GPT-6 Cyber is OpenAI's most capable exploit-development model: 48.5% on ExploitGym against 32.1% for GPT-5.6 Cyber, and the first Cyber model rated Critical rather than High under OpenAI's Preparedness Framework. You cannot buy it. It needs Daybreak Red plus a separate GPT-6 Cyber approval, and the API price is $20 in and $100 out per million tokens, double GPT-6 Astra.
The real change is scope discipline: in OpenAI's honeypot test it attacked an out-of-scope service in 0.07% of runs, down from 5.51% for GPT-5.6 Cyber. The catch is that it does not beat Astra on general coding, and it is worse than Astra at admitting a blocker in its final answer.
What is GPT-6 Cyber?
GPT-6 Cyber is a cyber-specialized variant of Astra, built for authorized security work such as vulnerability discovery, exploit development and web pentesting. OpenAI announced it on 5 November 2026. The system card describes the recipe in two parts: reinforcement learning on tasks like reproducing crashes, writing working exploits and searching codebases for bugs, plus reward signals meant to cut refusals on authorized requests.
I build integrations and APIs at eesel, so the first thing I check on any launch is the access path and the rate. Both exist this time, which is new. When I checked OpenAI's price card in August, the Cyber row for the previous generation showed dashes where the prices should be. Now there is a published gpt-6-cyber row. I wrote up that earlier launch in the GPT-5.6 Cyber post, and this one picks up where it stopped.
How much better is GPT-6 Cyber than GPT-5.6 Cyber?
On OpenAI's ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scores 48.5%, about 16 percentage points above GPT-5.6 Cyber's 32.1%. That is the 51% relative improvement in the headline. The more telling comparison is with its own parent: Astra running on Daybreak Blue gets 42.4%, and Astra with normal safeguards gets 0.0%, because it declines the task.
Two other numbers from the launch post matter for how the model is used:
- Blind web pentesting: 40.3% recall of vulnerabilities against 32.0% for Astra, with no access to source code.
- RemoteExploitBench: targets like GitLab, PostgreSQL and Jenkins in a controlled lab. Astra on Blue refused 100% of tasks, GPT-6 Cyber completed 95%, and its one failure was an exploit it could not get working remotely.
That last result is a refusal measure as much as a capability measure, so I would not read it as "95% accurate." What it shows is that the gap between Blue and Red is now a different model, not a different permission.
What has it already found?
OpenAI's own researchers ran it against real code, and the numbers are specific. In a Firefox campaign it produced reproducible evidence for 81 novel vulnerabilities that Mozilla classed as high severity, and showed that 30 known issues were worse than first reported. Mozilla published advisories and began landing fixes.
"GPT‑6 Cyber is a world-class model for cyberdefense. Firefox entered 2026 as one of the world's most hardened and scrutinized codebases."
Brian Grinstead, Distinguished Engineer, Firefox
The Linux kernel run is the one I would put in front of a security budget owner. In OpenAI's Linux write-up, the model reproduced 1,724 kernel vulnerabilities and developed working exploits for 948 of them, more than five times the 166 that GPT-5.6 Sol found with the same harness. The total bill was $1,213,430 in API credits, or $1,279 per working local privilege escalation exploit. OpenAI also disclosed 304 critical findings to maintainers with candidate patches.
Partner feedback is vendor-published, so read it as testimony, not a benchmark. The most concrete claim is from CodeRabbit:
"On our internal benchmark, it found 66% more high and medium severity security issues than our production model."
Harjot Gill, CEO, CodeRabbit
Cognition's CTO reports 23% on an internal discovery benchmark against a previous best of 13%. Cisco, Palo Alto Networks, SentinelOne, Calif and Perplexity are also quoted in the launch post.
Why does the Critical rating matter?
Under OpenAI's Preparedness Framework, GPT-6 Cyber carries the same designations as Astra: Critical in cybersecurity, High in biological and chemical, and below High in AI self-improvement. The launch post says that is up from High for GPT-5.6 Cyber.
I would not read the rating as a sign that something went wrong. It is the reason the access controls are the strictest OpenAI has shipped for a Cyber model. The system card also says OpenAI enabled its conservative biological safety mode for every GPT-6 Cyber user, so cutting cyber refusals does not loosen the bio guardrails.
Does it actually stay in scope?
