On November 5, 2026, US time, November 6, 2026, Beijing time, OpenAI released the dedicated cybersecurity model GPT-6 Cyber for identifying and validating exploitable vulnerabilities. The company classified it as Critical in its own Preparedness Framework, which is higher than the High level of GPT-5.6 Cyber; this is not a government rating or independent certification. Initially, the model is only accessible through API and Codex to a selected and approved group of Daybreak Red customers. This classification reflects OpenAI's judgment of capability thresholds and does not grant users the right to test unauthorized targets, nor does it replace specific organizational authorization processes.
Access Thresholds and ExploitGym
OpenAI restricts the use of this model to authorized vulnerability research, exploit validation, and repair verification, with plans to gradually expand access to all Daybreak Red customers. The official announcement did not specify the number of approved customers or the date of full release, nor did it announce availability for general ChatGPT users and regular API accounts. Daybreak Blue continues to provide vulnerability and repair validation for defenders, with a different scope of release and deeper exploit development permissions. The official model documentation also requires organizations to first obtain Daybreak Red access approval, and the presence of the model identifier does not mean that any account has the calling qualification.
In OpenAI's ExploitGym evaluation, GPT-6 Cyber scored 48.5%, while GPT-5.6 Cyber scored 32.1%. The company describes the difference as a relative improvement of 51%, with the test content being the completion of exploit tasks for specified vulnerabilities. This figure comes from the benchmark environment set by OpenAI, and there is no third-party independent reproduction from existing sources, nor can it be directly converted into the success rate of discovering or exploiting any vulnerability in real networks. The two scores differ by about 16 percentage points; the relative increase and the percentage point difference are different metrics. The original scores from the official source are retained in the text to avoid misrepresenting the 51% as the hit rate itself.
Out-of-Scope Testing and Controlled Ranges
Another evaluation, ExploitGym Honeypot, specifically tests whether a model will attack supporting services that are outside the assigned task but easier to exploit. OpenAI says that, without the deployment safety prompt, GPT-6 Cyber avoided attacking out-of-scope services in 99.93% of tests, compared with 94.49% for GPT-5.6 Cyber; with the prompt, GPT-6 Cyber reached 100%. The test deliberately makes package registries or object stores easy to exploit while requiring the model to respect the designated target boundary. These rates apply only to this test setup and do not guarantee that deployment will eliminate scope violations or misuse.
OpenAI also reports that GPT-6 Cyber recalled 40.3% of vulnerabilities in an offensive web-penetration evaluation conducted without source code, compared with 32.0% for GPT-6 Astra. In the controlled RemoteExploitBench, which includes targets with known vulnerabilities in GitLab, PostgreSQL, Jenkins, and other software, Astra with Daybreak Blue refused every task while Cyber completed 95%. OpenAI says Cyber's only failure was an exploit it could not make work remotely. The access and safeguard configurations differ, so the result cannot be generalized to performance on live systems.
Linux and Firefox Research
In the Linux research project, OpenAI stated that researchers used the same toolchain to reproduce 1,724 vulnerabilities with GPT-6 Cyber and created usable privilege escalation exploits for 948 of them; the corresponding numbers for GPT-5.6 Sol in this toolchain were 166. The company also mentioned that they have disclosed 304 critical findings to maintainers and submitted candidate patches. These operations are part of a research environment and coordinated disclosure and do not imply that the model attacked 948 online systems, nor do they indicate that all candidate patches have been integrated into upstream versions. The announcement did not list the individual numbers, merge statuses, and fix release dates for these 304 findings, so the number of disclosures cannot be equated with the number of completed fixes.
In the research on Firefox, OpenAI stated that the model identified 81 previously unknown vulnerabilities that Mozilla classified as high severity, and reclassified 30 known issues as more severe. The model also assisted in proposing candidate patches, which Mozilla subsequently began implementing. Official materials only state that many of the vulnerabilities have been fixed but do not provide a complete list proving that all 81 have been fixed. The number of vulnerabilities, their severity, and the progress of fixes are based on the collaborative results described in the OpenAI announcement, and the existing materials are insufficient to verify each identifier and patch status individually.
Deployment Control and Fact Boundaries
With the model release, OpenAI has listed cybersecurity-specific measures such as misalignment monitoring, monitoring for new threats, Private Safety Processing, Daybreak Red interface credentials with default IP whitelists, and recommendations for sandboxing and human oversight. The company also requires some zero-data retention customers to use private safety processing. The default IP whitelist restricts requests to approved networks, while monitoring is used to identify whether authorized actions align with behavior. These measures are part of access and monitoring controls and do not equate to a security guarantee for any environment; high-risk work is still confined to authorized scopes and controlled processes.
The Verge and TechCrunch publicly shared authorized information streams at 17:00 and 19:06 UTC on November 5, respectively, confirming the event within this 24-hour window; both media outlets provided titles, short summaries, times, and links. The capability grading, benchmark ratios, and the numbers for Linux and Firefox are still sourced from OpenAI's self-reporting. The media confirm the product release, not an independent retest of all benchmarks. There is currently no independent reproduction, a total count of approved customers, a general availability date, or a complete vulnerability directory, so controlled testing cannot be written off as already verified real-world protective outcomes.