluations, and the company classes the model Critical in cybersecurity under its Preparedness Framework, up from High.
What has it already found?
OpenAI says its researchers used GPT-6 Cyber to develop working exploits for 948 Linux kernel vulnerabilities. It reproduced 1,724 flaws in all, and the older GPT-5.6 Sol managed 166 with the same research harness. OpenAI disclosed 304 critical findings to the Linux maintainers with candidate patches.
It also produced evidence and reproducible tests for 81 new Firefox vulnerabilities that Mozilla classes as high severity. Mozilla has released fixes for many of them.
GPT‑6 Cyber uncovered previously unknown high-severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users.
Brian Grinstead, Distinguished Engineer, Firefox, in OpenAI's post
Who can use GPT-6 Cyber?
GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. Daybreak is OpenAI's program for security defenders.
OpenAI says it will progressively expand access to all Daybreak Red customers soon, and it is making GPT-5.6 Cyber available to all of them now. It is also widening Daybreak Blue alpha access for GPT-6 Astra.
What safeguards come with it?
OpenAI says it tested whether the model stays inside its task. In one test, without safety prompts, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of cases, and 100% with them.
Other protections include monitoring for misuse, IP allowlisting for Daybreak Red API access by default, and new checks that block high-risk help against critical systems. OpenAI also points to a $1 billion Daybreak for Frontline Defenders grant program for small teams such as government bodies and essential service providers.
Why does it matter?
AI that can find and prove software flaws at scale means more bugs get found and fixed, and OpenAI also says attackers are trying to misuse such models.
For most people the practical step is the usual one: install updates to your phone, computer and browser when they arrive.
What's next?
OpenAI says wider Daybreak Red access is coming soon. It published a system card with the full safety results. It gave no date for access beyond approved customers.
Questions people ask
Can I use GPT-6 Cyber in ChatGPT?
OpenAI says it is initially available through the API and Codex to a select group of approved Daybreak Red customers. The post does not announce ChatGPT access.
What is Daybreak Red?
It is OpenAI's access level for deeper exploit development and authorized security testing with GPT-6 Cyber. Daybreak Blue helps verified defenders validate vulnerabilities and fixes.
How much better is it than GPT-5.6 Cyber?
OpenAI says 48.5% on ExploitGym against 32.1%. These are OpenAI's own results.
Did it really find Firefox flaws?
OpenAI says it produced evidence for 81 new vulnerabilities that Mozilla classes as high severity, and Mozilla has released fixes for many of them.
What does OpenAI's Critical rating mean?
OpenAI says that under its Preparedness Framework it now classes the model Critical in cybersecurity, up from High for GPT-5.6 Cyber.
Sources
Why "Confirmed"? We label a story "Confirmed" when the company or government announced it itself. Spotted an error? Email hello@openloopnews.com and we will correct it.
