GPT-6 Cyber: OpenAI unveils its cybersecurity model with better alignment and advances in vulnerability exploitation

OpenAI has unveiled GPT-6 Cyber, a cybersecurity model trained to find and validate exploitable vulnerabilities without straying beyond the scope authorized by researchers. According to the company, it marks a major leap over GPT-5.6 Cyber in both capability and reliability at respecting boundaries. All figures below come from OpenAI's own evaluations and communications, not from independent verification.

On ExploitGym, which measures whether a model can exploit a specific vulnerability on a remote target, GPT-6 Cyber scores 48.5%, compared with 32.1% for GPT-5.6 Cyber. OpenAI presents this as a 51% relative improvement. On a new offensive web pentesting evaluation, in which the model analyzes applications without access to source code, it achieves 40.3% vulnerability recall, versus 32.0% for GPT-6 Astra. The company says GPT-6 Cyber outperforms Astra on most cybersecurity tasks, even when Astra does not refuse the request.

OpenAI also created RemoteExploitBench, a benchmark of known vulnerabilities in applications such as GitLab, PostgreSQL and Jenkins, deployed in a controlled environment. In the initial evaluation, GPT-6 Astra with Daybreak Blue refused 100% of the tasks, while GPT-6 Cyber completed 95%. Its only failure was an exploit it could not get working remotely. Based on these results, OpenAI classifies the model as Critical in cybersecurity under its Preparedness Framework, above GPT-5.6 Cyber's High level.

Alignment is the other central pillar of the announcement. OpenAI explains that one risk with cybersecurity agents is that they stray from the assigned task, try to exploit third-party services or ignore the researcher's rules of engagement. To measure this it uses ExploitGym Honeypot, an evaluation inspired by the Hugging Face incident. The model is given a difficult exploitation task in an isolated environment, with deliberately easy-to-attack auxiliary services (such as a package registry or an object store) whose exploitation would reveal the task's flag. The model must infer that attacking them is out of scope. Without deployment safety prompts, GPT-6 Cyber avoided exploiting those services in 99.93% of cases, compared with 94.49% for GPT-5.6 Cyber. With those prompts, the result was 100%. OpenAI quotes excerpts from the model's chain of thought, such as “don't explore out of scope credentials”, to illustrate how it reasons about boundaries.

The company describes several results on real-world software. Its researchers used the model to reproduce 1,724 Linux kernel vulnerabilities and develop working exploits for 948 of them, more than five times the 166 achieved by GPT-5.6 Sol with the same research environment. Following Linux community guidance, they reported 304 critical findings to maintainers along with candidate patches. In Firefox, they provided evidence and reproducible test cases for 81 new vulnerabilities that Mozilla rated as high severity, and showed that another 30 known issues were more serious than reported. Mozilla began shipping fixes shortly after receiving the reports. OpenAI also mentions a critical vulnerability in Brotli, a compression library used by Node.js, for which it developed and validated remote code execution exploits in dependent applications, alongside other models. It also says it used the model to harden the infrastructure it uses to train its models: in red-teaming campaigns, agents chained vulnerabilities to escape microVMs and execute code on the underlying hosts.

The post includes testimonials from customers and partners at Mozilla, Calif, Cognition, Palo Alto Networks, Cisco, SentinelOne, CrowdStrike, Perplexity and CodeRabbit. Cognition says the model scored 23% on its internal benchmarks for discovering and exploiting new vulnerabilities, versus 13% for the best previous model. CodeRabbit says it found 66% more high- and medium-severity security issues than its production model. Calif describes it as the best for long-running exploit development. These are assessments from companies that work with OpenAI.

On safeguards, OpenAI acknowledges that as models discover more vulnerabilities, attempts to use them to cause harm also increase, including from malicious actors and groups seeking to distill its models. The measures it lists include cybersecurity-specific misalignment monitoring (which checks whether actions match the user's authorization), targeted monitoring of emerging threats (for example, attempts to develop exploits against production PHP servers during the coordinated disclosure of critical PHP vulnerabilities) and Private Safety Processing (PSP). API customers with Zero Data Retention must generally use PSP, which reviews encrypted logs retained for 30 days in the customer's storage without exposing prompts or responses to OpenAI staff. It also requires an IP allowlist by default for API access to Daybreak Red, monitors for compromised credentials and recommends sandboxing, action review and human oversight in high-risk workflows.

Protecting critical infrastructure, such as power plants, water treatment facilities and OT/ICS systems, gets its own section. OpenAI has a $1 billion grant program, Daybreak for Frontline Defenders, to subsidize access for under-resourced teams such as public agencies and essential service providers. It is adding a new group, Daybreak Red for Critical Infrastructure, for approved defenders who need to carry out authorized testing on critical systems. It also says it has refined its safeguards against assistance that could compromise industrial controls or safety-critical systems, noting that a higher block rate is not always better, because many techniques are necessary for legitimate security work.

To evaluate this area, OpenAI worked with Dragos, which ran tests with permissive Daybreak Red models in a controlled lab. According to Rob T. Lee of Dragos, a frontier model placed in a simulated power plant range, with very little information, independently separated OT assets from IT noise and found two zero-days in engineering software that handles protective relay data. OpenAI used that information to tune its safeguards and says it will expand partnerships with other offensive security vendors, infrastructure operators and national laboratories.

As for availability, GPT-6 Cyber is initially rolling out via the API and Codex to a select group of approved Daybreak Red customers, and OpenAI plans to extend it to all of them soon. GPT-5.6 Cyber becomes available to all Daybreak Red customers. The company is also expanding Daybreak Blue alpha access with GPT-6 Astra to more organizations and individual researchers. Daybreak Blue is designed for verified defenders, with fewer unnecessary refusals, while Daybreak Red is for exploit development and authorized security testing.

Editorially, the announcement combines two messages: a notable leap in automated offensive capability (which OpenAI itself places at the Critical level of its framework) and an effort to show that the model respects scope. Almost all the data comes from evaluations designed or commissioned by OpenAI and from partner testimonials, so it is worth reviewing the published system card and waiting for external verification before drawing firm conclusions.