OpenAI launches GPT-6 Cyber, a security model it rates 'Critical' for cyber risk

Cybersecurity is becoming its own frontier-model product line. OpenAI's GPT-6 Cyber is not a general chat model with a security prompt bolted on: it is a specialised system built around vulnerability discovery, exploit development and web penetration testing inside authorised security work.

According to the capability list in the report, the model can identify flaws, build proof-of-concept exploits, validate exploit chains and propose fixes. That makes it dual-use by design: red teams use it to find a way in, blue teams use it to confirm exposure and decide what to patch first.

OpenAI reports a 51% relative improvement over GPT-5.6 Cyber on ExploitGym, with GPT-6 Cyber scoring 48.5% against the earlier model's 32.1%. The field results are harder evidence: OpenAI says it found 81 previously unknown high-severity Firefox vulnerabilities and produced working exploits for 948 Linux kernel vulnerabilities.

The risk label rose with the capability. Under OpenAI's Preparedness Framework the model is rated "Critical", the highest cyber-risk tier, precisely because it can develop functional zero-day exploits. That rating is what shapes the release: the stronger the model, the less it can be handed out at once.

Hence the scope metrics. In honeypot tests run without extra safety instructions, GPT-6 Cyber stayed inside authorised boundaries 99.93% of the time, up from 94.49% for its predecessor. For security teams that number matters as much as the benchmark gain, because a powerful model that wanders outside scope is a liability in live operations.

Access is deliberately narrow. GPT-6 Cyber is initially available through the API and Codex only to selected, approved Daybreak Red customers, with broader Red access planned. That staged path differs sharply from releasing a model to everyone on day one.

The interesting shift is not the score but the shipping model: a capability ceiling is no longer the selling point, while staying inside authorised boundaries has become the entry ticket. Frontier labs are now writing access tiers, behavioural guardrails and honeypot evaluations into release notes instead of leaving them to security operations.

Three things are worth watching: the pace and criteria for widening Red access, whether outside researchers can reproduce the ExploitGym numbers, and how the vulnerabilities the model surfaces move through coordinated disclosure with vendors. Those will say more about whether this class of model is durably useful for defence than any single benchmark figure.