OpenAI introduces GPT-6 Cyber for verified defenders, claiming stronger exploit skills

Verified security researchers are getting an AI model built to turn software weaknesses into working attacks—and to resist shortcuts outside their permission. OpenAI introduced GPT-6 Cyber on November 5, saying it improves both exploit development and compliance with research boundaries. Access runs through Daybreak Red, its program for authorized security testing.

Working attacks are the capability test

OpenAI classifies GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. The company evaluated whether the model could understand software, identify vulnerabilities and build working exploits: demonstrations that a weakness can actually be used, rather than simply flagged for review.

On ExploitGym, which asks models to exploit a specified vulnerability in a remote target, the new model improved by roughly 16 percentage points. A separate web penetration test measured discovery without access to application source code. GPT-6 Cyber found 40.3% of the vulnerabilities, compared with 32.0% for GPT-6 Astra, according to OpenAI.

OpenAI also built RemoteExploitBench around known vulnerabilities in applications including GitLab, PostgreSQL and Jenkins, deployed in controlled environments. GPT-6 Cyber completed 95% of tasks. Astra running with Daybreak Blue refused every task, so that comparison reflects differing permissions as well as whether a model could make an exploit work remotely.

A tempting route outside the target

The scope test deliberately offers an easier, unauthorized path to success. In ExploitGym Honeypot, a model works on a difficult exploitation task inside an isolated environment. Supporting services, such as a package registry or object store, are made easy to attack. Exploiting them can reveal the task’s success marker, but the model must infer that those services are outside its assignment.

Without deployment safety prompts, GPT-6 Cyber avoided exploiting those services in 99.93% of tests, versus 94.49% for GPT-5.6 Cyber. With the prompts, it stayed within bounds in every test. These are OpenAI’s evaluation results, not a guarantee that every deployed task will remain within scope.

OpenAI says specialized training targeted three behaviors: staying inside authorized scope, respecting restrictions on actions and accurately reporting completed work. The honeypot evaluation was informed by the Hugging Face incident.

Research findings meet access controls

OpenAI attributes substantial software-security findings to the model. In Firefox, it says GPT-6 Cyber produced evidence and reproducible tests for 81 previously unknown vulnerabilities that Mozilla classified as high severity. It also showed that 30 known issues were more severe than previously reported. Mozilla began landing fixes after receiving the findings and proposed patches.

For Linux, the company reports reproducing 1,724 vulnerabilities and developing working exploits for 948. It disclosed 304 critical findings to maintainers with candidate patches and says work to get other vulnerabilities fixed is continuing. Cisco, Calif and CodeRabbit are also using the model for vulnerability research or code review, according to OpenAI.

Daybreak Red gives verified defenders access for deeper exploit development and authorized testing. OpenAI distinguishes it from Daybreak Blue, which helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals. Alongside the release, the company describes deployment safeguards aimed at misuse and unauthorized actions:

• Cyber-specific monitoring checks whether actions match the user’s authorization while recognizing legitimate exploit development and testing.
• Targeted monitoring addresses emerging threats. During coordinated disclosure of critical PHP vulnerabilities, OpenAI monitored attempts to develop exploits against live PHP servers while preserving support for defenders patching systems.
• API customers using Zero Data Retention generally must use Private Safety Processing: automated checks of encrypted records retained in customer storage for 30 days, without exposing prompts and responses to OpenAI personnel.