GPT-6 Cyber

GPT-6 Cyber was announced on November 5, 2026 as a cybersecurity model trained to find and validate exploitable vulnerabilities while staying inside the scope a researcher sets. OpenAI offered it first through the API and Codex to a select group of approved Daybreak Red customers, and said access would widen to all Daybreak Red customers. The same announcement said GPT-5.6 Cyber was being made available to every Daybreak Red customer. OpenAI rated GPT-6 Cyber Critical for cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber, and said it outperformed GPT-6 Astra on most cyber tasks. The system card also carried forward High, not Critical, for biological and chemical capabilities, and below High for AI self-improvement.

At release, OpenAI reported 48.5% on ExploitGym, the share of tasks that exploited a specified vulnerability in a remote target, against 32.1% for GPT-5.6 Cyber. The system card states that result as a 48.45% intended-exploit success rate, and 36.94% on a hardened ExploitGym variant with stronger mitigations. On RemoteExploitBench, GPT-6 Cyber completed 95% of tasks; the launch post said GPT-6 Astra running with Daybreak Blue refused every task. A separate, unnamed web penetration test without source code recorded 40.3% vulnerability recall, against 32.0% for GPT-6 Astra. On ExploitGym Honeypot, GPT-6 Cyber stayed in scope in 99.93% of tests without a deployment prompt and 100% with one, compared with 94.49% for GPT-5.6 Cyber without the prompt. OpenAI also said the model had identified 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 Linux kernel vulnerabilities. The API documentation listed a 1,050,000-token context window, text and image inputs, and text output. For approved organizations, short-context rates were $20 per million input tokens and $100 per million output tokens; long-context rates were not published.