OpenAI launches GPT-6 Cyber, a Critical-rated model for scoped vulnerability research

OpenAI on 5 November 2026 introduced GPT-6 Cyber, a restricted cybersecurity model for finding and validating exploitable vulnerabilities while staying inside the scope researchers set. OpenAI rates it Critical under its Preparedness Framework, up from High for GPT-5.6 Cyber, and says it is initially available through the API and Codex to a select group of approved Daybreak Red customers, with a wider Daybreak Red rollout planned soon.

On ExploitGym, which tests whether a model can exploit a specified vulnerability, OpenAI reports GPT-6 Cyber at 48.5%, up from 32.1% for GPT-5.6 Cyber. In an alignment check modeled on the Hugging Face incident, OpenAI says the model avoided out-of-scope services in 99.93% of tests without its deployment prompt, and 100% with that prompt. OpenAI also says researchers used it to develop working exploits for 948 Linux privilege-escalation cases and to identify 81 previously unknown high-severity Firefox vulnerabilities that Mozilla has begun fixing.

The Verge frames the launch around that scope discipline and the Critical rating. TechCrunch puts the model inside Daybreak Red and notes OpenAI's broader push to put cyber tools in the hands of authorized defenders, including a large Daybreak for Frontline Defenders grant program. CSO Online repeats the Linux and Firefox figures and the access limits.

Key facts

• Primary: OpenAI announcement, 5 November 2026
• Independent: The Verge, TechCrunch, and CSO Online, 5 November 2026
• Rating: Critical in cybersecurity on OpenAI's Preparedness Framework (vendor rating)
• Benchmark claim: 48.5% on ExploitGym vs 32.1% for GPT-5.6 Cyber (OpenAI figures)
• Scope claim: 99.93% / 100% in-bounds on ExploitGym Honeypot with and without the deployment prompt
• Real-world claims: 948 Linux privilege-escalation exploits developed; 81 novel high-severity Firefox findings with Mozilla fixes underway
• Access: select Daybreak Red customers first; expanding to all Daybreak Red customers soon; GPT-5.6 Cyber opened to that set as well

How to read it

This is a gated model release, not a ChatGPT free-tier update. The capability claims, the Critical rating, and the Linux and Firefox counts all come from OpenAI. Independent outlets confirmed the announcement and the access model, but they did not re-run the benchmarks. The concrete product change is that authorized Daybreak Red teams get a cyber-specialized GPT-6 tier that OpenAI says is stronger at exploit work and tighter about staying on the assigned target. Whether that combination holds up outside OpenAI's own harnesses is still an open question for outside labs.

Independence

Frontier Flux is not affiliated with OpenAI, Mozilla, The Verge, TechCrunch, or CSO Online. Benchmark scores, vulnerability counts, and the Critical rating are OpenAI's claims and have not been independently verified by Frontier Flux.