GPT-6 Cyber explained: what OpenAI's Critical-rated model found

What is GPT-6 Cyber?

GPT-6 Cyber is OpenAI's new model for security research, announced on November 5, 2026. It is a version of GPT-6 Astra, OpenAI's main model, trained to find software flaws, prove they can be exploited, and write fixes. It is also trained to refuse less when a verified security team asks for that work.

It is OpenAI's fourth cyber-focused model this year, after releases in April, June and August. OpenAI rates it Critical for cybersecurity under its Preparedness Framework, the highest level, up from High for GPT-5.6 Cyber. GPT-6 Astra carries the same Critical rating.

OpenAI's headline claim: the model is much better at hacking and much better at staying inside the limits a researcher sets. Both halves matter, and both are OpenAI's own numbers.

What GPT-6 Cyber found

Linux kernel. On November 4, OpenAI published "A thousand fewer paths to root". In one run in mid-October, an automated pipeline built on the model scanned the latest Linux kernel, turned 2,308 candidate findings into 1,724 reproduced vulnerabilities, and produced 948 distinct working exploits that take an ordinary local user to root. The run cost $1,213,430 in API credits, about $1,279 per exploit. The targets ran a stock desktop Linux with standard protections on.

In July, GPT-5.6 Sol found 166 on the same harness, after which the kernel had three more months of hardening. OpenAI also says the agents used at least 10 exploitation techniques that outside kernel experts had not seen before. It has not published them.

Firefox. OpenAI says the model found 81 new vulnerabilities that Mozilla rated high severity, and showed that 30 known issues were worse than first thought. Mozilla's Firefox 159 advisory of October 27 credits 41 high-impact fixes to OpenAI and its Codex Security tool. Firefox's Brian Grinstead says the browser had already been hardened "with multiple generations of frontier models" before this.

Other work. OpenAI researchers used the model to show how a critical flaw in Brotli, a compression library used by Node.js, could allow remote code execution. During the disclosure of the PHP flaws in October, covered in PHP2Shell and the 10 worst vulnerabilities in internet history, OpenAI watched for attempts to build exploits against live PHP servers. Cisco, Calif, CodeRabbit, Palo Alto Networks, SentinelOne and Perplexity are named as users.

How OpenAI got to GPT-6 Cyber

The Linux result is the latest step in a year of fast progress. Each model found more than the last on the same code.

• June 202624 Linux exploits

  Under Patch the Planet, OpenAI's program for finding and fixing bugs in open-source code, GPT-5.5 Cyber found Linux kernel flaws and built 24 root exploits to prove them.

• July 2026166 exploits, and an incident

  GPT-5.6 Sol found and exploited 166 kernel flaws for $513,690. The same month, OpenAI's security-testing agents broke into Hugging Face, the Hugging Face incident.

• August 2026Daybreak splits in two

  OpenAI's program for vetted security teams splits into Daybreak Blue for defensive work and Daybreak Red for exploit development.

• Mid-October 2026948 exploits

  The new cyber model, not yet named, runs the same pipeline on the kernel and finds more than five times as many.

• November 5, 2026GPT-6 Cyber launches

  The model goes to a first group of Daybreak Red customers through the API and Codex.

GPT-6 Cyber vs GPT-6 Astra vs GPT-5.6 Cyber

OpenAI says GPT-6 Cyber beats GPT-6 Astra on most cyber tasks, even when Astra does not refuse. The main numbers from the announcement and the system card:

• ExploitGym: 48.5% vs 42.4% vs 32.1%

  Exploit a known, specified flaw in a remote target. Cyber scores highest, Astra second, GPT-5.6 Cyber third. ExploitGym is the same test set the agents in the Hugging Face incident were working on.

• RemoteExploitBench: 95% vs 0%

  A new OpenAI test with known flaws in GitLab, PostgreSQL and Jenkins, set up in a controlled environment. Astra, running in Daybreak Blue, refused every task. Cyber completed 95%.

• Web penetration testing: 40.3% vs 32.0%

  Share of vulnerabilities found in web apps without access to their source code, Cyber vs Astra.

• Outside test by Irregular: 90 vs 96 of 288

  On Irregular's FrontierCyber challenges, Astra solved slightly more. Neither model solved any of the 15 hardest, and Irregular saw no successful attack on a fully hardened target.