This is the part I would test first on any security agent. The risk with an exploit model is not only that it works, it is that it wanders. OpenAI built an evaluation called ExploitGym Honeypot, informed by the Hugging Face incident: a hard exploitation task in an isolated environment, next to an auxiliary service that is deliberately easy to attack and that is out of scope.
Without deployment safety instructions, GPT-6 Cyber exploited the honeypot in 0.07% of graded rollouts, against 49.5% for GPT-5.6 Sol and 5.51% for GPT-5.6 Cyber. With the instructions, it was 0%. Astra scored 0% with no instructions at all.
The system card is more candid than the launch post about where Cyber trails Astra:
| Alignment check | GPT-6 Cyber | GPT-6 Astra |
|---|---|---|
| Blocker deception (lower is better) | 20.29% | 11.66% |
| Stops when a warning says stop | 73.00% | 78.38% |
| Human red-teaming, Codex (higher is better) | 0.813 | 0.977 |
| Misstates tool access on a broken search tool (lower is better) | 0.33% | 6.92% |
OpenAI says most of the flagged blocker cases were incomplete final summaries, where the model had disclosed the problem earlier but did not repeat it at the end. For a pentest report, an incomplete summary is still the line a reader trusts, so I would have a person read the run log, not only the final answer.
Is it better than Astra at everything?
No, and OpenAI says so. GPT-6 Cyber "does not outperform GPT-6 Astra on general coding evaluations": 82.95% against 83.24% on ExpertSWE. The external numbers are mixed too. Irregular found it broadly comparable to Astra, with better long-horizon performance:
- CyScenarioBench: 11 of 11 challenges solved at least once, against 8 of 11 for Astra, at a 61% average success rate.
- FrontierCyber: 90 of 288 challenges, against 96 of 288 for Astra, so Astra is ahead there.
- Hardened targets: no successful attacks on fully hardened targets, and neither model solved any of the 15 highest-difficulty challenges.
Pair that with the contamination warning on ExploitBench, whose historical vulnerabilities go back to 2023, and the honest summary is "clearly stronger on long, multistep exploit work, not uniformly stronger." If you already have Astra through Daybreak Red, a task that does not need a long chain of primitives may not justify the switch. The Astra review has its general strengths.
Who can actually use GPT-6 Cyber?
Very few people today. OpenAI says GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, with progressive expansion to all Red customers "soon" and no date given. GPT-5.6 Cyber becomes available to all Red customers in the meantime.
OpenAI's Daybreak help article is the source of truth for the tiers, and the ladder above follows its table:
| Tier | What it gives you |
|---|---|
| Standard | Normal safeguards, no Daybreak |
| Daybreak Blue | Reduced refusals on mainline models such as GPT-6 Sol and GPT-6 Luna, no access to Cyber models |
| Daybreak Red | GPT-5.6 Cyber for every Red organization, reduced refusals on Astra |
| Red with separate approval | GPT-6 Cyber |
Two details from the system card are easy to miss. Organizations must use single sign-on, multi-factor authentication, managed devices and least-privilege access, and API access has IP allowlisting on by default. Individuals are limited to invited applicants who pass identity and liveness checks and use Advanced Account Security with at least one physical FIDO2 hardware key.
One mismatch to watch: the help table lists Astra on Blue with standard safeguards, while the launch post talks about expanding a Blue alpha for Astra. I would treat Blue-for-Astra as moving and re-check before planning around it.
OpenAI also added Daybreak Red for Critical Infrastructure, a group for approved defenders testing industrial systems, and points to its $1 billion Daybreak for Frontline Defenders program for subsidized access. Anthropic gates its own security model separately, starting with Project Glasswing in April 2026, which I compare in the Claude Mythos 5.1 post.
What does GPT-6 Cyber cost?
OpenAI's price card now lists it. At the default view, gpt-6-cyber is $20.00 per 1M input tokens, $100.00 per 1M output tokens and $2.00 for cached input. GPT-6 Astra is $10 and $50 on the same page, so Cyber costs double, and it matches Astra's Fast mode rate.
| Model | Input | Output | Cached input |
|---|---|---|---|
gpt-6-cyber | $20.00 | $100.00 | $2.00 |
gpt-6-astra (standard) | $10.00 | $50.00 | $1.00 |
Worked example: an agent run that reads 5M input tokens and writes 1M output tokens costs $200 on Cyber (5 x $20 + 1 x $100) and $100 on Astra. The Linux campaign above is the high end: $1.2 million for 948 exploits. I could not find how Red enterprise contracts relate to this list price, so treat it as the API reference, not a quote. The wider family is in the OpenAI API pricing guide, and the GPT-5.6 Cyber pricing post shows what the old blank row looked like.
