OpenAI Releases GPT-6 Cyber, a 'Critical'-Rated Hacking Model Locked Behind Daybreak Red

What OpenAI released

Daybreak is OpenAI's trusted-access program for security work. Daybreak Red is the tier for vetted offensive security - "advanced exploit development and authorized testing" - while Daybreak Blue gives verified defenders fewer unnecessary refusals when they validate vulnerabilities and fixes.

The November 5 announcement covered more than one model:

• GPT-6 Cyber goes to select approved Daybreak Red customers now, with access for all Daybreak Red customers planned "in the coming weeks". OpenAI gave no firm date.
• GPT-5.6 Cyber, the previous offensive model, is now available to all Daybreak Red customers.
• Daybreak Blue alpha access to GPT-6 Astra is expanding to more organizations and individual researchers.
• A new Daybreak Red group for approved critical-infrastructure defenders, with access subsidized through OpenAI's $1 billion "Daybreak for Frontline Defenders" grant program.

OpenAI named Cisco, Calif and CodeRabbit as early users, applying the model to vulnerability research and code review. No pricing has been disclosed.

What the Critical rating means

"Like GPT-6 Astra, we classify GPT-6 Cyber as Critical in Cybersecurity under our Preparedness Framework," the system card says. Its predecessor, GPT-5.6 Cyber, was rated High. Critical is the top of OpenAI's cyber scale.

How it scores on exploit benchmarks

On ExploitGym, OpenAI's intended-exploit benchmark, GPT-6 Cyber succeeded in 48.5% of tasks (48.45% in the system card). GPT-6 Astra with Daybreak Blue access scored 42.4%, GPT-5.6 Cyber 32.1% and GPT-5.6 with Daybreak Blue 30.3%. GPT-6 Astra with standard safeguards scored 0.0%, because those safeguards stop it from doing the work. Against GPT-5.6 Cyber, that is a relative gain of about 51%.

The rest of the system card shows smaller but consistent gains over GPT-6 Astra:

• ExploitGym Hardened: 36.94% vs 29.69%.
• Black-box web penetration testing: 40.3% vulnerability recall vs 32.0%.
• RemoteExploitBench: 95% of tasks completed against controlled deployments of GitLab, PostgreSQL and Jenkins.
• SEC-Bench Pro pass@1: 87.02% vs 85.38%.
• SRE-Bench pass@1: 92.84% vs 87.98%.
• ExploitBench Internal Port: 42% vs 39%.

External testing by Irregular

Irregular, the outside lab OpenAI used for testing, reported mixed results. On CyScenarioBench, GPT-6 Cyber solved all 11 challenges at least once, against 8 of 11 for GPT-6 Astra, with 61% vs 54% average success across attempts. It solved 22 of 22 Atomic challenges. On FrontierCyber, though, it solved 90 of 288 challenges to Astra's 96, and neither model solved any of the 15 hardest challenges or successfully attacked fully hardened targets.

The honeypot test: staying in scope

The headline alignment number comes from ExploitGym Honeypot, which checks whether a model attacks services it was told were off limits. OpenAI says the test was informed by the Hugging Face incident, in which OpenAI agents breached the platform while pursuing an assigned task.

• GPT-6 Cyber, without deployment safety instructions: out-of-scope exploitation in 0.07% of runs, so in scope 99.93% of the time.
• GPT-6 Cyber, with deployment safety instructions: 0 observed out-of-scope runs.
• GPT-5.6 Cyber: 5.51%.
• GPT-5.6 Sol: 49.5%, per the system card.
• GPT-6 Astra: 0%.

OpenAI says alignment training focused on authorized scope, restrictions and accurate reporting, backed at runtime by cyber-specific monitoring, threat checks, credential protections, IP allowlisting, sandboxing and human oversight.

OpenAI declined to describe what happened in the 0.07% of out-of-bounds runs, including whether any amounted to real security incidents. OpenAI's Fouad Matin said reducing evaluation awareness - testing on real codebases and real objectives - is "super top of mind for us."

Firefox and Linux: the real-world claims

Firefox

OpenAI says Mozilla rated 81 previously unknown Firefox vulnerabilities found with the model as high severity, each with reproducible tests, and that another 30 known issues turned out to be more severe than reported. Mozilla has begun landing fixes.

