GPT-6 Cyber: OpenAI Built an AI That Hacks — So Defenders Can Patch First

OpenAI's newest model doesn't write poems or summarize your inbox. It finds software vulnerabilities, builds working exploits for them, and drafts the patches. It's called GPT-6 Cyber, it launched on November 5, 2026, and before the announcement was even public, it had already found 81 previously unknown flaws in Firefox and developed working exploits for 948 Linux kernel vulnerabilities.

The catch is the point: you almost certainly can't use it. GPT-6 Cyber is available only to vetted security professionals inside OpenAI's Daybreak Red program. This is the most capable offensive-security model OpenAI has ever shipped — and its most tightly gated one.

A Variant of Astra, Tuned for Offense

GPT-6 Cyber is built on GPT-6 Astra, OpenAI's flagship model, with extra post-training aimed at three jobs: finding vulnerabilities in code, developing working exploits that prove a flaw is real, and drafting fixes. It supports a 1,050,000-token context window, so it can hold large codebases in memory while it works.

OpenAI rates it "Critical" for cybersecurity under its Preparedness Framework — the highest rating on the scale, up from "High" for its predecessor, GPT-5.6 Cyber. That rating is a measure of dual-use risk: a model this good at finding flaws is also a model that could be misused to exploit them.

The Numbers Behind the Launch

The benchmark jumps are large, and they explain why this launch made news beyond the security press:

• ExploitGym: 48.5%, up from 32.1% for GPT-5.6 Cyber — a 51% relative improvement.
• Offensive web pentesting: 40.3% recall of vulnerabilities probed without source-code access, versus 32.0% for GPT-6 Astra.
• RemoteExploitBench: 95% completion. On a benchmark built around known flaws in GitLab, PostgreSQL, and Jenkins, GPT-6 Astra under the permissive Daybreak Blue program refused 100% of tasks. GPT-6 Cyber completed 95%.

The last comparison is the telling one. The gap between Cyber and Astra isn't raw intelligence — it's permission. Astra is trained to refuse exploit work; Cyber is trained to do it, inside an authorized scope.

What It Has Already Found

• 948 Linux kernel exploits. GPT-6 Cyber reproduced 1,724 known kernel vulnerabilities and developed working local privilege-escalation exploits for 948 of them — more than five times the 166 exploited by GPT-5.6 Sol on the same harness. OpenAI disclosed 304 critical findings to Linux maintainers with candidate patches.
• 81 new Firefox vulnerabilities. The model produced evidence and reproducible tests for 81 previously unknown flaws Mozilla classified as high severity, and showed 30 known issues were worse than previously reported. Mozilla has begun landing fixes.
• A critical Brotli flaw. GPT-6 Cyber helped validate exploits for a critical vulnerability in Brotli, the compression library used by Node.js and other software (CVE-2026-111497, CVSS 9.2), showing it could enable remote code execution downstream.

All of these are OpenAI's own reported results — nothing has been independently reproduced yet. But the pattern is consistent: the model produces working proof, which is what turns a suspected flaw into a patch.

The Hard Part: Staying in Bounds

The obvious danger of a model that builds exploits is that it wanders outside its assignment. OpenAI made alignment a central focus of the training. In a test called ExploitGym Honeypot — where the model is given a hard task alongside deliberately easy-to-hack supporting services that are out of scope — GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without its deployment safety prompt, and 100% with it, up from 94.49% for GPT-5.6 Cyber.

OpenAI has paired the model with misuse monitoring, IP allowlisting for Daybreak Red API access, and blocks against high-risk assistance involving critical infrastructure, industrial control systems, and election systems. The safeguards were refined with input from Dragos, the operational-technology security firm.

Pricing and Access

GPT-6 Cyber is not a ChatGPT feature and there is no public signup. Access runs through Daybreak Red, OpenAI's gated program for authorized offensive security work — penetration testing, exploit development, red-teaming — with identity checks, single sign-on, multi-factor authentication, and API IP allowlisting. Access is initially limited to a select group of approved customers, expanding to all approved members over the coming weeks.

Pricing is premium-tier: $20 per million input tokens, $100 per million output tokens, $2 per million cached input tokens. For teams that can't afford it, OpenAI's $1 billion Daybreak for Frontline Defenders program subsidizes access for resource-constrained defenders, and a new Daybreak Red for Critical Infrastructure group gives approved defenders permission to test critical systems.

Why It Matters

Most developers will never touch GPT-6 Cyber, but its work will reach them anyway. Every Firefox flaw it found is a flaw that would otherwise have sat in a browser used by hundreds of millions of people. Every Linux kernel exploit it developed is a privilege-escalation path in the OS that runs most of the world's servers and Android phones.

The open question is whether OpenAI can widen the gate fast enough. The company says access will expand to all approved Daybreak Red customers soon — but attackers are closing the same gap with open-weight models that have no gate at all.

This is a condensed explainer. The full breakdown — including the complete benchmark comparison, the pros and cons, and who each tier is for — is on NeurAITool: GPT-6 Cyber: OpenAI's AI That Hacks to Defend (2026).