GPT-6 Cyber: Why OpenAI Built an AI It Won't Let You Use

OpenAI released GPT-6 Cyber on November 5, a specialized version of its GPT-6 model trained to find and exploit software vulnerabilities, and restricted access to vetted security teams through a program called Daybreak Red after rating the model "critical" under its preparedness framework. GPT-6 Cyber scored 48.5% on the Exploit Gym benchmark, up from 32.1% for GPT-5.6 Cyber, and OpenAI researchers used it to build 948 working exploits from 1,724 reproduced Linux vulnerabilities, disclosing 304 critical findings to Linux maintainers with candidate patches; it also surfaced 81 previously unknown high-severity bugs in Firefox. The public GPT-6 Astra model does not have these capabilities enabled, and OpenAI's own chart shows an upcoming cyber model already reaching 77% on Exploit Gym, also limited to trusted defenders.

GPT-6 Cyber: Why OpenAI Built an AI It Won't Let You Use GPT-6 Cyber found hundreds of real exploits and dozens of Firefox bugs, but OpenAI locked it to approved security teams only. Here's why. What is GPT-6 Cyber? GPT-6 Cyber is a specialized version of OpenAI’s GPT-6 model, trained specifically to find software vulnerabilities, prove they can be exploited, and help write fixes for them. OpenAI released it on November 5, rated it “critical” in cybersecurity risk under its preparedness framework, the highest tier the company uses, and then restricted access to a small set of vetted security teams through a program called Daybreak Red. The public-facing model most people can actually use, GPT-6 Astra, does not have these capabilities enabled. TL;DR - GPT-6 Cyber scored 48.5% on Exploit Gym , a benchmark testing whether a model can exploit a vulnerability in a remote target, up from 32.1% for the prior cyber model, a 51% relative jump in one generation. - OpenAI’s researchers used it to build 948 working exploits out of 1,724 reproduced Linux vulnerabilities and disclosed 304 critical findings to Linux maintainers with candidate patches attached. - It found 81 previously unknown high-severity bugs in Firefox , a codebase Mozilla describes as already one of the most hardened and scrutinized in the world. - A security researcher noted the model invents novel exploitation techniques rather than just copying patterns from public bug reports, a qualitative shift from earlier cyber-focused models. - An even stronger “upcoming cyber model” already hits 77% on Exploit Gym according to OpenAI’s own chart, and it’s also headed only to trusted defenders, not the public. - OpenAI restricts access through Daybreak Red , which requires approval and IP allow-listing by default, while a filtered version called Daybreak Blue built on GPT-6 Astra ships with far more refusals intact. - Anthropic did the same thing earlier in 2025 with a model called Claude Mythos, keeping the unrestricted version limited to partners like Microsoft, Cisco, and the Linux Foundation while the public got a safeguarded version instead. Build an onboarding app for 4,000 new hires. Build ↵ Self-hosted SOC 2 Role-based access Audit log How good is GPT-6 Cyber, really? The benchmark numbers are the clearest signal. On Exploit Gym, which measures whether a model can actually exploit a vulnerability in a remote target rather than just describe one, GPT-6 Cyber hit 48.5%, compared to 32.1% for its predecessor, GPT-5.6 Cyber. On a separate test called Remote Exploit Bench, which uses real known vulnerabilities in widely used software like GitLab, PostgreSQL, and Jenkins, GPT-6 Cyber completed 95% of tasks. GPT-6 Astra, the version available to the public, refused all of them. The real-world results back this up. In a controlled research campaign, OpenAI reproduced 1,724 known Linux vulnerabilities and used GPT-6 Cyber to build working exploits for 948 of them, more than five times the 166 that the previous model managed under the same setup. Those findings went to Linux maintainers along with 304 critical disclosures and candidate patches. Against Firefox, a browser that’s been through years of intense public security research, the model surfaced 81 new high-severity vulnerabilities, which Mozilla’s own engineers described as a genuine surprise given how hardened the codebase already was. Security researcher Stefan Esser, commenting independently, noted that earlier models tended to take techniques from public bug reports and apply them in a rough, imitative way. GPT-6 Cyber, by contrast, produced exploitation techniques he hadn’t seen discussed publicly before. That distinction matters: a model copying known tricks is a search engine with extra steps. A model inventing new ones is doing something closer to original security research. It isn’t flawless. An independent evaluation by the security firm Irregular found that GPT-6 Cyber solved all of its basic scenario and atomic challenges at least once, and 90 out of 288 “Frontier Cyber” challenges, but neither GPT-6 Cyber nor GPT-6 Astra solved any of the 15 hardest challenges, and no successful attacks were observed against fully hardened targets. Why does OpenAI call it “critical” risk? OpenAI’s preparedness framework ranks models by potential for catastrophic misuse, and “critical” is the top tier, a step up from the “high” rating given to the previous cyber model. The jump isn’t just about raw exploit counts. It reflects a model that can chain together multiple smaller weaknesses into a working attack, discover vulnerabilities nobody has catalogued yet, and do it fast enough and cheaply enough that the economics of finding exploits shift. One estimate of OpenAI’s own Linux exploit campaign put the API cost at roughly $1,279 per working exploit, cheap compared to what a single unpatched vulnerability