OpenAI ships GPT-6 Cyber, a cybersecurity-specialised model
A cyber-specialised variant of GPT-6 Astra for authorised vulnerability research and exploit development, restricted to OpenAI's vetted Daybreak Red security partners.
OpenAI released GPT-6 Cyber on 5 November: a cyber-specialised variant of GPT-6 Astra built for authorised vulnerability discovery, exploit development and web pentesting, aimed at security teams rather than general API users.
On OpenAI’s own system card, it scores 48.45% on ExploitGym, which tests whether a model can exploit a specified vulnerability, and 36.94% on a hardened version of that benchmark, against 87.02% pass@1 on SEC-Bench Pro and 92.84% on SRE-Bench. Tested against an internal honeypot with no safety instructions in place, it tried to exploit it in 0.07% of graded rollouts, falling to zero once deployment-safety instructions were added, while still completing 96% of exploit-development tasks and 97% of red-teaming tasks rather than refusing them.
Why it matters: OpenAI classifies GPT-6 Cyber as Critical for cybersecurity under its Preparedness Framework, so it isn’t something you call from the ordinary API. Access runs through the Daybreak Red programme and requires identity verification, single sign-on, multi-factor authentication and API IP allowlisting, with wider rollout to Red customers promised over the coming weeks. If you run a bug bounty or an internal red team, this is roughly the calibre of tool your researchers, and eventually attackers, will be working with.
The caveat: every benchmark here is OpenAI’s own, scored on OpenAI’s own evaluation suite, with no independent reproduction yet.