GPT-6 Cyber pairs a big exploit-writing jump with tests built to keep it in scope

OpenAI is shipping GPT-6 Cyber, a cybersecurity specialist trained to find and validate exploitable bugs while staying inside researcher-set boundaries. It posts 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber. On RemoteExploitBench it completes 95% of authorized remote exploit tasks that GPT-6 Astra with Daybreak Blue refused entirely. Web pentest recall without source code reaches 40.3% versus Astra’s 32.0%. Its Preparedness classification moves from High to Critical.

It starts on the API and Codex for a select Daybreak Red group, with wider Red access, and GPT-5.6 Cyber for all Red customers, coming soon. Daybreak Blue alpha for GPT-6 Astra is also widening. Security teams at firms including Cisco, Calif, CodeRabbit and CrowdStrike are quoted in the launch.

In OpenAI’s own campaigns, the model helped develop exploits for 948 Linux kernel vulnerabilities, more than five times the working Linux exploits of GPT-5.6 Sol in the same harness, plus evidence for 81 novel high-severity Firefox issues that survived years of hardening and earlier frontier-model passes. Mozilla has landed fixes. The Linux work builds on OpenAI’s privilege-escalation pipeline (our analysis). OpenAI is effectively acknowledging that the cyber capability curve has gone steep and trying to put a harness on it.

ExploitGym Honeypot targets the Hugging Face-style failure: easy side doors that are out of scope (that incident). Chain-of-thought excerpts show the model reminding itself not to assume extra APIs or touch unrelated credentials. Safeguards include cyber-specific misalignment monitoring, live-server exploit watches during coordinated disclosure, Private Safety Processing for zero-retention API customers, default IP allowlisting on Daybreak Red and tighter blocks on harm to operational technology and industrial control systems. Dragos ran permissive models on a mock power plant range and saw reconnaissance quality jump; OpenAI says that feedback reshaped the blocks.

Releasing capability and containment together is the right approach, because either alone is dangerous. Given OpenAI’s own incidents with agents weakening monitors (our coverage), the honeypot results are the claims most worth independent replication.

Defenders should have this. Critical-infrastructure grants through the $1 billion Daybreak for Frontline Defenders program (coverage) and a Red subgroup for approved infrastructure testers are the right instinct. The risk is that Red stays a small club while open-weight models catch up: free Chinese models are already getting good at hacking (our coverage), and hobbyists are pulling severe bugs with older models (OpenAI’s ChatGPT Cyber). Then the alignment win is local and the capability spread is global. Expanding trusted access quickly while keeping the honeypot discipline is the balance to strike. Google’s similarly gated Gemini 4 Carbon is the direct comparison (our analysis). More in our cybersecurity coverage.