can cost an organization if attackers find it first. OpenAI also turned the model on itself. In internal red-teaming, agents using GPT-6 Cyber and other OpenAI models chained vulnerabilities together to escape sandboxed environments https://goremy.ai/blog/articles/ai-agent-security-why-vms-alone-wont-contain-them and execute code on the underlying machines, findings OpenAI says it used to harden the infrastructure that trains its own frontier models. Why isn’t it available to the public? Enterprises use Remy. ChatGPT Here’s a draft of your policy… Gemini Here are 5 ways to track it… Perplexity According to 4 sources… - Self-hosted - SOC 2 - HIPAA - Audit log - Role-based access Because the same skills that make a model good at defense make it good at offense. OpenAI states this explicitly: higher refusal rates aren’t automatically better, because the techniques involved in attacking a system, understanding it, finding its weak points, verifying a fix actually works, are largely identical to the techniques involved in defending it. There’s no clean line between “hacker behavior” and “security researcher behavior.” That’s the core problem with trying to build guardrails around a model like this. Block too aggressively and you cripple its usefulness for the defenders who are supposed to benefit from it. Block too loosely and you’ve shipped an exploit-generation engine to anyone with a ChatGPT account. OpenAI’s answer is tiered access. Daybreak Red gives vetted, approved security teams the full, unfiltered GPT-6 Cyber, with IP allow-listing required by default so requests only come from approved networks. Daybreak Blue offers a version built on GPT-6 Astra with fewer refusals than the general public model, but still well short of Daybreak Red’s capability. For everyone else, there’s the standard GPT-6 Astra, which declined every task on Remote Exploit Bench. OpenAI’s own testing found the model stayed within authorized scope 99.93% of the time when operating without its safety prompt. That number sounds reassuring until you scale it: at hundreds of millions of users, a 0.07% failure rate still represents an enormous volume of unauthorized actions. That math is likely a big part of why the full model never reaches open access. Is this the first time a lab has held back its best model? No. Anthropic did essentially the same thing earlier in 2025 with a model internally called Claude Mythos. Rather than releasing it broadly, Anthropic gave access to a limited set of partners, including Microsoft, Cisco, and the Linux Foundation, through a program called Project Glasswing, at premium pricing and with up to $100 million in usage credits committed to the effort. Anthropic’s stated reasoning mirrored OpenAI’s: the model could chain together multiple vulnerabilities, none individually serious, into sophisticated multi-step exploits, and it showed unusual autonomy in sustaining long security-research tasks. When Anthropic later released a public model from that same lineage, Claude Opus 5 “Fable 5” in some reporting , it added safeguards that reroute high-risk cybersecurity, biology, and chemistry requests to an older, weaker model. The full, unrestricted version stayed limited to trusted partners. Functionally, that’s the same split OpenAI has now built into Daybreak Red and Daybreak Blue: one capability tier for the public, a materially stronger one for vetted organizations only. The pattern suggests this isn’t a one-off policy choice by either lab. It reflects a structural reality: cyber capability isn’t trained in separately, it emerges as a byproduct of making models better at code, which is the single most prioritized capability across every frontier lab right now. That means every future flagship model is likely to arrive with cyber capabilities that need separate gating, not as an exception, but as a default part of the release process. Frequently Asked Questions What is Exploit Gym? Exploit Gym is a benchmark OpenAI uses to test whether a model can actually exploit a vulnerability in a remote target, not just describe or identify one. GPT-6 Cyber scored 48.5% on it, up from 32.1% for the previous generation. What is Daybreak Red? Daybreak Red is OpenAI’s restricted access program that gives approved security teams and organizations full access to GPT-6 Cyber. It requires vetting and, by default, IP allow-listing so requests only come from approved networks. Daybreak Blue is a lighter-restriction tier built on the public GPT-6 Astra model. Can regular developers or companies use GPT-6 Cyber? Remy. claims.northwind.internal Your servers. Your domain. 1,902 214 17 3.2h CLM-20417 · M. Alvarez $4,120 Approved CLM-20418 · D. Okafor $880 In review CLM-20419 · S. Lindqvist $12,300 In review Not directly. Access is limited to vetted security teams approved through Daybreak Red. The general-purpose public model, GPT-6 Astra, does not have equivalent exploit-generation capability and refused all tasks on OpenAI’s Remote Exploit Bench test. Did Anthropic do something similar? Yes. Anthropic restricted a cyber-capable model called Claude Mythos to select partners including Microsoft, Cisco, and the Linux Foundation earlier in 2025, then released a public version with added safeguards that route sensitive requests to a weaker model, keeping the full-strength version limited to trusted organizations. Does this mean future AI models will always be restricted this way? It’s likely to become more common rather than less. Because cyber capability appears to emerge from general code ability rather than requiring separate training, every future frontier model is expected to arrive with stronger offensive security potential, pushing labs toward tiered release models rather than single public launches.