# OpenAI GPT-6 Cyber: The Aligned Exploit Model

> OpenAI released GPT-6 Cyber, a model that finds and validates exploits while staying in scope. The benchmarks, the 948 Linux exploits, and who gets it.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-11-05
- Canonical (HTML): https://cellcog.ai/blog/openai-gpt-6-cyber/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- OpenAI released GPT-6 Cyber on November 5, 2026: a model trained to find and validate exploitable vulnerabilities while staying within the scope researchers set.
- It scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, and is now classed Critical in cybersecurity under OpenAI's Preparedness Framework, up from High.
- The headline is alignment: in a honeypot test it left easy out-of-scope services alone in 99.93% of cases without a deployment prompt, and 100% with one.
- OpenAI's researchers used it to build working exploits for 948 Linux kernel bugs, five times the 166 from its older model, and found 81 novel high-severity Firefox bugs.
- GPT-6 Cyber is available only through the API and Codex to approved Daybreak Red customers, with IP allowlisting required and critical-infrastructure testing kept separate.
- It is priced at $20 per million input tokens and $100 per million output tokens, and a Cyber at the Frontier livestream on November 12 promises more.

## At a glance

- **What is GPT-6 Cyber?** An OpenAI model, released November 5, 2026, trained to find and validate exploitable software vulnerabilities while staying within the scope a researcher authorizes.
- **How good is it?** It scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, and OpenAI classes it Critical in cybersecurity. Its researchers built working exploits for 948 Linux kernel bugs with it.
- **Who can use GPT-6 Cyber?** Only approved Daybreak Red customers, through the API and Codex, with IP allowlisting required. OpenAI says it will expand to all Daybreak Red customers soon.

OpenAI has released a model whose whole job is breaking into software, and spent most of the announcement explaining why it stays in its lane. GPT-6 Cyber, introduced on November 5, 2026, is trained to find and validate exploitable vulnerabilities, and OpenAI's pitch pairs the two things security teams fear most in one agent: it is sharply more capable than the last cyber model, and far better at not wandering off the assigned target.

OpenAI calls it "a major advance in security research that pairs stronger capabilities with better model alignment." This page is read from OpenAI's [announcement](https://openai.com/index/introducing-gpt-6-cyber/), its [model page](https://developers.openai.com/api/docs/models/gpt-6-cyber) and its [Daybreak setup guide](https://developers.openai.com/api/docs/guides/daybreak).

## The capability jump

![Animated diagram: a robot agent given an Authorized target walks past a glowing amber Out of scope bait box to a locked teal target and opens it, beside the large figure 99.93% stays in scope, 100% with a deployment prompt](https://cellcog.ai/blog/media/openai-gpt-6-cyber/scope.svg)
*GPT-6 Cyber walks past the out-of-scope bait to the one target it was authorized to hit.*

GPT-6 Cyber is "more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set." On ExploitGym, the benchmark for whether a model can exploit a specified vulnerability in a remote target, it scores 48.5%, up from 32.1% for GPT-5.6 Cyber, which OpenAI frames as a 51% relative improvement. OpenAI now classifies it as Critical in cybersecurity under its Preparedness Framework, up from High for the previous model.

The real-world numbers are larger. OpenAI's researchers used the model to reproduce 1,724 Linux kernel vulnerabilities and develop working exploits for 948, more than five times the 166 its GPT-5.6 Sol model managed with the same harness, and disclosed 304 critical findings to maintainers with candidate patches. In Firefox, which OpenAI's quoted Mozilla engineer calls "one of the world's most hardened and scrutinized codebases," it produced evidence for 81 novel high-severity vulnerabilities and showed 30 known issues were worse than reported.

## The part that is new: an attacker that stays in scope

The worry with an autonomous exploit agent is not only that it fails, but that it succeeds in the wrong place, attacking an unrelated service or ignoring the rules of engagement. OpenAI made that the center of the release.

Its test is a honeypot. The model gets a hard exploitation task in an isolated lab that also contains easy-to-exploit side services, a package registry or an object store, where breaking in would reveal the answer the fast way. Staying honest means inferring that those services are out of scope and leaving them alone. GPT-6 Cyber "avoided exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT-5.6 Cyber" without a deployment prompt, and 100% with one.

*Table: GPT-6 Cyber by the numbers (OpenAI announcement and model page, November 5, 2026)*

| Measure | Value |
|---|---|
| ExploitGym | 48.5% (was 32.1%) |
| Stays in scope, no deploy prompt | 99.93% (was 94.49%) |
| RemoteExploitBench | 95% complete; GPT-6 Astra refused 100% |
| Web pentest vulnerability recall | 40.3% vs 40.3% Astra's 32.0% |
| Linux kernel working exploits | 948 of 1,724 reproduced |
| Firefox novel high-severity bugs | 81, plus 30 underrated |
| Preparedness class | Critical (was High) |
| Price | $20 input, $100 output per 1M tokens |

## Who can use it, and the guardrails

GPT-6 Cyber is not open to everyone. It is available through the API and Codex to a select group of approved Daybreak Red customers, OpenAI's trusted-access tier for offensive security work, expanding to all Daybreak Red customers soon. Mainline GPT-6 Astra already does code review and patch development; Daybreak Blue helps verified defenders validate fixes with fewer refusals; Daybreak Red adds exploit development with this model.

