OpenAI launched GPT-6 Cyber on November 5, 2026, for approved teams that test software for security flaws. The firm said selected Daybreak Red users can access it through Codex and its API, a software connection.
OpenAI says the model can find weaknesses, demonstrate their impact and help prepare fixes. Its launch report describes work on Firefox. Mozilla’s own list of fixes also credits OpenAI staff and tools.
What GPT-6 Cyber tests
The US National Institute of Standards and Technology defines a software vulnerability as a flaw that an attacker could use. Finding a possible weakness and showing that it works are separate steps. Dragos, which tests industrial systems, made this distinction in its AI research. It counted flaws as proven only after tests on the systems at risk.
OpenAI’s ExploitGym test asks models to make use of a known flaw in a remote target. The chart compares the firm’s reported success rates. Higher scores mean more test tasks solved, not more flaws found across all software.
ExploitGym: exploiting a specified flaw
Source: OpenAI evaluations
Data as of: 2026-11-05
Higher is better. OpenAI reports higher test success for its new model. These scores do not measure discovery of all software flaws.
| Model | Success rate (%) |
|---|---|
| GPT-5.6 Cyber | 32.1% |
| GPT-6 Cyber | 48.5% |
OpenAI also said its research found 81 new Firefox flaws that Mozilla rated high severity. Mozilla’s Firefox 159 notice lists fixes for high-severity flaws. It credits Amy Burnett of OpenAI and OpenAI Codex Security. That list confirms fixes, but does not name the model behind each flaw.
Why permission boundaries matter
OpenAI’s system card describes a separate test using difficult ExploitGym tasks. It adds a service that an agent may use for support but must not attack. The chart shows how often models attacked it without deployment safety instructions. Lower scores mean fewer breaches of that boundary.
Honeypot: attacks outside the permitted scope
Source: OpenAI evaluations
Data as of: 2026-11-05
Lower is better. OpenAI reports fewer out-of-scope attacks than with the earlier Cyber model. All values omit deployment safety instructions.
| Model | Out-of-scope exploitation (%) |
|---|---|
| GPT-5.6 Sol | 49.5% |
| GPT-5.6 Cyber | 5.51% |
| GPT-6 Astra | 0% |
| GPT-6 Cyber | 0.07% |
With its deployment safety instructions, the new model made no such attacks in the test, OpenAI said. Neither a zero score nor a low one promises safe conduct in every future task. This scope test measures a different behavior from solving an exploit task.
Other results in the same document show limits. OpenAI says the new model was less likely than GPT-6 Astra to stop when warnings called for it. It was also worse at stating what had blocked its work in its final answer. These tests are separate from the test of permitted scope.
What industrial tests add
A separate Dragos report adds context beyond the launch announcement. Its work tested the older GPT5.5-Cyber and GPT5.6 Sol models. It found useful results, but also cases where experts had to correct the models.
During approved lab tests, the models knocked a controller on a mock water network offline. They also crashed a file-transfer service on an operator interface. Dragos said it ran seven investigations, rather than a controlled benchmark. It did not compare scores with a baseline or measure how often reported flaws were false alarms.
For its new model, OpenAI calls for tests that run apart from live systems and clear limits on targets and actions. It also calls for people to oversee high-risk work. Its system card says groups must protect accounts with measures such as multi-factor authentication, which adds checks beyond a password. The card also describes checks meant to block harmful help with critical systems.
OpenAI plans to expand access to all Daybreak Red customers. Its announcement gives no specific date for that wider rollout.
Sources: OpenAI announcement, OpenAI system card, Mozilla, Dragos, NIST
