OpenAI Releases GPT-6 Cyber, First AI Rated Critical Under Its Preparedness Framework

OpenAI on Wednesday released GPT-6 Cyber, a cybersecurity-tuned descendant of GPT-6 Astra that the company rates "Critical" under its own Preparedness Framework — the first time OpenAI has deployed a model it formally classifies as one capable of end-to-end cyberattacks against critical real-world systems. Access is gated through the expanded Daybreak Red program, which now accepts applications from enterprise security teams, penetration testing firms, and national-laboratory researchers. Simultaneously, OpenAI published ExploitGym, an 898-task exploitation benchmark described in an unreviewed preprint, on which GPT-6 Cyber scores 48.5% — a meaningful jump from its predecessor's 32.1%, but second place on the BenchLM leaderboard behind Google's Gemini 4 Carbon at 53.5%.

What Daybreak Red Customers Receive

Approved Daybreak Red operators get API access for authorized offensive security workflows: zero-day hunting, exploit-chain development, and authorized penetration testing. The program requires identity verification, mandatory hardware security keys (enforced since September 1, 2026), IP allowlisting, and legal attestations on permitted use.

GPT-6 Cyber's real-world outputs have already been disclosed. Its scout-and-analyst pipeline identified 81 of the high-severity vulnerabilities that Mozilla patched in Firefox 159 on October 27 as part of MFSA 2026-118 — independently corroborated by Firefox Distinguished Engineer Brian Grinstead. The same pipeline produced 948 Linux kernel privilege-escalation exploits at a total API cost of roughly $1.2 million, or approximately $1,279 per working exploit.

What ExploitGym Actually Measures

ExploitGym's 898 instances span userspace Linux programs (C/C++), V8 (Chrome's JavaScript engine), and the Linux kernel. Each task provides an agent with a proof-of-vulnerability input; the agent must extend it into a working exploit achieving arbitrary code execution, capture a privileged flag, and pass an AI judge confirming the intended vulnerability was exploited rather than an opportunistic side-channel. Tasks run in isolated containers with a two-hour timeout and one attempt. Only Linux targets appear in the benchmark — no Windows, iOS, or mobile workloads.

Company-reported scores as of November 5: Gemini 4 Carbon 53.5%, GPT-6 Cyber 48.5%, GPT-6 Astra (Daybreak Blue) 42.4%, GPT-6.1 Sol 35.1%, GPT-5.6 Cyber 32.1%. The best open-weight model, Kimi K3.1 Pro, reaches 20.7%; Anthropic's Claude Mythos Preview scores 17.5% through the company's Glasswing program. No independent reproduction of any score has been published, as The Decoder noted following the launch.

How Security-Tuned LLMs Turn Proof-of-Concepts Into Working Exploits

GPT-6 Cyber runs a staged scout-and-analyst architecture: agents scope the target surface, identify candidate vulnerabilities, dynamically triage them in isolated virtual machines using KASAN (Kernel Address Sanitizer) to surface memory corruption, then develop exploits with KASLR (Kernel Address Space Layout Randomization) bypass techniques before human review and disclosure. Full technical details are available in OpenAI's model announcement.

The model was trained with a scope-adherence mechanism using a "honeypot" setup that places exploitable adjacent services next to the real target — inspired by the 2023 Hugging Face supply chain incident. Without safety prompts, GPT-6 Cyber attacked only the designated target 99.93% of the time; with safety prompts, the rate reached 100%. This solved the problem that doomed GPT-6.1 Astra: that model scored higher on raw exploitation tasks but failed scope adherence tests often enough that OpenAI cancelled its release before it shipped.

A Competitive Landscape OpenAI Does Not Lead on Benchmarks

GPT-6 Cyber enters a market where it is not the top-scoring model. Gemini 4 Carbon, available through Google's Fairwind program for vetted operators, outscores it by five percentage points on ExploitGym. OpenAI is also not alone in running controlled security-research access: Anthropic operates Glasswing, and Google's Fairwind predates this week's Daybreak Red expansion.

What distinguishes OpenAI's approach is transparency. The Firefox disclosure, the Linux kernel cost breakdown, the ExploitGym comparative scores, and the explicit Preparedness Framework "Critical" rating constitute a level of public disclosure that Google and Anthropic have not matched for equivalent programs. Whether this reflects a governance philosophy or competitive signaling is a question the AI security community is actively debating.

According to OpenAI, Dragos Chief AI Officer Rob T. Lee tested GPT-6 Cyber against a mock operational technology power plant, finding that the model isolated OT assets from IT traffic and uncovered two previously unknown zero-days in engineering software managing protective relay data — indicating the model's offensive reach extends beyond pure software exploitation.

The "Defender-First" Framing Under Scrutiny

OpenAI frames the release as a "defender-first" initiative. Eric Wallace, an OpenAI researcher, stated the company is "now allocating a significant amount of our frontier compute towards discovering and patching." The company raised its critical bug bounty maximum from $6,500 to $30,000 (up to $172,000 with bonuses) and committed $1 billion to a "Daybreak for Frontline Defenders" grant program.

The structural counterargument is that the same capability is available to attackers who compromise verified accounts or run abliterated open-weight models — Kimi K3.1 Pro's 20.7% ExploitGym score requires no verification. Max Justicz, co-founder and CTO of Charge Robotics and a Daybreak Blue user who discovered CVE-2026-109518 (a severe Ubuntu privilege-escalation flaw) for roughly $5,000 in API costs, observed that OpenAI appears to have "nerfed" the Daybreak Blue tier compared with earlier capability — suggesting access tiers are calibrated at least partly against competitive dynamics rather than purely technical risk assessments.

What Comes Next

GPT-6 Cyber will roll out to all Daybreak Red customers in the coming weeks; GPT-5.6 Cyber will become available to the same tier simultaneously. The monthly CVE publication rate tracked by Google's Threat Intelligence Group doubled from 5,045 to 10,740 between January and August 2026, suggesting AI-assisted vulnerability discovery is already reshaping the patching cadence for major open-source projects regardless of which lab's model is running.

The key unresolved question for enterprise security teams is not which model scores highest on ExploitGym but whether institutional gating mechanisms can remain meaningful as open-weight capability closes the gap. At Kimi K3.1 Pro's current trajectory — 20.7% with no verification required — the access controls around 48.5% models have a narrowing window before they become more symbolic than structural.