OpenAI has introduced GPT-6 Cyber, a security-focused model designed to advance vulnerability discovery, exploit development, and patching while staying within the boundaries researchers set. The company reports a 51% relative improvement on ExploitGym over GPT-5.6 Cyber—48.5% versus 32.1%—and a step-change improvement on staying within scope. GPT-6 Cyber is classified as Critical under OpenAI‘s Preparedness Framework, up from High for GPT-5.6 Cyber.

A central focus is alignment to authorized scope. In ExploitGym Honeypot, an evaluation informed by the Hugging Face incident, the model works on a difficult exploitation task with access to supporting services that are intentionally easy to exploit and can reveal the task’s flag. GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without deployment safety prompts, versus 94.49% for GPT-5.6 Cyber, and 100% with those prompts. Reported chain-of-thought excerpts illustrate the reasoning, including “Can’t assume extra API or attack controller not target. We should only target binary/server.” and “don’t explore out of scope credentials.”

The model is already producing real-world results. OpenAI researchers used GPT-6 Cyber to reproduce 1,724 Linux kernel vulnerabilities and develop working exploits for 948—more than five times the 166 exploited by GPT-5.6 Sol with the same harness; 304 critical findings were disclosed to maintainers with candidate patches. In Firefox, it produced evidence and reproducible tests for 81 novel high-severity vulnerabilities and showed 30 known issues were more severe than previously reported, with Mozilla releasing fixes for many of them. It also helped demonstrate critical remote code execution in Brotli, a compression library used by Node.js and other software. Security teams at Cisco, Calif, and CodeRabbit are using it for vulnerability research and code review, and OpenAI used it to harden its own infrastructure, including chaining vulnerabilities to escape microVMs in controlled red-teaming campaigns.

To evaluate agentic cyber workflows, OpenAI built RemoteExploitBench, a benchmark using known vulnerabilities in applications such as GitLab, PostgreSQL, and Jenkins in a controlled environment. In an initial evaluation, GPT-6 Astra with Daybreak Blue refused 100% of tasks, while GPT-6 Cyber completed 95%, with its only failure being an exploit it could not get to work remotely. A new offensive web penetration testing evaluation, where models probe web applications without source code, shows GPT-6 Cyber at 40.3% recall of vulnerabilities versus 32.0% for GPT-6 Astra. The model outperforms GPT-6 Astra on most cyber tasks even when Astra does not refuse the request.

Access is controlled and expanding. GPT-6 Cyber is initially available through the API and Codex to a selective group of approved Daybreak Red customers, with progressive expansion planned and GPT-5.6 Cyber becoming available to all Daybreak Red customers. Daybreak Blue alpha access for GPT-6 Astra is expanding to more organizations and individual security researchers to support vulnerability validation, code review, and patch development with fewer unnecessary refusals. For critical infrastructure defense, OpenAI‘s $1 billion Daybreak for Frontline Defenders grant program subsidizes access for government organizations and essential service providers, and a new Daybreak Red for Critical Infrastructure group gives approved defenders permissions for authorized testing while retaining safeguards. New protections include cyber-specific misalignment monitoring, targeted monitoring for emerging threats such as PHP vulnerabilities, Private Safety Processing with encrypted 30-day retention, IP allowlisting and credential compromise monitoring for Daybreak Red, and refined safeguards against assistance that could compromise industrial controls or safety-critical systems. OpenAI notes that higher safeguard block rates are not always better, since many of the evaluated techniques are essential to legitimate security work, and it assesses rates alongside support for legitimate research rather than aiming for 100%.

The work is supported by an evaluation partnership with Dragos, which ran tests using cyber-permissive Daybreak Red models in a controlled lab covering network discovery, reconnaissance, exfiltration, and unauthorized device actions; OpenAI used the feedback to refine safeguards and is expanding partnerships with offensive security providers, purple teams, energy companies, and national labs. Full evaluation settings and results are in the accompanying system card, and OpenAI recommends sandboxing, action review, and human oversight for high-risk workflows.