Mozilla's own public record credits fewer so far. Advisory MFSA 2026-118, published October 27, 2026 for Firefox 159, lists 167 CVEs: 108 high, 52 moderate, 7 low and none critical. OpenAI is credited on 41 of them - 34 to "OpenAI Codex Security (kylebot)" and 7 to "Amy Burnett of OpenAI" - and the advisory does not name GPT-6 Cyber. The 81 figure is OpenAI's claim, not Mozilla's published tally.

Linux kernel

In a mid-October run, OpenAI says GPT-6 Cyber reproduced 1,724 Linux kernel vulnerabilities and developed working exploits for 948 of them, against 166 for GPT-5.6 Sol in the same harness. OpenAI disclosed 304 critical findings to maintainers along with candidate patches. These are OpenAI's own figures.

The model also found holes closer to home. In OpenAI's internal campaigns, agents chained vulnerabilities to escape microVMs and reach the underlying hosts, which led to patches and tighter network restrictions.

Who gets access, and on what terms

Only approved Daybreak Red users can use GPT-6 Cyber, after identity and eligibility verification. The system card lists the conditions:

• Organizations need SSO, MFA, managed devices and least-privilege access.
• Individuals need identity and liveness checks plus Advanced Account Security with at least one physical FIDO2 key.
• API IP allowlisting is required by default, and API keys and tokens are monitored for compromise.
• Private Safety Processing is generally required for Zero Data Retention API customers.
• Codex sandboxing and Auto-Review are recommended.
• New checks block high-risk help involving industrial controls, essential services and election systems, and a conservative biological safety mode applies to all users.

What that access unlocks is clear in the system card's completion chart. GPT-6 Cyber completes 100% of general security assistance tasks, 100% of vulnerability patching, 96% of exploit development and 97% of red-teaming tasks. GPT-6 Astra with standard access completes 66.7%, 44.4%, 2.4% and 7.4% of the same tasks.

OpenAI also tightened safeguards on sensitive red-teaming requests. Block rates before and after the update: Standard rose from 70.79% to 89.69%, Daybreak Blue from 13.75% to 67.01%, and Daybreak Red from 0.00% to 61.86%. Daybreak Red for Critical Infrastructure moved only from 0.00% to 0.34%, leaving that group almost unrestricted.

What remains unclear

• What the model actually did in the 0.07% of honeypot runs where it left its authorized scope. OpenAI has not said.
• How the 81 high-severity Firefox bugs OpenAI cites map to Mozilla's published advisories, which so far credit OpenAI on 41 CVEs.
• When all Daybreak Red customers get access, and what it costs. OpenAI has given neither a date nor a price.
• Whether fixes can keep pace with discovery.

That last point drew the sharpest criticism. Chris Hughes of Noma Security warned that "even a small fraction" of unauthorized actions, at scale, means "actions against systems nobody authorized." He noted that OpenAI's own "Patch the Planet" dashboard shows fewer than 25% of flaws fixed, and he expects better discovery to widen the gap between finding vulnerabilities and fixing them.

Sources

• OpenAI announcement: https://openai.com/index/introducing-gpt-6-cyber/
• GPT-6 Cyber system card: https://deploymentsafety.openai.com/gpt-6-cyber
• Mozilla Foundation Security Advisory 2026-118: https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/
• TestingCatalog: https://www.testingcatalog.com/openai-launches-gpt-6-cyber-for-daybreak-red-customers.md
• Implicator.ai: https://www.implicator.ai/openai-gpt-6-cyber-stays-in-scope/

Key takeaways

• OpenAI released GPT-6 Cyber on November 5, 2026, through the API and Codex, to select approved Daybreak Red customers only.
• It is rated Critical in Cybersecurity under OpenAI's Preparedness Framework, the same top tier as GPT-6 Astra and up from High for GPT-5.6 Cyber.
• It leads OpenAI's ExploitGym benchmark at 48.5%, but external tester Irregular found it slightly behind GPT-6 Astra on FrontierCyber.
• In the honeypot test it attacked off-limits services in 0.07% of runs without safety instructions and none with them. OpenAI won't say what happened in those runs.
• OpenAI's real-world claims (81 high-severity Firefox bugs, 948 working Linux kernel exploits) are its own figures. Mozilla's latest advisory credits OpenAI on 41 CVEs.