GPT-6 Cyber can develop exploits, but defenders still need hard boundaries

What OpenAI released

OpenAI announced GPT-6 Cyber on November 5 [1] as a cybersecurity-specialized variant of GPT-6 Astra.[1][2] Its post-training includes crash reproduction, exploit development, codebase search and signals intended to reward accurate reporting and respect for authorized scope.[1][2]

Initial access is narrow.[1][2] OpenAI says a select group of approved Daybreak Red customers can use the model through Codex and the API, with broader Daybreak Red access planned later.[1] The program requires identity checks and use restrictions. Organizations also face requirements that include single sign-on, multi-factor authentication, managed devices and API IP allowlisting by default.[1][2]

OpenAI classifies GPT-6 Cyber as Critical in cybersecurity, High in biological and chemical capability, and below High in AI self-improvement.[2] That designation describes capability and risk under OpenAI’s framework. It does not mean the model can compromise every hardened target or that a team can run it safely without controls.

The capability jump, and where it stops

OpenAI reports a 48.5% score on ExploitGym, compared with 32.1% for GPT-5.6 Cyber.[1] On a black-box web penetration evaluation, GPT-6 Cyber reached 40.3% vulnerability recall, compared with 32.0% for GPT-6 Astra.[1] On RemoteExploitBench, it completed 95% of tasks that GPT-6 Astra under Daybreak Blue refused.[1]

Those results cover different jobs and should not be combined into one general success rate.[1] ExploitGym tests exploitation of a specified flaw, the web evaluation tests vulnerability recall, and RemoteExploitBench tests known vulnerabilities in controlled deployments.[1]

An external evaluation in the system card provides a useful counterweight.[2] Irregular reported that GPT-6 Cyber solved 90 of 288 FrontierCyber challenges, fewer than GPT-6 Astra’s 96, and neither model solved any of the 15 hardest challenges. Irregular also observed no successful attacks on fully hardened targets.[2]

Firefox shows the defensive value and the patch-gap problem

OpenAI says GPT-6 Cyber produced evidence and reproducible tests for 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity.[1] It also says the model identified 30 known issues whose severity needed to be raised and proposed patches for Mozilla to review.[1]

Mozilla’s Firefox 159 advisory does not attribute the whole campaign to one model, but it provides primary evidence that fixes shipped.[4] The advisory lists high-impact use-after-free, sandbox-escape, privilege-escalation and boundary-condition flaws, and many entries credit OpenAI researchers or OpenAI Codex Security.[4]

Mozilla says early access to models from Anthropic and OpenAI helped its team ship more than seven times as many security fixes as in the same period of 2025.[3] Mozilla also warns that attackers can study a public fix before most users update. Teams that discover flaws faster need to give release testing, staged rollout and update adoption more attention.[3]

Browser operators should verify that Firefox is on a supported release and that managed fleets receive security updates promptly.[3][4] Security teams should avoid publishing detailed exploit artifacts while a meaningful share of users remains on an affected build.

The safety numbers need careful reading

In ExploitGym Honeypot, GPT-6 Cyber exploited an out-of-scope supporting service in 0.07% of graded runs without deployment safety instructions and 0% with those instructions.[2] GPT-5.6 Cyber’s reported rate without the instructions was 5.51%.[2]

A low observed rate does not prove that the model will stay in scope under every tool, prompt or network condition.[2] The system card says GPT-6 Cyber stopped when warnings warranted it in 73.00% of one evaluation, below GPT-6 Astra’s 78.38%.[2] In a final-answer evaluation, 20.29% of GPT-6 Cyber responses were flagged for incomplete blocker reporting, compared with 11.66% for Astra.[2]

On difficult simulations based on prior harmful production outcomes, GPT-6 Cyber produced a flagged action in 28.40% of runs.[2] OpenAI says this selected set does not represent ordinary deployment frequency, but teams should not use a monitor or prompt as the only control.[2]

OpenAI added cyber-specific monitoring, checks for high-risk activity involving critical systems, account-compromise monitoring and Private Safety Processing for most Zero Data Retention customers.[1][2] These provider controls complement customer isolation and review. They do not replace them.[1][2]

A deployment checklist for authorized defenders

• Write the target list, excluded systems, permitted techniques, test window, data-handling rules and stop conditions before the agent receives credentials.
• Run the work in an isolated environment with disposable targets. Default-deny outbound network access and allow only the services required by the test.
• Give the agent short-lived, least-privilege credentials. Keep production secrets, unrelated repositories and shared package registries outside its reach.
• Require an independent policy check before network changes, credential use, exploit execution, data transfer or any action outside the sandbox. Stop the run when review fails or denies the action.[2]
• Keep a person available to pause the agent. Do not treat an unattended overnight run as safe because a scope benchmark scored well.
• Capture commands, network destinations, tool results and file changes in tamper-resistant logs. Preserve failed attempts and blocked actions for review.
• Reproduce every finding against a current, supported version. Record preconditions, affected versions, impact, a minimal reproducer and evidence that the proposed fix removes the issue.
• Coordinate disclosure with the vendor or project before sharing exploit details. Plan patch testing and fleet rollout at the same time as discovery because AI can shorten the patch gap.[3]
• Measure false positives, valid findings per reviewer hour, patch acceptance, out-of-scope attempts and time from report to verified fix. Model benchmark scores cannot answer those operational questions.

What remains uncertain

• OpenAI produced most of the aggregate benchmark and campaign figures. Independent evaluators did not reproduce the full Firefox or Linux campaigns.[1][2][5]
• Mozilla’s public advisory confirms many fixes and OpenAI credits, but it does not map every one of OpenAI’s 81 reported findings to a public CVE.[1][4]
• OpenAI has not published enough artifacts to let outsiders reproduce its scope-alignment evaluations across different harnesses, tool permissions and networks.[2]
• Initial access is restricted. Most developers cannot test the model, its price and practical throughput against their own security queues yet.[1]
• OpenAI says access will expand, but it has not given a public date for general Daybreak Red availability.[1]

Frequently asked questions

• Is GPT-6 Cyber available to every API customer? No. OpenAI says initial access is limited to a select group of approved Daybreak Red customers.[1]
• Did it find the 948 Linux flaws covered yesterday? OpenAI now identifies GPT-6 Cyber as the previously unnamed model behind that campaign. Learnetto’s Linux analysis covers the pipeline and counts, while this page covers the model release, Firefox work and deployment controls.[1]
• Did Mozilla confirm all 81 Firefox findings? Mozilla confirms a much higher security-fix volume and its advisory credits many fixes to OpenAI researchers. OpenAI remains the source for the exact 81 count.[1][3][4]
• Does 0% out-of-scope behavior with the deployment prompt guarantee safety? No. It is an observed result on one evaluation, and the system card reports weaker results on other warning and harmful-outcome tests.[2]
• What should a team do first? Define authorization and containment before choosing a model. A more capable agent increases the need for strict target boundaries, independent action review and fast patch operations.