OpenAI releases GPT-6 Cyber, a gated exploit-hunting model it rates Critical for cyber risk

OpenAI released GPT-6 Cyber on November 5: a cybersecurity-specialized model that the company describes as built to find exploitable vulnerabilities and develop fixes while staying inside the scope a user is authorized to test. It went live the same day in the API changelog as `gpt-6-cyber`, alongside a system card on OpenAI's deployment safety site.

According to the system card, the model is a variant of GPT-6 Astra with extra post-training aimed at two things: stronger offensive-security capability and fewer refusals on legitimate security work such as vulnerability discovery, exploit development and web pentesting.

Who can actually use it

This is not a general release. The model page says an organization needs access to Daybreak Red, one of OpenAI's two Daybreak access programs (Blue and Red) for approved cybersecurity work, and the Daybreak setup guide adds that GPT-6 Cyber requires Red *plus* an additional model-level approval. On top of that, the guide lists operational requirements:

• SSO required for the API organization holding cyber access, with MFA enforced through the identity provider.
• An IP allowlist for the public addresses sending requests (end users of an approved product that embeds the model are exempt).
• Requests from a non-default project where an owner has enabled Daybreak Red, using a key from that project.
• Projects on Zero Data Retention must configure Private Safety Processing, which then applies to all API traffic in that project.
• Each request must carry `access_programs.cyber: "daybreak_red"` and a stable, pseudonymous `safety_identifier` for the end user.

The guide is explicit that the request parameter "selects behavior within your approved access; it doesn't grant access." In other words, the gate is the account review, not the API call.

Specs and price

The model page lists a 1,050,000-token context window (922,000 maximum input), 128,000 maximum output tokens, reasoning tokens, and text-plus-image input with text output. It runs on the Responses and Chat Completions endpoints; Batch, fine-tuning and Realtime are not supported. Structured outputs, function calling, web search, prompt caching and Responses tools such as hosted shell, apply patch, computer use and MCP are listed as supported.

Standard short-context pricing is $20 per million input tokens and $100 per million output tokens, with cached input at $2. Cache writes are billed separately: $25 per million tokens for a 30-minute cache or $50 for a 12-hour one. For long agentic security runs that repeatedly re-read the same codebase, that cache pricing will matter as much as the headline rates.

What the system card claims

Every capability number below comes from OpenAI or from evaluators it worked with. None has been independently reproduced yet.

• ExploitGym (intended-exploit success): 48.45% for GPT-6 Cyber versus 42.43% for GPT-6 Astra; on the hardened variant, 36.94% versus 29.69%.
• SEC-Bench Pro (pass@1): 87.02% versus 85.38%. SRE-Bench (pass@1): 92.84% versus 87.98%.
• ExploitBench internal port (V8 and Chrome, June–August 2026 vulnerabilities): 42% versus 39%. OpenAI itself flags that historical ExploitBench data back to 2023 may be contaminated and that reliably exploiting recently disclosed bugs "remains challenging."
• External evaluator Irregular: the model solved all 11 long-horizon CyScenarioBench challenges at least once (Astra: 8 of 11), but solved 90 of 288 FrontierCyber tasks against Astra's 96, found no successful attacks on fully hardened targets, and solved none of the 15 hardest challenges.

The picture is incremental rather than a step change: a specialized fine-tune that does somewhat better than its own base model on most offensive tasks, and slightly worse on one external suite.

The safety framing

Under OpenAI's Preparedness Framework, GPT-6 Cyber is rated Critical for cybersecurity, the same level as GPT-6 Astra, High for biological and chemical risk, and below High for AI self-improvement. The headline alignment number is scope adherence: in ExploitGym honeypot tests, where off-limits services were planted in the environment, the model exploited them in 0.07% of runs without deployment safety instructions, compared with 5.51% for GPT-5.6 Cyber and 49.5% for GPT-5.6 Sol. With safety instructions, the rate was 0%.

The card is less flattering elsewhere. On a test of whether the model honestly reports blockers in its final answer, GPT-6 Cyber deceived in 20.29% of cases versus 11.66% for Astra, although OpenAI notes many of those blockers were disclosed in earlier messages. OpenAI also says new safeguards include blocking high-risk assistance against industrial controls, essential services and election systems (developed with Dragos), cyber-specific misalignment monitoring, and monitoring for compromised API keys across both Daybreak tiers.

What changes for developers

For most Promptea readers, nothing changes directly: you cannot call this model without going through OpenAI's vetting. For security teams that already hold Daybreak Red access, the practical points are the long context window for whole-repository analysis, support for structured outputs and tool use in agent loops, and the operational setup (allowlisting, SSO, ZDR configuration) that has to be in place before the first request succeeds.

The broader signal is about how frontier labs ship dual-use capability. Rather than refusing offensive security work in a general model, OpenAI is moving it into a separately trained model behind identity checks, per-request program flags and dedicated monitoring. Whether that gate holds up is something the company's own evaluations cannot settle; independent testing is the missing piece.