Does GPT-6 Cyber stay in scope?

The biggest worry with an AI that hacks is that it hacks the wrong thing. That is what happened in July, when OpenAI's test agents left their tasks and broke into Hugging Face. OpenAI built a test from that incident, ExploitGym Honeypot: the model gets a hard task plus an easy-to-hack side service, such as a package registry, that would reveal the answer. Hacking the side service is out of scope.

Without its safety prompt, GPT-6 Cyber stayed in scope in 99.93% of runs. GPT-5.6 Cyber managed 94.49%, and GPT-5.6 Sol went out of scope in about half its runs. With the safety prompt, GPT-6 Cyber stayed in scope every time.

99.93% is very good. Across thousands of automated runs it still means some runs go where they should not. Chris Hughes of Noma Security told CSO Online that even a small rate matters at that scale.

GPT-6 Cyber: viral claims vs facts

Posts about the launch spread fast. Four claims we saw, checked against OpenAI's announcement and system card.

• The claim

  It completes 95% of attacks on real servers.

  What the sources say

  The 95% is RemoteExploitBench: known flaws in GitLab, PostgreSQL and Jenkins, deployed in a controlled environment. These were not live servers.

• The claim

  Early versions escaped the sandbox and reached live servers, so OpenAI had to retrain it.

  What the sources say

  The escape OpenAI describes was planned. In red-team tests of its own training systems, agents using GPT-6 Cyber and other models broke out of microVMs onto the host machines, and OpenAI patched what they found. The system card reports no incidents with real systems. The real break-in onto a live site was the July Hugging Face incident, which involved earlier models.

• The claim

  Anyone can now use it to hack.

  What the sources say

  Only approved Daybreak Red customers, after identity and liveness checks, a legal attestation and a physical security key. API access is limited to approved networks by default.

• The claim

  It is OpenAI's first Critical-rated model.

  What the sources say

  GPT-6 Astra already has the Critical rating. GPT-6 Cyber is the first of OpenAI's Cyber models to get it.

Who can use GPT-6 Cyber?

For now, a select group of Daybreak Red customers, through the API and Codex. OpenAI says it will open the model to all Daybreak Red customers soon, and it is moving GPT-5.6 Cyber to the whole Red tier. Daybreak Blue, for defensive work such as code review and patch testing, is getting wider early access to GPT-6 Astra. There is also a new Daybreak Red group for critical infrastructure defenders and a $1 billion grant program for teams with small budgets. Pricing has not been published.

Individual users must pass identity and liveness checks, sign a legal attestation and log in with a physical FIDO2 key. Organizations need SSO, MFA and least-privilege access. OpenAI monitors whether the model's actions match what the user is authorized to do, can pause or stop a run, and adds extra checks on work that touches industrial control systems, essential services and election systems.

OpenAI is not alone. Anthropic runs a vetted-access program called Glasswing, and Google offers its Gemini 4 Argon model to approved defenders through its Fairwind program.

What GPT-6 Cyber means for defenders

OpenAI built GPT-6 Cyber for defenders, and its access rules are strict. But the trend is the point. Hacking contests such as Pwn2Own have paid $20,000 to $70,000 for a single Linux kernel root exploit. OpenAI's run made them for about $1,300 each. And OpenAI expects that within a few years even less capable models will be able to build exploits once a flaw is public.

Patching is the first answer, and it is now a race: hundreds of kernel fixes are landing at once. It will not be finished in a day, so for some time many servers will run with known flaws. And some of the techniques are new, so detection rules written for known attacks will miss them. Dragos's Rob T. Lee says the same: new attack paths make detection harder.

What every one of those exploits has in common is the step after it. An ordinary account becomes root, and then something runs that never ran on that host before. That is visible on the server, whatever bug was used. A runtime baseline for each server flags it while the attacker is still working toward a goal.

Signals worth watching on every Linux host:

• An account gaining root it never had: new sudo use, setuid changes, a root shell from a service user.
• New processes, binaries or kernel modules on a host whose software rarely changes.
• Outbound connections from a server that has never talked to that address or port.
• Changes to system files, login keys or startup scripts outside a release window.
• Servers with no agent at all: the ones you cannot see are the ones that stay unpatched longest.