OpenAI Releases GPT-6 Cyber Cybersecurity Specialist Model

The model's efficacy in controlled environments is even more striking. On the new RemoteExploitBench—which tests against GitLab, PostgreSQL, and Jenkins—GPT-6 Cyber successfully completed 95% of assigned exploit tasks. In contrast, the more restrictive GPT-6 Astra refused 100% of these tasks due to its general-purpose safety alignment. This highlights the 'surgical' nature of GPT-6 Cyber: it is trained to be aggressive within a defined scope but strictly disciplined outside of it.

Real-world impact has already been documented. The model identified 81 novel high-severity vulnerabilities in Firefox, providing both reproducible evidence and candidate patches. In Linux kernel testing, it developed working exploits for 948 vulnerabilities out of 1,724 reproduced—a 5.7x increase over GPT-5.6 Sol. It also played a key role in validating a critical RCE in the Brotli compression library.

• ExploitGym Score: 48.5% (vs 32.1% for GPT-5.6 Cyber).
• Web Pen-Testing Recall: 40.3%.
• RemoteExploitBench Completion: 95%.
• Linux Kernel Exploits: 948/1,724 (5.7x improvement over predecessor).

Alignment & Safety Framework

Given the model's ability to automate exploitation, OpenAI has elevated its classification to 'Critical' under the Preparedness Framework. To mitigate the risk of misuse, the model features an advanced alignment step-change. In ExploitGym Honeypot tests, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of cases, a significant jump from the 94.49% seen in GPT-5.6 Cyber.

Safety is further bolstered by deployment prompts; when explicitly instructed to stay within scope, the model achieved a 100% success rate in boundary adherence. This level of control is essential for integrating AI into automated Red Teaming and DevSecOps pipelines without the risk of the model 'wandering' into production environments.

• 99.93% success rate in avoiding out-of-scope services.
• Classified as 'Critical' under OpenAI Preparedness Framework.
• Built-in safeguards for Operational Technology (OT) and ICS environments.

Use Cases

GPT-6 Cyber is not a chatbot; it is a specialized tool for security engineering. Its primary use cases include automated vulnerability research, rapid patch development, and advanced Red Teaming. It is particularly effective for security teams managing massive codebases where manual auditing is impossible.

Beyond standard software, the model is optimized for critical infrastructure. Thanks to evaluations with Dragos, it is capable of understanding and assisting in the security of OT/ICS environments, making it a vital asset for protecting power grids, water systems, and manufacturing plants.

• Automated Vulnerability Discovery (Fuzzing assistance).
• Rapid Patch Generation and validation.
• Advanced Red Teaming and Penetration Testing.
• Critical Infrastructure (OT/ICS) security auditing.

API Pricing & Access

Access to GPT-6 Cyber is strictly controlled and is not available to the general public. It is currently restricted to approved 'Daybreak Red' customers via API and Codex. Access is managed through IP allowlisting by default to prevent unauthorized usage.

To support the defense community, OpenAI has launched the $1 billion 'Daybreak for Frontline Defenders' program, which subsidizes access for organizations protecting critical infrastructure. There is no public pricing listed for the general market, as availability is limited to vetted security partners.

• Access: Restricted to vetted Daybreak Red customers only.
• Method: API and Codex with mandatory IP allowlisting.
• Subsidies: Available via the Daybreak for Frontline Defenders program.
• Public Pricing: N/A (Restricted access).

Getting Started

For organizations that are part of the Daybreak Red program, access can be provisioned through the standard OpenAI enterprise portal. Developers should ensure their environments are configured for the specialized API endpoints provided to security partners.

If your organization is a critical infrastructure defender, we recommend applying through the Daybreak for Frontline Defenders program to secure subsidized access and specialized support for OT/ICS deployments.

• Contact OpenAI Daybreak Red division for vetting.
• Use specialized security-hardened API endpoints.
• Consult Dragos-validated documentation for ICS implementations.

Sources