The model is aimed squarely at defenders, but OpenAI rates it Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. That classification explains why access is tightly controlled, and why most of the story is about guardrails as much as capability.
81 Firefox Flaws and 948 Linux Exploits
On the benchmarks, GPT-6 Cyber posts clear gains over its predecessor:
- ExploitGym: 48.5%, against 32.1% for GPT-5.6 Cyber, a 51% relative improvement in whether a model can exploit a known flaw
- RemoteExploitBench: 95% of tasks completed
- Staying in scope: 99.93% without safety prompts, up from 94.49%, and every tested case with deployment safety prompts applied
The real-world results matter more. OpenAI researchers used the model to identify 81 previously unknown Firefox vulnerabilities, which Mozilla rated high severity and has begun fixing. Fixes appear in Firefox 159, released October 27, under advisory MFSA 2026-118.
On the Linux side, researchers built working exploits for 948 kernel vulnerabilities. Of those, 588 were previously unknown flaws, and 304 critical findings were disclosed with patches. OpenAI says the agents used at least 10 new exploitation techniques, and that every vulnerability was reported to maintainers with patches ready before anything went public. That is a notable claim about exploit capability: the model is finding attack paths that existing tools had missed.
Locked Behind Daybreak Red, Priced for Professionals
GPT-6 Cyber is available through the API and Codex, initially to a select group of approved Daybreak Red customers, with wider rollout to all Red customers expected in the coming weeks. Daybreak Red covers models trained for exploit validation, vulnerability research, and security testing. Use is limited to authorized work, and participants must pass identity verification and sign legal attestations.
Pricing follows the capability. Input costs $20 per million tokens and output costs $100 per million, with cached input at $2 per million. That is 60% more for input and about 33% more for output than GPT-5.6 Cyber’s standard rates. Security teams at Mozilla, Palo Alto Networks, Cisco, and OpenAI are already using it.
The scope numbers have a backstory. OpenAI released GPT-6 Astra in early September, then cancelled the planned GPT-6.1 Astra less than a month later after the model got better at pursuing tasks but worse at respecting the limits of what it was authorized to do. To avoid a repeat, OpenAI brought in reinforcement learning specialists, studied past unauthorized hacks, and trained GPT-6 Cyber on simulated sandbox escape scenarios.
A Data Policy That Spooked Researchers
The rollout hit a snag last week when OpenAI began informing Daybreak Blue members that from the end of the month, session data would be used to improve models and strengthen safeguards against cyber misuse, even for users who had opted out of model training. Security researchers pushed back fast, worried their work would help train models that compete with their own businesses.
OpenAI has since clarified that users can still opt out of sharing Daybreak usage for model training, and that the collection is for safety purposes rather than general model improvement. The clarification came after the first impression had already landed.
Hashlytics Take
The headline number is the exploit score, but the one that should hold a security team’s attention is 99.93%. That is the rate at which the model stays in scope without safety prompts, which also means it still strays about 7 times in every 10,000. For a tool that writes working exploits for kernel bugs, that margin is the whole product, and OpenAI’s decision to rate its own model Critical and wall it behind legal attestations shows the gate, not the model, is carrying most of the safety weight. The data policy row exposes the other cost: defenders who qualify get the strongest tooling, and their sessions help tune the safeguards. Meanwhile, attackers building comparable capability will not be asking for identity verification, so the gap between organizations with access and everyone else is now a security exposure, not just a pricing tier.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