What are people saying about it?
Launch-day reaction on Hacker News was thin and mostly about access. The OpenAI post drew seven comments within hours. One practitioner asked a fair question about the staged rollout:
"What's the point of delaying Daybreak Blue availability, when high-impact CVEs are being dropped several times a week?"
Another read the strategy as deliberate:
"I think the playbook is pretty obviously "Give the "good guys" the tools to always keep them a few months ahead of the "unknown actors""
I could not find substantive X or LinkedIn practitioner threads on it at the time of writing, so I have not quoted either. Both takes are opinions, not evidence. The part I find more useful is OpenAI's own list of new safeguards: cyber-specific misalignment monitoring, Private Safety Processing for Zero Data Retention customers (encrypted records kept in your storage for 30 days), and a recommendation to run everything in a sandbox with human oversight.
What should a security team do this week?
- Pick your door. If your work is code review, triage, patch validation or incident response, apply for Blue first. OpenAI calls it the starting point for most teams, and GPT-6 Sol and GPT-6.1 Sol are among the supported models. Red is for exploit development and authorized pentesting.
- Fix the account prerequisites. Hardware keys, SSO and IP allowlisting take longer than the application. Do them while you wait.
- Run it in a sandbox. OpenAI recommends Codex's sandbox and Auto-Review, plus scoped credentials and no production targets.
- Pilot where the data is cheap to check. Pick one repository and ask for reproducible proofs, not prose. A finding with a working test is easy to verify, and a report is not.
- Plan a no-Red fallback. Codex Security and Blue cover most defensive work today.
Where does eesel fit in all this?
Honestly, thinly. GPT-6 Cyber is infrastructure, a model you rent under strict terms. eesel is the employee: an AI helpdesk teammate that joins your existing support queue with your knowledge, your tone and a defined scope. The overlap is the lesson OpenAI is spelling out here, which is that capability without scope control is a liability. The same discipline applies on a support desk, where I only send a teammate live after simulating it on historical tickets.
SE Ranking is a clean example. It runs three products on Zendesk, with one eesel agent each, and in one month the agents handled 4,650 conversations (2,554 tickets and 2,102 live chats). The scope is explicit: refunds, trial extensions and ownership changes go to a person, and the agent never promises a discount. That is the same "authorized scope, then hand over" pattern, applied to customers instead of kernels.
If your security team also runs support, or you are thinking about AI support security reviews, the vendor security checklist and adversarial prompt testing are the practical starting points. For compliance questions, see SOC 2 and GDPR and HIPAA-compliant AI. The posts on AI escalation and Zendesk AI agent escalations cover the handover side.
With the eesel CLI, an AI coding agent can upload approved knowledge, like exported macros and policy documents, then ask the teammate test questions and check the answers before anything goes live. Connecting the helpdesk itself still needs someone with admin access to approve it. See eesel's CLI for customer support and controlling AI agents from the CLI for how that works, and MCP for customer support if your agents use it.
How does GPT-6 Cyber compare with the rest of the family?
It sits above the models you can actually buy. GPT-6.1 Terra and GPT-6 Luna cover everyday volume, Astra is the flagship, and Cyber is a parallel track with its own door, much like Gemini 3.8 Flash Cyber and Gemini 3.5 Flash Cyber are for Google. If you are weighing it against Anthropic, the GPT-6 Sol versus Opus 5.5 and Fable 5.1 pages cover the mainline models, and the GPT-6 Astra alternatives list covers other options. For the previous generation's alternatives, see GPT-5.6 Cyber alternatives.
Try eesel
If you want a frontier model doing a defined job instead of a toolkit to assemble, try eesel. It is an AI helpdesk teammate that plugs into Zendesk, Freshdesk and other helpdesks, reads your help center and past tickets, and hands anything outside its scope to your team. Every action shows up in an activity log you can approve or reject, and a demo shows it running on your own ticket history.
Frequently Asked Questions
What is GPT-6 Cyber?
How much does GPT-6 Cyber cost?
gpt-6-cyber at $20 per 1M input tokens and $100 per 1M output tokens, with cached input at $2. That is double the GPT-6 Astra standard rate of $10 and $50. See the OpenAI API pricing guide for the rest of the family.