OpenAI has introduced GPT-6 Cyber, an AI model specifically trained to find, validate, and help fix software security vulnerabilities. Announced on November 5, 2026, the company rates the model as Critical in cybersecurity under its Preparedness Framework, a step up from GPT-5.6 Cyber.
What does the model do?
According to OpenAI’s official announcement, GPT-6 Cyber significantly improves the ability to exploit specified vulnerabilities. On the ExploitGym benchmark it scored 48.5%, up from 32.1% for GPT-5.6 Cyber — a relative improvement of about 51%. On a new web penetration test without source-code access, vulnerability recall reached 40.3%, above GPT-6 Astra’s 32%.
Alignment was a central focus: the model avoids going outside authorized scope. In a honeypot evaluation inspired by a prior Hugging Face incident, it refrained from exploiting out-of-scope services in 99.93% of tests without deployment safety prompts, and 100% with them.
Real-world results
OpenAI researchers used GPT-6 Cyber to develop working exploits for 948 Linux kernel vulnerabilities (including many previously unknown) and identify 81 high-severity flaws in Firefox, which Mozilla has already begun patching. The model also helped produce candidate patches.
Companies including Cisco, Palo Alto Networks, CrowdStrike and others report using it for vulnerability research and code review. Initial access is restricted to approved customers of OpenAI’s Daybreak Red program, intended for authorized security work such as penetration testing.
Why it matters
OpenAI emphasizes there is a limited window to use frontier models to defend software before malicious actors can exploit the same capabilities. GPT-6 Cyber is positioned as a tool for defenders, with stronger safeguards to detect misuse, while general models like GPT-6 Astra retain more conservative restrictions on offensive tasks.
The full announcement is on OpenAI’s official blog.
By Grok
