OpenAI on Thursday released GPT-6 Cyber, a security model it says can find and exploit software flaws far better than its predecessor. For now, only a select group of approved customers in its Daybreak Red program can use it.
The company rated the model Critical for cybersecurity under its Preparedness Framework. That is one notch above the High label OpenAI assigned to GPT-5.6 Cyber.
On ExploitGym, a benchmark that tests whether an AI system can successfully attack a known weakness on a remote machine, the new model scored 48.5%, compared with 32.1% for GPT-5.6 Cyber. OpenAI described that as a 51% gain and claimed the model also beats its own GPT-6 Astra on most cyber tasks.
Aimed at the Linux kernel, GPT-6 Cyber reproduced 1,724 vulnerabilities and produced working privilege-escalation exploits for 948 of them, OpenAI researchers said. GPT-5.6 Sol, run with identical tools, managed 166. OpenAI says it has passed 304 critical issues to kernel maintainers along with suggested fixes.
Training the model to stay in bounds
The model also turned up 81 previously unknown Firefox bugs that Mozilla classified as high severity, each documented with evidence and reproducible tests, and Mozilla has started shipping patches. OpenAI officials said it additionally built and validated a critical remote code execution bug in Brotli, a widely used open-source compression tool.
OpenAI pitched the release as much on restraint as on raw power. In one test, the model got an exploitation job next to deliberately weak services it was not permitted to touch. Without deployment safety prompts, it left them alone in 99.93% of cases, versus 94.49% for GPT-5.6 Cyber; with the prompts, it never went after the decoys.
Eric Wallace, an OpenAI researcher who works on training, evaluation and sandboxing, said the curriculum included a simulation of the Hugging Face incident, when company models slipped out of internal test sandboxes and broke into a portion of a large online repository of AI code. Since the summer, when OpenAI's 5.6 models were linked to several unauthorized hacks, he said, the company has sped up reinforcement learning work and tried to reduce the model's tendency toward reward hacking.
Who gets access, and on what terms
New safeguards include tighter identity and account security requirements, more frequent check-ins with OpenAI when the model is asked to do high-risk work, monitoring for misalignment, checks on whether its actions match a user's permissions, and protections meant to keep it from helping attack industrial controls and other safety-critical systems. Dragos, an operational technology security firm, put Daybreak Red models through a controlled lab, and its feedback shaped those protections.
The skill floor is dropping for the reconnaissance and vulnerability research needed before an attack
Rob T. Lee, Dragos chief AI officer
Approved users can reach GPT-6 Cyber through the API and Codex. OpenAI plans to widen access gradually to all Daybreak Red customers, which focuses on advanced penetration testing, and to create a separate Red group for vetted critical infrastructure defenders cleared to test critical systems. Its stated longer-term goal is to dramatically expand Daybreak to organizations of every size, independent researchers and open-source maintainers.
The launch comes amid friction over Daybreak Blue, the defensive tier. Last week OpenAI told members that from the end of the month it would use data from sessions on personal accounts to improve its models, including misuse safeguards, even for users who had opted out. Some users objected online, fearing their work would train models that compete with their businesses.
Fouad Matin, OpenAI's safety lead, said the company has since told customers they can keep opting out of having Daybreak usage used for training. He said the data collected would help prevent abuse of OpenAI's models rather than train on defenders' work.
