On Nov. 5, OpenAI released a security-research model that it rates at the highest risk level it has used for cybersecurity. The company calls it GPT-6 Cyber. Under OpenAI's Preparedness Framework, the internal system it uses to grade a model's capacity for harm, GPT-6 Cyber is classified "Critical" for cybersecurity, up from "High" for its predecessor, GPT-5.6 Cyber. OpenAI's answer to that rating is to limit who can use it. For now the model is available through the API and Codex only to select, approved customers of its Daybreak Red program, and wider access is planned, according to TestingCatalog.

The launch also comes with a large number. OpenAI says its researchers used the model to develop 948 privilege-escalation exploits in Linux and to identify 81 previously unknown high-severity vulnerabilities in Firefox. Nearly every figure in the announcement comes from OpenAI's own testing, so they should be read as vendor claims, not independent results.

One model, two names

The coverage doesn't agree on what the model is called. OpenAI's announcement page, read here through an archived copy, says GPT-6 Cyber. TechCrunch calls it "ChatGPT Cyber." This article uses OpenAI's name. If you're comparing vendor briefings or procurement documents, both names appear to refer to the same release.

What OpenAI is claiming

OpenAI rests its case on internal benchmarks and one large real-world exercise.

  • ExploitGym. On this exploit-development benchmark, GPT-6 Cyber scored 48.5%, compared with 32.1% for its predecessor, GPT-5.6 Cyber. heise online adds that GPT-6 Astra, OpenAI's general-purpose model, scored 42.4%.
  • Web penetration testing. OpenAI reports vulnerability recall of 40.3% in black-box testing, against 32.0% for GPT-6 Astra. Recall is the share of real vulnerabilities the model actually found.
  • RemoteExploitBench. GPT-6 Cyber completed 95% of the tasks, run against controlled deployments of software including GitLab, PostgreSQL and Jenkins.

The Linux results get more detail from OpenAI's announcement and TestingCatalog. According to those accounts, the model reproduced 1,724 Linux kernel vulnerabilities and developed working exploits for 948 of them. GPT-5.6 Sol managed 166 using the same research harness. OpenAI also says it disclosed 304 critical findings to maintainers along with candidate patches. TechCrunch describes the same exercise more cautiously, saying the model scanned the kernel and found 948 "potential issues." That gap matters. "A working exploit" and "a potential issue" are very different claims. OpenAI's own page uses the stronger wording, and no independent party has verified it.

OpenAI says the Firefox findings were 81 previously unknown high-severity bugs, and that Mozilla has released fixes for many of them. TechCrunch describes them as "novel."

The guardrail question

A model that writes exploits is only useful to defenders if it stays inside the engagement it was given. OpenAI says GPT-6 Cyber avoided out-of-scope services in 99.93% of tests without a deployment safety prompt, the standing instructions that define what it's allowed to touch, and in 100% of tests with that prompt in place. heise frames the same data another way: the model exceeded its limits in under 1% of cases, compared with about 5% for its predecessor, according to OpenAI.

That is a real improvement if it holds up. Still, 99.93% is not 100%. Across thousands of automated runs, a small failure rate means the model will sometimes go somewhere it shouldn't. Anyone who deploys it on an engagement should treat the deployment prompt as required and keep strict network-level scoping in place no matter what the model promises.

Red, Blue and a billion dollars

OpenAI sells access in tiers. Daybreak Red is the offensive-research tier, which OpenAI says enables "deeper exploit development" and authorized security testing. Daybreak Blue is for verified defenders, with fewer unnecessary refusals when validating vulnerabilities and fixes. Along with the launch, TestingCatalog reports that GPT-5.6 Cyber is now available to all Daybreak Red customers, not only a selected subset.

OpenAI also announced Daybreak for Frontline Defenders, a $1 billion grant program. In OpenAI's description it subsidizes access for resource-constrained teams such as government organizations and essential service providers, while TechCrunch describes it as supporting professionals who work on critical infrastructure like the electrical grid or water systems. The sources we read don't say how the money will be distributed or who qualifies. OpenAI names Cisco, Calif and CodeRabbit as organizations already using the model.

A view from the Blue tier

TechCrunch adds a practitioner's view to the vendor numbers. Max Justicz, CTO of Charge Robotics, used GPT 5.6 Sol through Daybreak Blue and found a severe vulnerability in code maintained by the Debian Project that could let attackers take control of servers running Ubuntu. He reported it to Debian, and it has been patched. There is no known evidence of exploitation. He told TechCrunch he spent about $5,000 on subscriptions and tokens to find several exploits, and he said OpenAI appears to have recently "nerfed" Daybreak Blue to make it less useful at finding vulnerabilities.

His account shows both sides of the tiering. Even a restricted tier turned up a real bug in widely deployed open-source code. But the strongest capabilities are reserved for the Red tier, and getting in requires OpenAI's approval. Small security teams, and the volunteer maintainers who own most of this code, may find the cost and the vetting process hard to get past.

What It Means for Defenders

Most organizations won't get access to GPT-6 Cyber. The patching work it produces reaches everyone anyway. Here is what to do now:

  • Update Firefox now. OpenAI says Mozilla has released fixes for many of the reported high-severity flaws. The sources we read don't list specific Firefox version numbers, so confirm that managed fleets are on Mozilla's current release (or the current ESR, if you use the Extended Support Release) and that auto-update isn't being held back by policy.
  • Patch Debian and Ubuntu systems. The flaw Justicz found in Debian-maintained code, which could affect Ubuntu servers, has been patched. The sources don't name the package or the fixed version, so the safe step is to apply current security updates across Debian- and Ubuntu-based servers, containers and images.
  • Watch for a run of kernel fixes. If OpenAI's figure of 304 critical findings sent to maintainers with candidate patches is accurate, expect a steady stream of upstream kernel and distribution security updates. Privilege-escalation bugs turn a minor foothold into full root access. Shorten your kernel patch cycle, plan the reboots it requires, and prioritize multi-user and internet-facing hosts.
  • Assume attackers will get similar capability. OpenAI is gating this model, but the benchmark results suggest that AI-assisted exploit development is improving quickly. The time between disclosure and a working exploit is likely to keep shrinking, which favors fast patching and good asset inventory over waiting for a quarterly maintenance window.
  • If you plan to use these tools, govern them. Teams applying to Daybreak Blue or Red should write down scope, require the deployment prompt, sandbox targets at the network layer, and log model actions. OpenAI's own numbers show the model is not perfectly reliable at staying in scope. Federal contractors working through CMMC should treat AI-driven testing tools like any other privileged tool in their system security plan.
  • Critical-infrastructure and public-sector operators should ask about the subsidy. OpenAI says the $1 billion Daybreak for Frontline Defenders program targets resource-constrained teams such as government organizations and essential service providers, though public details on eligibility are thin so far.

Last, read the benchmarks with appropriate skepticism. ExploitGym, RemoteExploitBench and the kernel figures all come from OpenAI's testing, and the outlets reporting them don't agree on how to describe the kernel results. Until outside researchers reproduce them, they show which direction the technology is heading, not how capable it reliably is.

Sources