Summary
OpenAI says its GPT-6 Cyber model improved on cybersecurity benchmarks and helped identify vulnerabilities in Linux and Firefox. Initial access is limited to approved Daybreak Red customers.
OpenAI introduced GPT-6 Cyber on November 5, 2026, for vulnerability research and authorised security testing. The company says the model performed better than its predecessor on exploit benchmarks, stayed within assigned test boundaries more reliably, and helped researchers find flaws in Linux and Firefox. Initial access is through the API and Codex for a select group of approved Daybreak Red customers.
Benchmark gains and scope controls
On ExploitGym, a test of whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scored 48.5%. GPT-5.6 Cyber scored 32.1%, making the newer model’s result about 16 percentage points higher. In a separate web penetration-testing evaluation, where models probed applications without access to their source code, GPT-6 Cyber achieved 40.3% recall of vulnerabilities, compared with 32.0% for GPT-6 Astra.
OpenAI also tested whether the model would stay within the authorised scope of a task. In its ExploitGym Honeypot evaluation, a model works in an isolated environment with supporting services that are deliberately easy to exploit, but outside the assigned task. GPT-6 Cyber avoided attacking those out-of-scope services in 99.93% of tests without a deployment safety prompt, and in 100% with the prompt. GPT-5.6 Cyber’s result without the prompt was 94.49%. These figures describe performance on OpenAI’s specific evaluation.
The added capability brings a higher internal risk classification: OpenAI rates GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. The company says the model is intended for advanced workflows such as developing exploits and testing them against remote targets, making limits on authorisation and scope central to how it is offered.
Reported findings in Linux and Firefox
OpenAI says its researchers reproduced 1,724 Linux kernel vulnerabilities and developed working exploits for 948 using GPT-6 Cyber and the same research harness. For comparison, GPT-5.6 Sol produced 166 exploits in that harness. OpenAI says it disclosed 304 critical findings to Linux maintainers with candidate patches; work to address other vulnerabilities is ongoing.
In Firefox, the company reports that the model helped produce evidence and reproducible tests for 81 previously unknown vulnerabilities that Mozilla classified as high severity. It also found that 30 known issues were more severe than previously reported. OpenAI says it sent Mozilla the findings and proposed patches, and that Mozilla has released fixes for many of the vulnerabilities.
These reports distinguish vulnerability discovery from fixing: researchers supplied maintainers with findings and candidate patches, while maintainers handled the software changes. OpenAI says it is also using monitoring, access controls and other safeguards alongside GPT-6 Cyber. It plans to expand access to all Daybreak Red customers, but has not given a date for that expansion.