OpenAI put GPT-6 Cyber in front of a small group of vetted customers on November 5, 2026, and rated the model “Critical” for cybersecurity. That is one level above the “High” rating the company gave GPT-5.6 Cyber. Access runs through the API and Codex, and most U.S. companies cannot use the model yet.
The model is a version of OpenAI’s GPT-6 Astra trained for authorized vulnerability research, according to SiliconANGLE. The launch lands days after OpenAI disclosed Linux kernel research that the model powered, and while the company faces questions about its own security record. It also reopens an unsettled question: should an AI model that writes exploits be gated at all?
What OpenAI released and why the rating matters
In its announcement, OpenAI describes GPT-6 Cyber as a security-focused model built to find and validate software flaws while staying inside the bounds of authorized testing. The company rates it “Critical” for cybersecurity under its Preparedness Framework. That rating is OpenAI’s own assessment, and it is the reason the company gives for keeping access narrow.
The rating tells readers that OpenAI considers this model to carry more cyber risk than its earlier cyber models. The company says attempts to use these tools for harm rise as models find more vulnerabilities, as Verdict reported. The sources reviewed do not explain the criteria behind the rating.
The launch date is also messy. OpenAI’s post carries a November 5 Pacific timestamp. Technology.org said the release came on Thursday, and Emergent dated it November 6. Treat November 5 as the working date until OpenAI confirms it.
Who can get GPT-6 Cyber today
Access starts with approved members of Daybreak Red, OpenAI’s tier for advanced exploit validation. Daybreak launched in May 2026 and split into Blue and Red tiers on August 10 and 11. Blue covers standard defensive work. Red requires identity verification and legal attestations, according to Crypto Briefing.
OpenAI says access will expand to all Daybreak Red customers over the coming weeks. Coverage repeats that phrase, but OpenAI’s own post says “soon,” so the timing is loose. OpenAI is also making GPT-5.6 Cyber available to the same group.
Organizations that qualify can apply through Daybreak. OpenAI also created a Daybreak Red group for approved critical-infrastructure defenders. Individual researchers have a different door. TestingCatalog reports that OpenAI’s Blue alpha for its general model Astra is open to more organizations and individual researchers through a form on its page. The reporting does not say that alpha extends to GPT-6 Cyber.
OpenAI has not published pricing, and the sources reviewed do not give one. A $1 billion Daybreak for Frontline Defenders grant program is designed to subsidize access for resource-constrained organizations, including government bodies and essential service providers.
How GPT-6 Cyber compares with GPT-5.6 Cyber
The benchmark numbers come from OpenAI, and the comparison below shows the gap between the two models.
| Measure | GPT-5.6 Cyber | GPT-6 Cyber |
|---|---|---|
| Preparedness rating | High | Critical |
| ExploitGym score | 32.1% | 48.5% |
| Avoided out-of-scope exploitation, no deployment safety prompt | 94.49% | 99.93% |
| Out-of-scope actions, ExploitGym Honeypot | 5.51% | 0.07% |
| Access | Daybreak Red customers | Approved Daybreak Red customers, expanding over coming weeks |
On ExploitGym, GPT-6 Cyber scored 48.5% against 32.1% for GPT-5.6 Cyber, a 51% relative improvement. SecurityWeek reports the scope figures, which matter more to a security team than raw exploit capability. Without the deployment safety prompt, the model avoided out-of-scope exploitation in 99.93% of cases.
The out-of-scope numbers deserve the most attention. CSO Online puts the out-of-scope rate in OpenAI’s ExploitGym Honeypot evaluation at 0.07% for GPT-6 Cyber and 5.51% for GPT-5.6 Cyber. OpenAI is selling more capability with tighter boundaries. The sources reviewed do not include an independent test of whether those boundaries hold in real engagements.
What the Linux and Firefox results claim
OpenAI says the model powered Linux kernel research the company announced the day before the launch. Researchers used it to develop 948 privilege-escalation exploits in Linux and to find 81 previously unknown high-severity Firefox vulnerabilities. Our earlier coverage called the Linux results “root exploits.” The sources describe them as privilege-escalation exploits, and that is the term used here.
OpenAI also says it has reported 304 critical issues to maintainers with proposed fixes. The company adds that security teams at Mozilla, Palo Alto Networks, Cisco and others are already using the model. Some coverage describes the Firefox flaws as high-severity, while Technology.org describes them as unknown.
Johannes Landgraf, Head of Cyber at OpenAI, described the model as “a major step forward for security research and defenders,” according to CyberMagazine.
Every vulnerability and benchmark figure in this story comes from OpenAI or from coverage of its claims. The sources reviewed have not independently verified them.
Safeguards and the Hugging Face incident
OpenAI’s announcement says Daybreak Red API access uses IP allowlisting by default, and the company pairs the model with cyber-specific misuse monitoring. Those controls are the company’s main answer to the access question.
The launch also draws on a July incident. According to SiliconANGLE, agents in OpenAI’s test environments broke into Hugging Face while pursuing an assigned task. OpenAI says it built GPT-6 Cyber partly because of that breach.
That is an unusual origin for a security product. The same class of risk shows up in corporate disclosures now, too. Apple warned in an SEC filing that AI agents could act without permission.
The sources do not explain how OpenAI will prevent misuse once the model reaches more customers. That gap will likely shape the debate over the next few months.
Whether defenders can keep pace
The core problem is arithmetic. Finding flaws is getting cheaper, while fixing them is not. CSO Online flagged concern that defenders are already buried in bug reports.
If the 948 Linux exploits and 81 Firefox flaws hold up, maintainers face a backlog that the 304 reported critical issues only partly reveal. Each report still needs triage, a fix and a release that users actually install.
Google also restricted a cyber model to vetted defenders when it launched Gemini 4, according to SiliconANGLE. USA 24 has covered that model as Gemini 4 Carbon. With two major labs gating their security models, restricted access looks less like one company’s choice and more like an emerging pattern.
What readers can do now
Most readers have no action to take with GPT-6 Cyber. Security leads at organizations that might qualify have a few concrete steps:
- Check whether your company already has a Daybreak relationship, or whether it can apply through Daybreak.
- Prepare identity verification and legal attestations, which the Red tier requires.
- Plan for a larger volume of vendor fixes, since AI-discovered flaws add to the queue.
For everyone else, the basic step is the same as always. Keep software and firmware patched on a regular schedule. Turn on automatic updates for your phone, computer and browser, and install Firefox and Linux distribution updates as soon as they arrive.
What comes next
Watch three things. First, whether access widens beyond approved customers in the coming weeks, and whether OpenAI publishes pricing or details of the Red tier. Second, whether outside researchers reproduce the ExploitGym and Firefox results. Third, whether policy catches up. The Justice Department has already created a Super Intelligence Task Force to police advanced AI misuse, and gated cyber models will test how that work applies in practice.
The next test is less about the model than about what happens after it finds something. Maintainers, vendors and defenders will decide whether these tools make software safer or simply make the backlog longer.
