OpenAI has put a name and a product path on the cyber model it had been describing as unreleased. In a November 5, 2026 post, the company introduced GPT-6 Cyber as a model for finding and validating exploitable vulnerabilities while staying inside the boundaries security researchers set. It says the model posts major gains over GPT-5.6 Cyber on cybersecurity benchmarks, including a 51% relative improvement on ExploitGym, and a step change in staying within authorized scope.
On ExploitGym, which tests whether a model can exploit a specified vulnerability, OpenAI reports GPT-6 Cyber at 48.5%, up from 32.1% for GPT-5.6 Cyber. In an alignment evaluation informed by the Hugging Face incident, the company says the model avoided exploiting out-of-scope supporting services in 99.93% of tests without its deployment prompt and 100% with that prompt. Under OpenAI's Preparedness Framework, GPT-6 Cyber is classified Critical in cybersecurity, up from High for GPT-5.6 Cyber.
OpenAI ties the release to work already in the field. It says researchers used GPT-6 Cyber to develop 948 privilege-escalation exploits in Linux and to identify 81 previously unknown high-severity Firefox vulnerabilities, with Mozilla shipping fixes for many of them. Security teams at Cisco, Calif, CodeRabbit, Palo Alto Networks, SentinelOne and Perplexity are quoted as using it for vulnerability research and review. The same model family sits behind Daybreak Red for deeper authorized exploit development and Daybreak Blue for defender workflows with fewer unnecessary refusals.
Access starts narrow. GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, with a progressive expansion planned. OpenAI is also making GPT-5.6 Cyber available to all Daybreak Red customers and expanding Daybreak Blue alpha access for GPT-6 Astra. Safeguards listed alongside the launch include cyber-specific misalignment monitoring, IP allowlisting for Daybreak Red by default, Private Safety Processing for zero-data-retention API customers, and tighter blocks around critical infrastructure and industrial control systems, informed in part by evaluations with Dragos on a mock power-plant range.
Independent coverage on TechCrunch and The Verge treated the post as the formal cybersecurity-model launch, distinct from OpenAI's November 4 research note on an automated Linux exploit pipeline that still described the underlying model as unreleased. Both outlets stress the dual-use tension: stronger offensive capability paired with scope alignment and defender-gated access.
For security researchers and platform builders, the news is a named Critical-tier cyber model with measured scope adherence and a gated Daybreak path, not another vague research teaser. Benchmark scores, customer quotes and preparedness labels are OpenAI's own figures; independent red-team replication outside OpenAI's partners was not available in this run. Readers should treat the Linux and Firefox impact numbers as OpenAI-reported campaign results pending broader public disclosure timelines.