It Dug Up 948 Privilege-Escalation Vulnerabilities—What This Security Model Spent the Most Time Learning Was Not to Dig Recklessly

OpenAI released GPT-6 Cyber on November 5. First, the numbers: the ExploitGym benchmark is 48.5%, up about 16 percentage points from GPT-5.6 Cyber's 32.1%. This benchmark measures whether a model can write remotely usable exploits for specified vulnerabilities.

Data on real projects is even more direct. OpenAI researchers used it to reproduce 1,724 Linux kernel vulnerabilities and developed usable privilege-escalation exploits for 948 of them. For comparison, the previous generation GPT-5.6 Sol achieved only 166 under the same research framework. On the Firefox side, the model found 81 previously unknown high-severity vulnerabilities. Mozilla distinguished engineer Brian Grinstead said that Firefox entered 2026 as one of the most thoroughly tested codebases in the world, hardened by several generations of frontier models, yet GPT-6 Cyber still turned up new things.

However, the largest portion of this release announcement is not how many vulnerabilities it can find, but how to keep it from digging recklessly.

There is an evaluation called ExploitGym Honeypot, whose design approach references the earlier Hugging Face incident. In the environment, besides the target task, several auxiliary services that are easy to compromise are deliberately included, such as package repositories or object storage. The model must judge for itself that attacking these services is beyond the authorized scope. Test results: without deployment safety prompts, GPT-6 Cyber's rate of avoiding out-of-scope services is 99.93%, versus 94.49% for the previous generation. With deployment prompts added, the number is 100%.

The original article also excerpted several passages of the model's chain of thought, such as 'we cannot assume that additional APIs or attack controllers are not targets; we should only target the binary or server,' and 'do not probe credentials beyond scope.'

According to OpenAI's own Preparedness Framework, this model is classified as Cybersecurity Critical, one level above GPT-5.6 Cyber's High. They also added several restrictions: API access for Daybreak Red requires an IP allowlist by default; targeted monitoring was conducted during coordinated disclosure of PHP vulnerabilities; and there is a separate blocking policy for requests related to critical infrastructure. They also newly opened a Daybreak Red for Critical Infrastructure group to conduct authorized testing for approved critical-infrastructure defense teams.

Access is tiered. GPT-6 Cyber is currently available via API and Codex only to some Daybreak Red customers, with expansion later. GPT-5.6 Cyber is opened to all Daybreak Red customers. On the Daybreak Blue side, alpha access to GPT-6 Astra is expanding to more organizations and independent security researchers.

One customer testing detail is worth mentioning. Dragos Chief AI Officer Rob T. Lee described their testing in a simulated power plant environment: given an almost blank prompt, the model separated OT assets from IT noise on its own, found two zero-days in engineering software that manages protection relay data, and exposed protection settings and circuit breaker trip logic. This is the map attackers most want before they act.

OpenAI's own wording is that the window left for defenders to use frontier models to harden software is limited. In an announcement full of benchmark numbers, this line isn't sentimental, but the meaning lands.

Who can use it now: approved Daybreak Red customers can call GPT-6 Cyber through the API and Codex. The system card is at deploymentsafety.openai.com/gpt-6-cyber. The application entry point is on the Daybreak page of OpenAI's official website.