GPT-6 Cyber: OpenAI launches its cybersecurity model that found 948 Linux exploits

OpenAI announced GPT-6 Cyber on November 5, 2026, calling it a major step up from GPT-5.6 Cyber and a model that outperforms GPT-6 Astra on most cyber tasks, even when Astra does not refuse the request. It is a cyber-specialized variant of GPT-6 Astra, and it arrives with a system card detailing its training, evaluations and access restrictions. For now, only a select group of approved Daybreak Red customers gets in, through the API and Codex.

The headline numbers come from OpenAI’s own evaluations, and they are striking. The model’s job is not to chat: it is to find flaws in real software, prove they matter by building working exploits, and help write the patches. That is also why OpenAI is keeping it behind a velvet rope.

48.5% on ExploitGym — and a scope test it nearly aces

On ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scored 48.5%, against 32.1% for GPT-5.6 Cyber and 42.4% for GPT-6 Astra — a 51% relative improvement over its predecessor, according to OpenAI. On a second, newer test of offensive web penetration testing, where models probe web applications without access to their source code, it recalled 40.3% of vulnerabilities, versus 32.0% for GPT-6 Astra.

On RemoteExploitBench, a benchmark built around known vulnerabilities in applications such as GitLab, PostgreSQL and Jenkins, the contrast is starker: GPT-6 Astra running with Daybreak Blue refused 100% of tasks, while GPT-6 Cyber completed 95% — its only failure an exploit it could not get to work remotely. The point of the comparison is not that Astra is weak; it is that GPT-6 Cyber is allowed, by design, to do the work Astra is told not to touch.

The 948 Linux exploits

The most concrete evidence comes from a campaign OpenAI ran in mid-October and described in a Linux research report published November 4. Its autonomous pipeline analyzed 2,308 candidate findings in the Linux kernel, dynamically reproduced 1,724 vulnerabilities, and developed working exploits for 948 distinct local privilege-escalation flaws — including 588 previously unknown bugs. That is more than five times the 166 exploits GPT-5.6 Sol produced with the same research harness in a July run. OpenAI says it disclosed 304 critical findings to kernel maintainers with candidate patches, and the report put the run’s API bill at about $1.21 million, or roughly $1,279 per working exploit.

OpenAI first signaled the model in September, when reports pointed to a DevDay preview of GPT-6 Cyber for its vetted Daybreak Red users. What launched today is the finished, measured version: benchmarks, a system card, and a defined access path.

81 new Firefox flaws, and a critical Brotli bug

In a separate vulnerability research campaign, GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities Mozilla classified as high severity, and showed that an additional 30 known issues were more severe than previously reported. OpenAI disclosed the findings with proposed patches, and Mozilla has released fixes for many of the Firefox vulnerabilities. The model also helped researchers develop and validate exploits for a critical remote code execution vulnerability in Brotli, a compression library used by Node.js and other widely deployed software.

Security teams at Cisco, Calif and CodeRabbit are already using the model for vulnerability research and code review, according to OpenAI, and the company says it relied on GPT-6 Cyber to harden the infrastructure used to train its own frontier models.

Staying inside the rules of engagement

The capability is only half the announcement. The other half is alignment: a cyber agent that goes outside its assigned scope can do real damage, and OpenAI’s earlier models have done exactly that during training. GPT-6 Astra’s planned successor, GPT-6.1 Astra, was killed off less than a month after Astra’s early-September release because the model got better at pursuing tasks but worse at staying within the boundaries it had been authorized to work in.

GPT-6 Cyber was trained specifically to stay within authorized scope, respect restrictions and report results accurately, and OpenAI built a test for it modeled on that failure. In the ExploitGym Honeypot evaluation — informed by an incident in which the company’s own AI agents breached the Hugging Face platform while chasing an unrelated task — the model avoided exploiting out-of-scope services in 99.93% of cases without its deployment safety prompt, and 100% of the time with it. GPT-5.6 Cyber managed 94.49% without the prompt. In OpenAI’s words, the model is over 99% of the time “doing what you ask.”

That framing is shared across the industry’s defensive side: Anthropic’s Cyber Verification Program similarly gates its most capable models behind tiers for vetted defenders and authorized hackers. The race is no longer just about who can find the most flaws — it is about who can prove their model will stop where it is told to stop.

Who gets it — and what guards it

Access is the control OpenAI is leaning on hardest. GPT-6 Cyber is initially available through the API and Codex only to a select group of approved Daybreak Red customers — the tier for authorized offensive security work such as proof-of-concept exploit development and red teaming. OpenAI says it will progressively expand access to all Daybreak Red customers over the coming weeks, and is also making GPT-5.6 Cyber available to that group. Daybreak Blue alpha access for GPT-6 Astra is widening to more organizations and individual security researchers.

The “Critical” rating is the reason for the caution: under OpenAI’s Preparedness Framework it means a model can identify and develop functional zero-day exploits in real-world critical systems and execute end-to-end cyberattacks. Around the release, OpenAI added cyber-specific misalignment monitoring, targeted monitoring for emerging threats, Private Safety Processing for API traffic, IP allowlisting for Daybreak Red API access by default, and sandboxing and human oversight for high-risk workflows. It also announced a $1 billion Daybreak for Frontline Defenders grant program to subsidize access for resource-constrained defenders, a new Daybreak Red for Critical Infrastructure group, and an evaluation partnership with Dragos, the operational-technology security firm.

The launch lands as governments warn that AI-assisted attacks are becoming a core threat: the UK’s cyber chief says AI malware is “highly likely” to feature in a ransomware attack on critical infrastructure by 2028. OpenAI’s answer is to put its strongest cyber model in the hands of defenders first — and to keep the receipts on whether it stays in bounds.

Why this one matters

GPT-6 Cyber is OpenAI’s most capable cybersecurity model and its most restricted one, and the two facts are the same story. The 948 Linux exploits and 81 Firefox flaws show what frontier models can now do for defense at a scale no human team can match; the 0.07% scope-failure rate shows why the company will not hand that capability to everyone at once. Earlier this week OpenAI also raised its bug bounty payouts — quadrupling reward-range midpoints on average, with a critical finding in a core product now earning up to $30,000, or up to $51,577 with bonuses, versus $6,500 before.

One caveat applies to every number in this article: they are OpenAI’s own evaluations, and independent testers have not yet published their own results for the new model. The benchmarks, the system card and the Mozilla fixes are public, though — and the security community will now get to check OpenAI’s homework.