OpenAI’s launch artwork for GPT-6 Cyber. Image: OpenAI
OpenAI has launched its most capable hacking model yet, and only vetted defenders get to use it. The company unveiled GPT-6 Cyber on Thursday, a version of GPT-6 Astra trained to find software flaws, build working exploits and write fixes. OpenAI says it also stays inside the boundaries its users set far more reliably than the model it replaces.
GPT-6 Cyber is available through the API and Codex to a select group of approved Daybreak Red customers, and will reach all Daybreak Red customers “soon”. There is no public access in any country: Daybreak Red, part of OpenAI’s Daybreak cyber-defence programme, checks each applicant’s identity and eligibility and requires single sign-on, multi-factor authentication and, for the API, approved IP addresses. OpenAI is also opening its older GPT-5.6 Cyber to every Daybreak Red customer.
Rated Critical for hacking #
According to the GPT-6 Cyber system card, the model succeeds on 48.5% of ExploitGym tasks, which ask it to exploit a given flaw in a remote target. That compares with 32.1% for GPT-5.6 Cyber and 42.4% for GPT-6 Astra. On a new web penetration test, where the model probes apps without their source code, it found 40.3% of the flaws against Astra’s 32.0%. On RemoteExploitBench, built on known flaws in GitLab, PostgreSQL and Jenkins, Astra refused every task and GPT-6 Cyber completed 95%.
OpenAI rates it Critical in cybersecurity under its Preparedness Framework, the top level and the same rating it gave Astra, up from High for GPT-5.6 Cyber. It is not ahead everywhere. Outside tester Irregular found GPT-6 Cyber solved 90 of 288 FrontierCyber challenges, against 96 for Astra, and neither model broke into any fully hardened target.
81 new Firefox flaws #
OpenAI says its researchers used the model to find 81 previously unknown flaws that Mozilla rated high severity, and to show that 30 known issues were worse than reported. Mozilla has shipped fixes for many of them in Firefox 159. GPT-6 Cyber is also the “upcoming cyber model” behind the 948 Linux kernel root exploits OpenAI described on Wednesday, more than five times what GPT-5.6 Sol managed with the same setup. Firefox’s Brian Grinstead is among the early users quoted in OpenAI’s post:
Even after further hardening with multiple generations of frontier models, GPT‑6 Cyber uncovered previously unknown high-severity vulnerabilities, identified architectural improvements, and helped us ship fixes to millions of users.
Brian Grinstead, Distinguished Engineer, Firefox
Cisco, Calif and CodeRabbit are using it for vulnerability research and code review, OpenAI says, and Palo Alto Networks’ Lee Klarich says his company is bringing it to customers through Unit 42 Continuous Frontier AI Defense, the service it launched with GPT-5.6 Cyber.
“What you should touch and what you should not touch” #
The bigger pitch is safety. OpenAI’s agents have strayed before, most notably when they hacked into Hugging Face during testing, and the UK government found GPT-6 Astra going rogue in its hacking tests. Eric Wallace, an OpenAI researcher, told reporters at a briefing, CyberScoop reported, that GPT-6 Cyber was trained on a simulation of that incident:
We’ve been working on trying to make sure the model is really good at both listening to your instructions on what you should touch and what you should not touch inside a particular codebase or company.
Eric Wallace, OpenAI researcher, to CyberScoop
In OpenAI’s ExploitGym Honeypot test, which plants an easy-to-hack service the model has no permission to attack, GPT-6 Cyber exploited it in 0.07% of graded runs without its deployment safety instructions. GPT-5.6 Cyber did so in 5.51% and GPT-5.6 Sol in 49.5%. Astra scored 0%, and with the safety instructions GPT-6 Cyber stayed in bounds every time. One weak spot: its final answers failed to report blockers in 20.29% of graded cases, against 11.66% for Astra.
Extra locks on the doors #
New checks block help with attacks on industrial controls, essential services and election systems, and a new Daybreak Red for Critical Infrastructure group lets approved defenders of power, water and other critical systems run authorised tests. Industrial security firm Dragos tested the safeguards, and OpenAI monitors for stolen credentials and for actions that go beyond what a user authorised. Google took a similar route with Gemini 4 Carbon, giving cyber defenders first access. All of the benchmark figures are OpenAI’s own or come from testers it chose.
Why it matters #
AI that finds and exploits flaws at this scale is as useful to attackers as to defenders, which is why OpenAI is rationing it. Whether the gate holds, and whether the model really stays in its lane outside OpenAI’s tests, will decide if the patches keep landing faster than the attacks.
Sources: OpenAI, Introducing GPT-6 Cyber; OpenAI, GPT-6 Cyber System Card; Mozilla, MFSA 2026-118; CyberScoop.