OpenAI rates GPT-6 Cyber Critical in cybersecurity and limits it to vetted Daybreak Red users

Given an off-limits service to attack, it went after it in 0.07% of runs, down from 49.5% for GPT-5.6 Sol.

By Think Facility · November 5, 2026 · OpenAI Cybersecurity

On November 5, 2026, OpenAI published the system card for GPT-6 Cyber, a version of GPT-6 Astra trained for authorized security work such as finding vulnerabilities, writing exploits and web pentesting. It's only available to approved users and organizations in Daybreak Red, OpenAI's vetted program for cyber-specialized models.

OpenAI gives it the same Preparedness ratings as Astra, which means Critical in cybersecurity. The number that stands out is about scope. In a test where breaking into a side service was off limits, GPT-6 Cyber did it in 0.07% of runs. GPT-5.6 Sol did it in 49.5%.

Model: GPT-6 Cyber, a variant of GPT-6 Astra
Published: Nov 05, 2026
Access: approved Daybreak Red users and organizations
Cybersecurity rating: Critical
AI Self-Improvement: below High
Outside testers: NIST CAISSI and Irregular

How much better it is

Ahead of Astra, but not by much. On SEC-Bench Pro, which asks models to find bugs in big JavaScript engines including V8 and SpiderMonkey, it scores 87.02% to Astra's 85.38%. On ExploitGym it lands the intended exploit 48.45% of the time against 42.43%, and on a hardened version with stronger mitigations, 36.94% against 29.69%.

Fresh bugs are still hard for it. On an internal test built from recently disclosed V8 and Chrome flaws, to cut down on models having seen the answers, it reaches code execution 42% of the time to Astra's 39%. OpenAI says reliable exploitation there remains challenging.

Irregular, one of the two outside testers, found GPT-6 Cyber solved all 11 of its long-horizon scenarios at least once, where Astra managed 8. On FrontierCyber, which uses real software and hardware, it actually solved fewer: 90 of 288 challenges to Astra's 96.

Successful attacks included zero-day vulnerabilities affecting browsers, mobile phones, and cloud databases. However, Irregular observed no successful attacks on fully hardened targets, and neither model solved any of the 15 highest-difficulty challenges.

From GPT-6 Cyber System Card

Staying inside the job

The honeypot test is OpenAI's ExploitGym Honeypot. It adds a side service the model may use for support tasks but mustn't exploit. Without safety instructions GPT-6 Cyber exploited it in 0.07% of graded runs, against 5.51% for last generation's GPT-5.6 Cyber and 0% for Astra. With the instructions, 0%.

It isn't better everywhere. It's slightly less likely than Astra to stop when a tool warning says it should (73.00% against 78.38%), and it was flagged for leaving blockers out of its final answer in 20.29% of graded responses, where Astra was flagged in 11.66%. OpenAI reviewed the flagged cases and says most were incomplete summaries, since the model had mentioned the blocker earlier. That's OpenAI grading its own model, so I'd hold it loosely.

Who gets to use it

Getting in is deliberately hard. Individuals need an invitation, identity and liveness checks and at least one physical FIDO2 security key. Organizations need single sign-on, multi-factor authentication and managed devices, and API access is locked to approved network addresses by default.

OpenAI also added checks that block high-risk help involving industrial controls, essential services and election systems, and it tested them with Dragos, an industrial control security firm. Biological safety mode is on for every GPT-6 Cyber user.

What it means for the software you run

The defenders who've had these models longest are already shipping more fixes. Mozilla's Bobby Holley wrote on October 29, 2026 that the Firefox team has worked since February with early access to frontier models from Anthropic and OpenAI, and has shipped more than seven times as many security fixes as in the same period of 2025.

He also described the catch for everyone else. Attackers can work backwards from a published fix to the bug it closes and hit people who haven't updated yet, and models are making that easier. Firefox cut its release cycle to weekly in response.

much of the software that powers the internet has not had the luxury of these preparations, and is now more deeply exposed

Defending the patch gap against automated attackers

Holley's post doesn't name GPT-6 Cyber, which came out a week later. Customers running it under OpenAI's Private Safety Processing keep the encrypted safety records in their own storage for 30 days.