GPT‑6 Cyber: OpenAI’s cyber model, with vetted access for defenders
OpenAI released GPT-6 Cyber on November 5 as a version of its GPT-6 Astra model trained for authorized vulnerability research. For now it is limited to a small group of approved customers in Daybreak Red, the top tier of OpenAI's Daybreak program for penetration testing, exploit development and red-teaming. Those customers reach the model through the API and Codex, and API calls must come from approved networks by default. Entry requires identity checks, legal attestations, single sign-on, multi-factor authentication and IP allowlisting. OpenAI says all Daybreak Red customers will get access over the coming weeks and plans a separate Daybreak Red group for critical infrastructure defenders. No public pricing has been announced.
OpenAI says researchers using the model reproduced 1,724 Linux kernel vulnerabilities and built working local privilege escalation exploits for 948 of them, according to reporting by VentureBeat. An earlier scan with the same harness produced 166 exploits for GPT-5.6 Sol. OpenAI disclosed 304 critical findings to Linux maintainers along with candidate patches. The model also found 81 high-severity Firefox flaws that Mozilla is now patching, per The Decoder. OpenAI rated the model Critical for cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.
In OpenAI's sandbox evaluations, the model stayed within permitted boundaries in 99.93% of tests without the deployment safety prompt and in all tests with it. The Linux work ran through an automated scout-and-analyst pipeline in controlled environments with human review. OpenAI has not disclosed evidence that the model compromised an internet-facing production system in this release.
Why it matters
For founders, the launch confirms that frontier labs are gating their most capable security models behind identity checks, managed devices and network allowlists instead of open signup. A startup that wants to build on these models will have to clear that vetting, which brings compliance work, legal attestations and data handling terms that can differ from a standard enterprise contract. Beri reported that Daybreak data handling departs from normal enterprise agreements and was changed a week before launch.
