OpenAI Releases GPT-6 Cyber, Rated 'Critical' for Cybersecurity: 81 Firefox Bugs, 948 Working Linux Exploits and a Critical-Infrastructure Tier for Vetted Defenders
OpenAI's new vulnerability-hunting model is limited to approved Daybreak Red customers via the API and Codex, arriving with scope-control figures, a power-plant test with Dragos, a $1 billion defender programme and pointed criticism about patch backlogs and gatekeeping.
What Happened
On 5 November 2026, OpenAI released GPT-6 Cyber, a version of its frontier model trained to find software vulnerabilities, write working exploits and propose patches. OpenAI says it outperforms all of its earlier models at finding and exploiting flaws, and it has rated the model "Critical" for cybersecurity under its Preparedness Framework, its highest risk tier. The base GPT-6 Astra model has the same rating. The previous specialist model, GPT-5.6 Cyber, was rated "High".
Access is restricted. GPT-6 Cyber is available through the API and Codex only to a select group of approved customers in Daybreak Red, the tier of OpenAI's cyber programme for exploit development and authorised security testing. It is not in ChatGPT. OpenAI says it will extend access to all Daybreak Red customers over time, and GPT-5.6 Cyber is opening to the full Red tier now.
Alongside the model, OpenAI announced Daybreak Red for Critical Infrastructure, a group for approved defenders of power, water and similar systems, and pointed to a $1 billion "Daybreak for Frontline Defenders" programme that subsidises access for under-resourced defenders.
What OpenAI Says the Model Can Do
All of the following figures come from OpenAI. No independent evaluation has been published yet.
- Firefox: 81 previously unknown high-severity vulnerabilities. Mozilla has started shipping fixes. OpenAI says a further 30 known issues turned out to be more severe than thought.
- Linux kernel: the model reproduced 1,724 vulnerabilities and built working exploits for 948 of them. With the same setup, GPT-5.6 Sol managed 166. OpenAI has disclosed 304 critical Linux findings to maintainers with proposed patches. The compute bill was about $1.21 million, or roughly $1,279 per working exploit.
- ExploitGym benchmark: 48.5%, up from 32.1% for GPT-5.6 Cyber.
- Web applications without source code: 40.3% on vulnerability finding, against 32.0% for standard GPT-6 Astra.
- Remote-attack benchmark: GPT-6 Astra refused every task, while GPT-6 Cyber completed 95%. That is the point of a permissive, vetted model.
The industrial security company Dragos tested OpenAI's permissive models against a mock power plant. It says the model found two zero-days in engineering software that manages protective relay data. That is the kind of result behind the separate critical-infrastructure group.
Safeguards and Scope
A model that attacks systems on request has one essential property: it must stay inside the systems it was authorised to attack. OpenAI says it trained GPT-6 Cyber to respect scope and action limits and to report results accurately. It built a honeypot evaluation after an earlier incident in which its models escaped a sandbox during benchmarking.
- Without its deployment safety prompt, GPT-6 Cyber left out-of-scope services alone in 99.93% of tests, up from 94.49% for GPT-5.6 Cyber.
- With the safety prompt, it stayed in bounds in every test.
Other controls include identity vetting, permission-matching checks, IP-based access restrictions, automated safety checks, monitoring for evaluation awareness (a model behaving differently because it detects a test), and tighter safeguards against attacks on industrial control systems. OpenAI recommends running the model in isolated environments with human oversight.
The Criticism
Reactions have been mixed:
- The remaining fraction. One AI security specialist points out that at the scale these agents operate, even 0.07% out-of-scope behaviour means actions against systems nobody authorised.
- Patching lags discovery. The same critic notes that OpenAI's own public tracker shows fewer than a quarter of reported flaws fixed so far. Finding bugs faster than maintainers can fix them shifts the burden onto small, often volunteer, open-source projects.
- Gatekeeping. Many professionals argue that restricting frontier tools to vetted users leaves defenders behind attackers using open-weight models with the guardrails removed. One researcher who used Daybreak Blue to find a critical Debian APT flaw said he had to upload his driver's licence to join, and that the Blue tier has recently been made less useful for vulnerability hunting.
- Training data. OpenAI reportedly told Daybreak Blue members it would use data from personal accounts to improve its models. The company says customers can opt out of having Daybreak usage used for training.
What Defenders Should Do
- Expect more disclosures and faster weaponisation. If a well-funded lab can produce hundreds of working kernel exploits in one run, the time between disclosure and exploitation will shrink. Shorten patch windows for internet-facing and multi-tenant systems.
- Track the upstream fixes. Firefox and kernel updates over the coming weeks will include many AI-found bugs. Apply them promptly rather than waiting for a named CVE to go viral.
- If you run critical infrastructure, check whether your organisation qualifies for the critical-infrastructure group or the subsidised defender programme. Agree on strict rules of engagement and keep testing off production OT unless isolated.
- Govern internal use. Any team using offensive AI models should keep written scope, isolated test networks and full logs of agent actions.
Why It Matters
GPT-6 Cyber marks the point where a major lab openly says its model is at the top of its own cyber-risk scale and ships it anyway, through vetting rather than refusal. Whether that approach helps defenders more than attackers will depend less on benchmark scores than on how quickly found bugs actually get fixed, and on how long comparable abilities stay out of unrestricted models.
