On November 5, 2026, OpenAI introduced GPT-6 Cyber, a specialized cybersecurity model that autonomously searches for vulnerabilities and develops working exploits within the boundaries set by the researcher. On the ExploitGym benchmark, it scored 48.5%, significantly outperforming both the previous cyber version, GPT-5.6 Cyber, and the universal flagship, GPT-6 Astra. Practical results are already visible: the model helped find 81 previously unknown high-severity vulnerabilities in Firefox, which Mozilla is currently patching, and 948 Linux kernel privilege escalation exploits were built, 588 of which were previously unknown. OpenAI assigned its own model a Critical cyber rating for the first time, although GPT-6 Cyber is currently available only to approved clients of the Daybreak Red program.

image
image
image

What happened

On November 5, 2026, OpenAI announced the release of GPT-6 Cyber, a separate model tailored for vulnerability discovery and exploit construction based on researcher instructions. On the ExploitGym benchmark, it showed 48.5% compared to 32.1% for the previous cyber version GPT-5.6 Cyber and 42.4% for the universal flagship GPT-6 Astra. In the ExploitGym Honeypot test, which checks boundary adherence, the model exceeded the scope of the assigned task in only 0.07% of cases, meaning 99.93% of attempts remained within the framework, whereas the previous version had a violation rate of up to 5.51%. Using the model, researchers found 81 previously unknown high-severity vulnerabilities in Firefox, and Mozilla is already releasing patches under advisory MFSA 2026-118. In the Linux kernel, 948 privilege escalation exploits were built, including 588 previously unknown ones, plus 10 new exploitation techniques that kernel experts had not previously encountered. Under the Preparedness Framework, OpenAI rated the model at the Critical level—a step above the High rating received by the previous cyber version.

Context

The Critical rating formally means, under the Preparedness Framework, the model's ability to create working zero-days for protected critical systems without human intervention, and it was assigned by the vendor itself: this is an OpenAI declaration, not an independent attestation. The nature of the evidence is also important: the release is supported not by benchmarks and demonstrations, but by externally verifiable artifacts, including accepted patches and maintainer-verified exploitation paths, which is rare for capability releases. Another notable point is that a narrow-domain model outperformed the universal flagship of the same company, a strong argument in favor of targeted training rather than just general growth in base capabilities. Manageability is provided by the Daybreak program: the Red level is designed for authorized offensive work by approved clients, while the Blue level is recommended for defenders. Finally, the Honeypot metric sets a methodological standard: evaluating not only the agent's usefulness but also the control of its autonomy—this type of check will soon be needed for any agentic system, not just cyber models.

Why this matters for the industry

Vulnerability discovery is transforming from a niche expert task into an industrial process with a measurable chain: OpenAI is preparing candidate patches for Linux maintainers, and coordination before public disclosure is conducted through Cloudflare WAF. At the same time, value in the chain is shifting from "finding" to "fixing": according to OpenAI's Patch the Planet dashboard, the level of automated vulnerability remediation is currently below 25%, so at the current stage, accelerated search strengthens potential attackers as well, especially since new exploitation techniques (TTP) complicate detection, as noted by Rob T. Lee from Dragos. For product creators, a pattern of scoped agents is emerging: a human sets the boundaries, the model conducts the search within them, and a human or CI validates exploit candidates. If access is expanded, the industry can expect an increased flow of findings for triage, the first defensive products based on agentic codebase scanning, and semi-automated loops where patches will reach maintainers faster than they can be reviewed. A separate market risk is a "race of self-assessments," where other vendors will begin assigning their own danger ratings to models.

Why this matters for users

GPT-6 Cyber is not available to the general public: the model is provided only to approved clients of the Daybreak Red program via API and Codex, so it cannot be tried in practice right now. Access expansion is promised within the coming weeks, and those planning integrations or applications should prepare in advance. Specific actions to take today: update Firefox, as the vulnerabilities found by the model are being closed by patches already being released, and also keep the Linux kernel and its dependencies up to date. Maintainers and CISOs should describe the process for accepting candidate patches and the triage order for incoming findings in advance. If access is expanded, automated vulnerability search in mature software will become a standard service, and regular updates will finally turn from a recommendation into basic hygiene.

What is currently unknown / limitations

The real scale of progress cannot yet be assessed: the data lacks a control group, meaning it is unknown how many vulnerabilities the same researchers would have found in Firefox and the Linux kernel without the model. The accuracy of the findings is also not disclosed: the proportion of false positives among the claimed previously unknown exploits has not been published. The ExploitGym methodology has not yet undergone external verification, there are no direct comparisons with competitor models, and the timing and conditions of the promised access expansion are not detailed, so loud conclusions are premature: in particular, the claim that "the moat of manual pentesting is already collapsing" has no scientific basis in the published data.

Sources

Author

Look at AI, editorial team