OpenAI Launches GPT-6 Cyber for Advanced Security Research

OpenAI has introduced GPT-6 Cyber, a specialised AI model designed to help cybersecurity teams identify software vulnerabilities, validate potential exploits and develop security fixes.

Announced on November 5, 2026, the model focuses on improving both cybersecurity capabilities and alignment. It is designed to perform complex security research while respecting the scope and restrictions defined by authorised researchers.

OpenAI says GPT-6 Cyber delivers significant improvements over GPT-5.6 Cyber, including a 51% relative improvement on the ExploitGym benchmark.

Stronger Vulnerability Detection and Exploit Development

GPT-6 Cyber demonstrated improved performance in identifying and exploiting software vulnerabilities. It achieved a score of 48.5% on ExploitGym, compared with 32.1% for its predecessor.

The model has also been used in real-world security research involving widely used software.

In Linux kernel research, OpenAI reports that GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 of them. The research team disclosed 304 critical findings to maintainers, alongside candidate patches.

In a separate Firefox campaign, the model identified 81 previously unknown high-severity vulnerabilities. OpenAI shared the findings and proposed patches with Mozilla, which has released fixes for many of the reported issues.

These results demonstrate how AI agents could support security researchers in examining large and complex codebases more efficiently.

Alignment and Authorised Testing Remain Central

As AI models become more capable of developing exploits, controlling their use becomes increasingly important.

OpenAI says GPT-6 Cyber has received specialised training to follow authorised testing boundaries, respect restrictions and report findings accurately.

In an alignment evaluation, the model avoided exploiting out-of-scope services in 99.93% of tests without deployment safety prompts. With the prompts enabled, it stayed within the assigned scope in 100% of tests.

The company has also introduced additional monitoring, credential protections, sandboxing recommendations and safeguards intended to prevent misuse.

Supporting Critical Infrastructure Protection

OpenAI is also focusing on the security of critical infrastructure, including power plants, water treatment facilities and industrial control systems.

Through its Daybreak programme, the company aims to provide approved defenders with access to advanced cybersecurity capabilities while maintaining safeguards against unauthorised activity.

OpenAI has also worked with cybersecurity organisations such as Dragos to evaluate how AI models can identify weaknesses in operational technology environments.

The company says these evaluations are helping improve safeguards while preserving support for legitimate security research.

Access Initially Limited to Approved Security Teams

GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. OpenAI plans to expand access to other Daybreak Red customers.

The company is also expanding Daybreak Blue alpha access, which supports vulnerability validation and defensive security workflows using GPT-6 Astra.

What GPT-6 Cyber Means for the Cybersecurity Industry

The introduction of GPT-6 Cyber highlights the growing role of AI in vulnerability discovery, security testing and software protection.

While these capabilities can help defenders identify weaknesses before attackers exploit them, they also increase the importance of access controls, human oversight and responsible deployment.

The broader challenge for the cybersecurity industry will be ensuring that increasingly capable AI agents remain aligned with authorised security objectives while helping organisations strengthen their digital infrastructure.