OpenAI is shipping a cybersecurity specialist model it ranks as Critical under its Preparedness Framework. In a November 5, 2026 post titled "GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents," the company said GPT-6 Cyber is trained to find and validate exploitable vulnerabilities while staying inside the scope researchers set, and that it is already in use on real codebases such as Linux and Firefox.

On ExploitGym, which checks whether a model can turn a specified vulnerability into a working exploit against a remote target, GPT-6 Cyber scores 48.5%, about 16 percentage points above GPT-5.6 Cyber's 32.1% — a roughly 51% relative gain. On a new offensive web penetration-testing evaluation without source code, OpenAI reports 40.3% vulnerability recall for GPT-6 Cyber versus 32.0% for GPT-6 Astra. On RemoteExploitBench, which uses known flaws in applications such as GitLab, PostgreSQL and Jenkins in a controlled environment, GPT-6 Cyber completed 95% of tasks while GPT-6 Astra with Daybreak Blue refused every one.

Alignment is a second headline. In ExploitGym Honeypot, models face an isolated exploit task plus deliberately easy out-of-scope services that can leak a flag if attacked. GPT-6 Cyber avoided those out-of-scope services in 99.93% of tests without its deployment prompt and 100% with the prompt, up from 94.49% without prompts for GPT-5.6 Cyber. OpenAI says the model received dedicated training to stay within authorized scope, respect restrictions and report results accurately.

The company ties the release to concrete research results. It says researchers used GPT-6 Cyber to develop 948 Linux privilege-escalation exploits in a mid-October pipeline run and to identify 81 previously unknown high-severity Firefox vulnerabilities, with candidate patches and Mozilla shipping fixes for many of them. Security teams at Cisco, Calif, CodeRabbit and others are cited as early users for vulnerability research and code review. OpenAI also says the model helped harden its own training infrastructure after controlled red-team campaigns.

Access stays gated. GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, with a progressive expansion to all Daybreak Red customers planned soon. Daybreak Blue continues to cover verified defensive workflows with fewer unnecessary refusals on mainline models such as GPT-6 Astra. OpenAI is pairing the stronger capabilities with cyber-specific misuse monitoring, Private Safety Processing for zero-data-retention API customers, default IP allowlisting for Daybreak Red API access, and refined blocks aimed at unauthorized critical-infrastructure attacks, informed in part by lab evaluations with Dragos.

Independent coverage from The Hacker News, The Verge and TechCrunch matches the announcement date, Critical classification, ExploitGym score, scope-alignment figures and Daybreak Red rollout. OpenAI's own framing is that defenders have a limited window to use frontier models to secure software before adversaries catch up — and that GPT-6 Cyber is meant for authorized research inside that window, not open public access.