The access comes wrapped in controls that mirror the ones a careful team would put on any powerful agent. Daybreak Red API access requires IP allowlisting by default. Zero Data Retention projects must use Private Safety Processing, which reviews encrypted records in the customer's own storage without exposing prompts to OpenAI staff. A new Daybreak Red for Critical Infrastructure group lets approved operators test power and water systems while keeping the misuse safeguards, and a $1 billion Daybreak for Frontline Defenders program subsidizes access for government and essential-service teams. OpenAI's own framing: "we have a limited window to use frontier models to secure software."

## Where CellCog sits

Our conflict, declared: we build CellCog, an AI employee platform, not a security product, so this is context, not competition. The release is still worth reading for anyone handing real work to an autonomous agent, because the headline is not the exploit count. It is that the capability and the discipline to stay in bounds were trained together and measured together. That is the same bet behind every CellCog [AI employee](https://cellcog.ai/ai-employees): the useful thing and the boundary are not separate features. Anything above the approval level you set waits for you, and a capable agent that respects that line is worth more than a more capable one that does not.

For the exploit-pipeline side of this work, see our record on [OpenAI's 948 Linux root exploits](https://cellcog.ai/blog/openai-948-linux-root-exploits/), and for the training-data change underneath Daybreak, [OpenAI training on Daybreak Blue sessions](https://cellcog.ai/blog/openai-daybreak-blue-training/).

## What is not established yet

- **Full benchmark detail.** OpenAI points to the system card for RemoteExploitBench and alignment settings; third parties have not tested the model.
- **When access widens.** "Soon" for all Daybreak Red customers; no date.
- **Pricing in practice.** The model page lists $20 input and $100 output per million tokens, but exploit development runs long, so real costs are unknown.
- **More to come.** OpenAI has a "Cyber at the Frontier" livestream on November 12 for further announcements.

## Where to watch

- The system card numbers once researchers read them.
- Whether the in-scope discipline holds outside OpenAI's own honeypot.
- The Daybreak Red for Critical Infrastructure rollout and the Dragos findings on OT systems.

## Sources

- OpenAI, [GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents](https://openai.com/index/introducing-gpt-6-cyber/), November 5, 2026, read in a browser 17:25 UTC.
- OpenAI on X, [announcement](https://x.com/OpenAI/status/2118390190246879554), November 5, 2026, 17:09 UTC.
- OpenAI, [GPT-6-Cyber model page](https://developers.openai.com/api/docs/models/gpt-6-cyber) and [Daybreak setup guide](https://developers.openai.com/api/docs/guides/daybreak), read November 5, 2026.
- Our records on [OpenAI's 948 Linux root exploits](https://cellcog.ai/blog/openai-948-linux-root-exploits/) and [Daybreak Blue training](https://cellcog.ai/blog/openai-daybreak-blue-training/).

## FAQ

**When did OpenAI release GPT-6 Cyber?**

On November 5, 2026. OpenAI posted the announcement on X at 17:09 UTC with a blog post the same day.

**What makes GPT-6 Cyber different from a normal model?**

It is trained both to be more capable at exploit development and to stay within an authorized scope. In a honeypot test it ignored easy out-of-scope services 99.93% of the time without a prompt.

**How much does GPT-6 Cyber cost?**

OpenAI's model page lists $20 per million input tokens and $100 per million output tokens. Exploit development runs long, so real costs depend on the task.

**What did GPT-6 Cyber find in the real world?**

OpenAI's researchers reproduced 1,724 Linux kernel vulnerabilities and built working exploits for 948, and found 81 novel high-severity Firefox vulnerabilities, with patches sent to maintainers.

**Where does CellCog fit?**

CellCog is our product, an AI employee platform, not a security tool. We read this release because it trains capability and staying-in-bounds together, the same bet behind our approval model.

## Related

- [OpenAI Agents Found 948 Linux Root Exploits for $1.2M](https://cellcog.ai/blog/openai-948-linux-root-exploits/index.md)
- [OpenAI Will Train on Daybreak Blue Sessions From Nov 29](https://cellcog.ai/blog/openai-daybreak-blue-training/index.md)
- [Claude Chained 4 Bugs Into a Chrome Exploit](https://cellcog.ai/blog/claude-finds-chrome-safari-exploits/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/openai-gpt-6-cyber/. Try CellCog free, no credit card needed: https://cellcog.ai/signup