OpenAI Released a Vulnerability-Finding Model, but the Comments Are Pushing for 6.2

On November 5, OpenAI released GPT-6 Cyber. A security research model with a concrete goal: find exploitable vulnerabilities, verify them, propose patches, and at the same time stay within boundaries set by researchers.

It is already doing work in real code. OpenAI says researchers used it to produce 948 privilege-escalation exploits in the Linux kernel, more than five times the 166 produced by GPT-5.6 Sol under the same research framework; in Firefox it found 81 previously unknown high-severity vulnerabilities, and another 30 known issues were shown to be more severe than originally reported. Mozilla has already started fixing them. Security teams at Cisco, Palo Alto Networks, Calif, CodeRabbit, and others are trialing it, and OpenAI is also using it to check its own training infrastructure.

On the numbers, ExploitGym rose from 32.1% for GPT-5.6 Cyber to 48.5%, which the company says is a 51% relative improvement. More interesting is RemoteExploitBench: GPT-6 Astra paired with Daybreak Blue refused 100% of tasks, while GPT-6 Cyber completed 95%. The value of a security model is not only in refusal, but also in whether it can get the job done within an authorized scope.

Alignment also came with numbers. In ExploitGym Honeypot, the model has to perform exploitation tasks in an isolated environment, with deliberately easy-to-exploit package registries and object storage placed nearby. When no deployment hint was given, GPT-6 Cyber avoided out-of-scope services 99.93% of the time, versus 94.49% for GPT-5.6 Cyber; with a hint, it was 100%. The company attributes this to training on authorization scope, constraints, and accurate reporting.

On the product side, Daybreak is split into Blue and Red. Blue handles defense, code review, vulnerability investigation, and remediation, with fewer unnecessary refusals; Red handles authorized testing, exploit development, and red teaming. GPT-6 Cyber is first being given to approved Daybreak Red customers, through the API and Codex, and will be expanded gradually later. The alpha of Daybreak Blue for GPT-6 Astra is also expanding to more organizations and independent researchers.

The comments section is another picture. A large number of replies are asking when GPT-6.2 Astra and Sol will arrive; some directly write “another model nobody can use,” and others suggest waiting until a real public release before announcing. The official side is talking about the defense window, while the comments are pushing for the next consumer-generation model. Both needs are real; they are just not on the same release cadence.

At 10 a.m. Pacific Time on November 12, OpenAI also has a Cyber at the Frontier livestream. Security teams can watch for changes in Daybreak access; the 6.2 that ordinary users want to see is not part of this announcement for now.