OpenAI’s GPT-6 Cyber is now available to selected, approved security teams through its API and Codex. Researchers can use it to find software flaws, test whether they can be exploited and work on fixes. OpenAI has also trained it to stay within the researcher’s authorised targets.
The 5 November announcement names it as the model behind OpenAI’s recent Linux kernel research. OpenAI reports working exploits for 948 distinct Linux vulnerabilities and 81 previously unknown high-severity Firefox vulnerabilities. Mozilla has begun shipping fixes for the Firefox findings.
Who gets access, and what it costs
GPT-6 Cyber is a specialised version of GPT-6 Astra for approved security researchers. OpenAI says access begins with selected customers in Daybreak Red, its vetted programme for more advanced authorised security work, and will expand to other Red customers. The announcement gives no fixed date for that wider access.
With Daybreak Blue, verified defenders can investigate vulnerabilities and check fixes with fewer refusals. Red also allows deeper exploit development and authorised testing. Both programmes require approval.
The model documentation lists standard short-context rates of $20 per million input tokens, $2 for cached input and $100 per million output tokens. Tokens are the chunks of text a model processes. A full investigation also involves repeated attempts, test environments and human review.
The system card sets out additional access requirements. Organisations must use single sign-on, multi-factor authentication and managed devices, among other controls. Individual access is limited to invited applicants who pass identity and suitability checks; they also need a physical FIDO2 security key. Daybreak Red API access requires approved network addresses by default, with exceptions.
What the Linux and Firefox results show
OpenAI’s Linux research report, published the day before the model launch, describes a pipeline rather than a single prompt. Agents searched code, reproduced suspected flaws in isolated systems, tested exploitability and proposed patches. Human researchers reviewed the results before reporting them to maintainers.
The pipeline started with 2,308 candidate findings, reproduced 1,724 vulnerabilities and produced 1,169 working local privilege-escalation exploits. OpenAI grouped the underlying issues into 948 distinct vulnerabilities using patch and variant analysis. Local privilege escalation lets someone with an existing foothold on a machine gain root, or administrator-level, control.
The run cost $1,213,430 in API credits, or about $1,279 per distinct vulnerability with a working privilege-escalation exploit. OpenAI says the end-to-end run prioritised measuring capability rather than minimising cost.
In an early run, human reviewers found that 20 of 200 apparently successful exploits had gained root through a different vulnerability from the one assigned. OpenAI then tightened the constraints and added an independent check of the vulnerability each exploit actually used.
The Firefox evidence has a separate maintainer record. OpenAI says Mozilla classified 81 newly reported flaws as high severity and began incorporating fixes. Mozilla’s Firefox 159 advisory, dated 27 October, lists fixes and credits OpenAI researchers and OpenAI Codex Security for multiple findings. The advisory records specific fixes; the 81-flaw total comes from OpenAI.
The benchmark gains, with their limits
OpenAI reports a rise from 32.1% to 48.5% on ExploitGym, which tests whether a model can exploit an assigned vulnerability. That is a 16.4-percentage-point increase.
| Test | GPT-6 Cyber | Comparison | What to keep in mind |
|---|---|---|---|
| ExploitGym, launch figures | 48.5% | GPT-5.6 Cyber: 32.1% | Assigned vulnerabilities in a test environment, not a universal exploitation rate. |
| ExploitGym Hardened | 36.94% | GPT-6 Astra: 29.69% | Stronger defences change the result. |
| Irregular’s long-horizon CyScenarioBench | 11 of 11 challenges solved at least once; 61% average success | Astra: 8 of 11 solved at least once | Solving each task at least once is not the same as succeeding on every attempt. |
| Irregular’s FrontierCyber | 90 of 288 challenges solved | Astra: 96 of 288 | Cyber does not lead Astra on every evaluation. |
In its own X post, evaluator Irregular confirmed the FrontierCyber limits: “In our FrontierCyber evaluations, neither GPT-6 Cyber nor GPT-6 Astra solved any of the 15 highest-difficulty challenges, and we observed no successful attacks on fully hardened targets.” Irregular worked with OpenAI on the assessment.
OpenAI classifies GPT-6 Cyber as “Critical” for cybersecurity under its Preparedness Framework. This capability-risk category also applies to GPT-6 Astra.
What other researchers are reporting
OpenAI vulnerability researcher kylebot described work beyond the Linux run: “We are using this technology to scan more OSS projects and secure the Internet infrastructure.” OSS means open-source software. The post describes the team’s ongoing plans.
Security-testing company XBOW has also reported a separate web-application experiment. Its founder, Oege de Moor, said the company tested GPT-6 Cyber against a Sol model on 65 vulnerable open-source applications. Among the 56 targets both models solved, Cyber was faster on 44, typically by about two times.
Speed came at a cost in XBOW’s setup. De Moor reported roughly $17 for Cyber to find half the exploits, versus roughly $1 for Sol. Given more time, the final solve rates were about 86% and 89%. His conclusion was: “Our initial take: use GPT-6 Cyber when speed matters more than cost.” These are XBOW’s web-application results, not a test of Linux or browser exploit development.
How OpenAI tests authorised scope
The launch also highlights an ExploitGym Honeypot test. Researchers put an easy-to-exploit supporting service beside a difficult assigned target. The model could use that service legitimately, but attacking it was outside the job’s authorised scope.
Without deployment safety instructions, GPT-6 Cyber exploited the off-limits service in 0.07% of graded runs, compared with 5.51% for GPT-5.6 Cyber. With those instructions, its observed rate was zero. The test measures whether the model respects the boundary set by the researcher.
On X, Channel Automation co-founder and chief technology officer Benjie Malinao cautioned: “that last number is a lab score, not a sandbox.”
Technical writer Adham also focused on the test design, noting that a small number of clean runs says little about rare failures.
OpenAI’s own recommendations point in the same direction: isolate the agent, limit its access to systems and credentials, review sensitive actions and keep a human able to stop high-risk work. Its safety results also vary by task. On a separate warnings test, Cyber stopped when it should in 73% of cases, compared with Astra’s 78.38%.
The privacy and operational checks before use
Teams handling sensitive source code should read the retention rules as closely as the benchmark table. OpenAI says standard retention is the default. API customers using Zero Data Retention generally must use Private Safety Processing, subject to limited exceptions. That involves encrypted safety records kept in the customer’s own storage for 30 days and reviewed automatically without exposing prompts and responses to OpenAI personnel.
Critical-infrastructure testing has further restrictions. OpenAI says safeguards target assistance that could endanger industrial controls, essential services or election systems. Testing still requires the owner’s authorisation.
We have not tested GPT-6 Cyber. The figures are attributed to OpenAI and the named evaluators. These sources do not establish patch coverage for every reported finding.
If your team gets access, check findings against the latest code and reproduce the exploit before accepting its proposed patch. The Linux review shows why identifying the exact flaw matters.
Sources
- OpenAI: GPT-6 Cyber announcement, 5 November 2026
- OpenAI: GPT-6 Cyber system card
- OpenAI: model access and API pricing
- OpenAI: A thousand fewer paths to root, 4 November 2026
- Mozilla: Firefox 159 security advisory, 27 October 2026
- OpenAI: launch post on X
- Benjie Malinao: reaction on X
- Adham: discussion of scope testing on X
- Irregular: direct evaluation statement on X
- OpenAI researcher kylebot: ongoing open-source research
- XBOW founder Oege de Moor: 65-application test
- XBOW: time to solve comparison
- XBOW: cost and final solve rates
- XBOW: conclusion and use cases
Discover more from Sulat — AI & Tech News
Subscribe to get the latest posts sent to your email.
