OpenAI Launches GPT-6 Cyber With Critical Security Rating
Released on November 5, 2026, the model carries a “Critical” cybersecurity capability rating under OpenAI’s Preparedness Framework. This marks a significant step in the company’s development of AI systems for advanced cybersecurity research.
Initially, OpenAI is making GPT-6 Cyber available to a limited group of approved customers through its Daybreak Red programme. The company plans to expand access to other eligible security teams in the coming weeks.
The model targets authorised security researchers, vulnerability analysts and organisations responsible for protecting critical digital infrastructure. Moreover, it combines advanced vulnerability research capabilities with safeguards designed to prevent unauthorised cyber activity.
GPT-6 Cyber Identifies Firefox and Linux Vulnerabilities
One of the most significant results involves Mozilla Firefox. OpenAI researchers used GPT-6 Cyber to identify 81 previously unknown vulnerabilities in the browser.
Mozilla classified these vulnerabilities as high severity and has begun releasing security fixes. Additionally, OpenAI reported that the model identified 30 existing Firefox issues whose severity exceeded earlier assessments.
The model also demonstrated capabilities in Linux kernel security research. It helped researchers develop working exploits for 948 Linux kernel vulnerabilities, including 588 previously unknown issues.
OpenAI also disclosed 304 critical findings to software maintainers, along with proposed patches. These disclosures could help developers address weaknesses before malicious actors exploit them.
The findings show how specialised AI models can speed up vulnerability discovery across widely used software. However, security researchers must still validate findings and review proposed fixes before deployment.
Model Receives Critical Cybersecurity Classification
OpenAI’s Preparedness Framework classifies GPT-6 Cyber as Critical for cybersecurity capabilities. This is an increase from the High classification assigned to GPT-5.6 Cyber.
The model also recorded improvements across several security benchmarks:
-
ExploitGym: Scored 48.5%, compared with 32.1% for GPT-5.6 Cyber.
-
Web penetration testing: Achieved 40.3% vulnerability recall, compared with 32% for GPT-6 Astra.
-
RemoteExploitBench: Completed 95% of tasks involving controlled deployments of GitLab, PostgreSQL and Jenkins.
These results demonstrate stronger capabilities in vulnerability discovery and exploit development. However, they also raise concerns about potential misuse by malicious actors.
To address these risks, OpenAI has introduced additional security controls. These include cyber-specific monitoring, credential protections, IP allowlisting and sandboxing.
The company has also trained the model to respect authorised testing boundaries. In ExploitGym Honeypot evaluations, GPT-6 Cyber avoided out-of-scope services in 99.93% of tests without an additional deployment safety prompt. With the prompt, it maintained authorised boundaries in 100% of tests.
Furthermore, OpenAI requires human oversight for sensitive security operations. These measures aim to prevent the model from supporting unauthorised access or extending attacks beyond approved environments.
Limited Access Through OpenAI’s Daybreak Programme
OpenAI is initially restricting GPT-6 Cyber to selected Daybreak Red customers. The programme supports advanced, authorised cybersecurity activities, including penetration testing and exploit development.
Eligible customers can access the model through OpenAI’s API and Codex. Meanwhile, the company plans to expand availability to all approved Daybreak Red customers over the coming weeks.
OpenAI is also making GPT-5.6 Cyber available to all Daybreak Red customers. This provides security teams with broader access to its earlier specialised cybersecurity model.
The company is working with cybersecurity organisations, including Mozilla, Palo Alto Networks, Calif and Cisco. These collaborations support vulnerability research, security testing and code review.
Additionally, OpenAI is forming a Daybreak Red group for approved defenders of critical infrastructure. It supports broader defensive access through its $1 billion Daybreak for Frontline Defenders grant programme.
The launch reflects a growing shift towards AI-assisted cybersecurity. Security teams can use specialised models to identify weaknesses and develop fixes more quickly.
Nevertheless, attackers could use the same capabilities to discover vulnerabilities and develop sophisticated exploits. Therefore, controlled access, continuous monitoring, and responsible deployment will remain central to adopting advanced cybersecurity AI.
