OpenAI has released a model whose whole job is breaking into software, and spent most of the announcement explaining why it stays in its lane. GPT-6 Cyber, introduced on November 5, 2026, is trained to find and validate exploitable vulnerabilities, and OpenAI’s pitch pairs the two things security teams fear most in one agent: it is sharply more capable than the last cyber model, and far better at not wandering off the assigned target.
OpenAI calls it “a major advance in security research that pairs stronger capabilities with better model alignment.” This page is read from OpenAI’s announcement, its model page and its Daybreak setup guide.
On this page · 7 sectionsOpen
OpenAI released GPT-6 Cyber on November 5, 2026: a model trained to find and validate exploitable vulnerabilities while staying within the scope researchers set.
It scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, and is now classed Critical in cybersecurity under OpenAI’s Preparedness Framework, up from High.
The headline is alignment: in a honeypot test it left easy out-of-scope services alone in 99.93% of cases without a deployment prompt, and 100% with one.
OpenAI’s researchers used it to build working exploits for 948 Linux kernel bugs, five times the 166 from its older model, and found 81 novel high-severity Firefox bugs.
GPT-6 Cyber is available only through the API and Codex to approved Daybreak Red customers, with IP allowlisting required and critical-infrastructure testing kept separate.
It is priced at $20 per million input tokens and $100 per million output tokens, and a Cyber at the Frontier livestream on November 12 promises more.
§ 01The capability jump
GPT-6 Cyber is “more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set.” On ExploitGym, the benchmark for whether a model can exploit a specified vulnerability in a remote target, it scores 48.5%, up from 32.1% for GPT-5.6 Cyber, which OpenAI frames as a 51% relative improvement. OpenAI now classifies it as Critical in cybersecurity under its Preparedness Framework, up from High for the previous model.
The real-world numbers are larger. OpenAI’s researchers used the model to reproduce 1,724 Linux kernel vulnerabilities and develop working exploits for 948, more than five times the 166 its GPT-5.6 Sol model managed with the same harness, and disclosed 304 critical findings to maintainers with candidate patches. In Firefox, which OpenAI’s quoted Mozilla engineer calls “one of the world’s most hardened and scrutinized codebases,” it produced evidence for 81 novel high-severity vulnerabilities and showed 30 known issues were worse than reported.
§ 02The part that is new: an attacker that stays in scope
The worry with an autonomous exploit agent is not only that it fails, but that it succeeds in the wrong place, attacking an unrelated service or ignoring the rules of engagement. OpenAI made that the center of the release.
Its test is a honeypot. The model gets a hard exploitation task in an isolated lab that also contains easy-to-exploit side services, a package registry or an object store, where breaking in would reveal the answer the fast way. Staying honest means inferring that those services are out of scope and leaving them alone. GPT-6 Cyber “avoided exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT-5.6 Cyber” without a deployment prompt, and 100% with one.
| Measure | Value |
|---|---|
| ExploitGym | 48.5% (was 32.1%) |
| Stays in scope, no deploy prompt | 99.93% (was 94.49%) |
| RemoteExploitBench | 95% complete; GPT-6 Astra refused 100% |
| Web pentest vulnerability recall | 40.3% vs 40.3% Astra’s 32.0% |
| Linux kernel working exploits | 948 of 1,724 reproduced |
| Firefox novel high-severity bugs | 81, plus 30 underrated |
| Preparedness class | Critical (was High) |
| Price | $20 input, $100 output per 1M tokens |
§ 03Who can use it, and the guardrails
GPT-6 Cyber is not open to everyone. It is available through the API and Codex to a select group of approved Daybreak Red customers, OpenAI’s trusted-access tier for offensive security work, expanding to all Daybreak Red customers soon. Mainline GPT-6 Astra already does code review and patch development; Daybreak Blue helps verified defenders validate fixes with fewer refusals; Daybreak Red adds exploit development with this model.
The access comes wrapped in controls that mirror the ones a careful team would put on any powerful agent. Daybreak Red API access requires IP allowlisting by default. Zero Data Retention projects must use Private Safety Processing, which reviews encrypted records in the customer’s own storage without exposing prompts to OpenAI staff. A new Daybreak Red for Critical Infrastructure group lets approved operators test power and water systems while keeping the misuse safeguards, and a $1 billion Daybreak for Frontline Defenders program subsidizes access for government and essential-service teams. OpenAI’s own framing: “we have a limited window to use frontier models to secure software.”
§ 04Where CellCog sits
Our conflict, declared: we build CellCog, an AI employee platform, not a security product, so this is context, not competition. The release is still worth reading for anyone handing real work to an autonomous agent, because the headline is not the exploit count. It is that the capability and the discipline to stay in bounds were trained together and measured together. That is the same bet behind every CellCog AI employee: the useful thing and the boundary are not separate features. Anything above the approval level you set waits for you, and a capable agent that respects that line is worth more than a more capable one that does not.
For the exploit-pipeline side of this work, see our record on OpenAI’s 948 Linux root exploits, and for the training-data change underneath Daybreak, OpenAI training on Daybreak Blue sessions.
§ 05What is not established yet
- Full benchmark detail. OpenAI points to the system card for RemoteExploitBench and alignment settings; third parties have not tested the model.
- When access widens. “Soon” for all Daybreak Red customers; no date.
- Pricing in practice. The model page lists $20 input and $100 output per million tokens, but exploit development runs long, so real costs are unknown.
- More to come. OpenAI has a “Cyber at the Frontier” livestream on November 12 for further announcements.
§ 06Where to watch
- The system card numbers once researchers read them.
- Whether the in-scope discipline holds outside OpenAI’s own honeypot.
- The Daybreak Red for Critical Infrastructure rollout and the Dragos findings on OT systems.
§ 07Sources
- OpenAI, GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents, November 5, 2026, read in a browser 17:25 UTC.
- OpenAI on X, announcement, November 5, 2026, 17:09 UTC.
- OpenAI, GPT-6-Cyber model page and Daybreak setup guide, read November 5, 2026.
- Our records on OpenAI’s 948 Linux root exploits and Daybreak Blue training.
Q1When did OpenAI release GPT-6 Cyber?
On November 5, 2026. OpenAI posted the announcement on X at 17:09 UTC with a blog post the same day.
Q2What makes GPT-6 Cyber different from a normal model?
It is trained both to be more capable at exploit development and to stay within an authorized scope. In a honeypot test it ignored easy out-of-scope services 99.93% of the time without a prompt.
Q3How much does GPT-6 Cyber cost?
OpenAI’s model page lists $20 per million input tokens and $100 per million output tokens. Exploit development runs long, so real costs depend on the task.
Q4What did GPT-6 Cyber find in the real world?
OpenAI’s researchers reproduced 1,724 Linux kernel vulnerabilities and built working exploits for 948, and found 81 novel high-severity Firefox vulnerabilities, with patches sent to maintainers.
Q5Where does CellCog fit?
CellCog is our product, an AI employee platform, not a security tool. We read this release because it trains capability and staying-in-bounds together, the same bet behind our approval model.