OpenAI introduces GPT-6 Cyber, a vetted-access security model rated Critical for cyber capability

On November 5, 2026, OpenAI introduced GPT-6 Cyber (gpt-6-cyber), a version of GPT-6 Astra with extra post-training for authorized security work: finding vulnerabilities, reproducing them, building and validating exploits, web penetration testing and checking fixes. OpenAI rates it Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. It also trained the model to stay inside the scope a researcher sets: in its ExploitGym Honeypot test, GPT-6 Cyber left deliberately easy out-of-scope services alone in 99.93% of runs without its deployment prompt (94.49% for GPT-5.6 Cyber) and in 100% with it.

OpenAI's own results: 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, 40.3% vulnerability recall on a new web pentesting test versus 32.0% for GPT-6 Astra, and 95% of tasks completed on RemoteExploitBench, where Astra under Daybreak Blue refused every task. In real use it found 81 previously unknown Firefox vulnerabilities that Mozilla rated high severity, and Mozilla has shipped fixes for many of them. It also powered the Linux kernel research OpenAI published on November 4: 1,724 reproduced vulnerabilities and 948 working root exploits. Cisco, Calif and CodeRabbit are named early users.

As of November 5, 2026, GPT-6 Cyber is available through the API and Codex only to a select group of approved Daybreak Red customers; OpenAI says it will extend access to all Daybreak Red customers soon and is opening GPT-5.6 Cyber to all of them now. Organizations must enforce SSO and MFA, and API access requires IP allowlisting by default. API pricing is $20 input, $2 cached input and $100 output per million tokens, with a 1.05M-token context window and 128K max output. The day before, OpenAI also brought GPT-5.6 Cyber to AWS GovCloud (US-East) through Daybreak Red on Amazon Bedrock. Artificial Analysis had not listed the model as of November 5.