A classification OpenAI has not used before
OpenAI released GPT-6 Cyber on 5 November, a model trained to find and validate exploitable vulnerabilities, and classified it Critical in cybersecurity under its Preparedness Framework. Its predecessor, GPT-5.6 Cyber, was rated High. The company’s framework reserves Critical for capabilities it considers capable of severe harm, and this is the first model OpenAI has placed in that tier for cyber.
The capability numbers are OpenAI’s own. On ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target, the company reports 48.5% for GPT-6 Cyber against 32.1% for GPT-5.6 Cyber. On a new offensive web penetration-testing evaluation OpenAI built, in which models probe applications without their source code, it reports 40.3% recall of vulnerabilities against 32.0% for the general-purpose GPT-6 Astra.
OpenAI also published results from RemoteExploitBench, another evaluation of its own making, which deploys known flaws in GitLab, PostgreSQL and Jenkins in a controlled environment. In that initial run the company says GPT-6 Astra, running under its Daybreak Blue access tier, refused all of the tasks, while GPT-6 Cyber completed 95% of them.
The alignment number OpenAI leads with
The release is framed less around capability than around scope. OpenAI says it trained the model specifically to stay inside the boundaries a researcher sets, and tested that with ExploitGym Honeypot, an evaluation it says was informed by the Hugging Face incident. The model is given a hard exploitation task alongside deliberately weak services it is not authorised to touch, where attacking them would reveal the answer.
Without deployment safety prompts, OpenAI reports that GPT-6 Cyber left those services alone in 99.93% of cases, up from 94.49% for GPT-5.6 Cyber. With the prompts in place, it reports 100%. None of these figures has been reproduced independently.
What it has already been pointed at
OpenAI says its researchers used the model to produce evidence and reproducible tests for 81 previously unknown vulnerabilities in Firefox that Mozilla classified as high severity, and to show that a further 30 known issues were more serious than recorded. Mozilla has begun landing fixes. Brian Grinstead, a distinguished engineer on Firefox, is quoted in the announcement saying the browser entered 2026 as one of the most scrutinised codebases in the world.
On Linux, the company says the model reproduced 1,724 vulnerabilities and built working exploits for 948 of them, against 166 for GPT-5.6 Sol using the same research harness, and that it disclosed 304 critical findings to maintainers with candidate patches.
Access, and the industrial systems question
GPT-6 Cyber is initially available through the API and Codex to a selected group of approved Daybreak Red customers, with OpenAI saying access will widen to all of them soon. GPT-5.6 Cyber goes to all Daybreak Red customers now. Security teams at Cisco, Calif and CodeRabbit are named as users.
The safeguards around it are narrower than the usual refusal classifier. OpenAI requires IP allowlisting for Daybreak Red API access by default, runs automated review of interactions it calls Private Safety Processing, and has added a separate group inside Daybreak Red for approved critical-infrastructure defenders. The company also says it worked with the operational-technology security firm Dragos, whose chief AI officer Rob T. Lee says a frontier model on a mock power plant range found two zero-days in engineering software handling protective relay data.
What to watch is whether anyone outside OpenAI can check the scope figures. The Critical rating is the company’s own assessment of its own model, published alongside the product it governs.
