OpenAI Launches GPT-6 Cyber: A 'Critical'-Rated Security Model Limited to Approved Daybreak Red Customers

This is an analysis of public material: OpenAI's announcement, system card, developer documentation and Linux research report, Mozilla's blog, and press coverage. We had no access to the model and did not reproduce any result; every figure below is OpenAI's or a publication's.

Who should care

• Enterprise red teams and AppSec leads. A commercial model that runs the find-reproduce-exploit-patch loop is now on the market, gated behind an application and review.
• Platform and SRE teams running Linux fleets. OpenAI's headline Linux finding is about local privilege escalation, which matters most on shared hosts, CI runners and multi-tenant infrastructure.
• Open-source maintainers. Expect more machine-generated vulnerability reports and candidate patches. OpenAI points maintainers to Patch the Planet, run with Trail of Bits, Calif and HackerOne.
• Everyone else. You won't use the model, but you will likely see more frequent browser and kernel security updates. Installing them promptly is the practical takeaway.

What OpenAI has confirmed

The system card frames the model as built for authorized work such as vulnerability discovery, exploit development and web pentesting, with training aimed at fewer cyber refusals, staying within the user's authorized scope, and keeping refusals outside cybersecurity. The model page in the developer docs lists the model ID gpt-6-cyber, the pricing above, cache writes at $25 per million tokens for 30 minutes or $50 for 12 hours, and states that an organization "needs Daybreak Red access and approval." The Batch and fine-tuning endpoints are not supported.

The real-world evidence OpenAI cites

Linux. In a November 4 report, "A thousand fewer paths to root," OpenAI describes a five-stage pipeline (target selection, static scanning, dynamic reproduction, exploitability assessment, patch generation, then human review) run in mid-October against the kernel master branch on a stock desktop distribution. It produced 2,308 candidates, reproduced 1,724, and yielded working local privilege escalation exploits for 948 distinct bugs, at $1,213,430 in API credits, about $1,279 per unique exploit. A July run with GPT-5.6 Sol found 166. OpenAI says it disclosed 304 critical findings to maintainers with candidate patches. The next day, the launch post identified GPT-6 Cyber as the model behind that run.

Firefox. OpenAI says the model produced evidence and reproducible tests for 81 new vulnerabilities that Mozilla classified as high severity, and showed 30 known issues were worse than previously assessed. Mozilla's October 29 post, "Defending the patch gap against automated attackers," says the Firefox team has used frontier models from Anthropic and OpenAI since February and has shipped more than seven times as many security fixes as in the same period of 2025.

What is not yet established

• Independent replication. All benchmark numbers, including the new RemoteExploitBench and Honeypot evaluations, are OpenAI's own. CSO Online notes the Linux report does not give a full remediation breakdown for all 948 findings.
• What "948" means. These are local exploits that need an existing foothold, not remote break-ins, and the pipeline targeted security-relevant parts of the kernel rather than auditing all of it. It is not a count of newly disclosed CVEs.
• Production behavior. The 99.93% scope result describes an evaluation, not a guarantee for live engagements. OpenAI's own Linux pipeline still ended with a human researcher reviewing every exploit and patch.
• Timing of wider access. OpenAI says it will expand to all Daybreak Red customers "soon," with no date.
• Daybreak Blue data use. The Hacker News reports that, starting November 29, OpenAI plans to use Daybreak Blue session content from personal accounts to strengthen misuse safeguards even when the "improve the model" setting is off. Check OpenAI's current terms before relying on that setting.

What it means for security and infrastructure teams

The most consequential line is in the Linux report, not the launch post: for the near term, OpenAI writes, a low-privileged account on a system missing available patches should be treated as functionally equivalent to root against a well-resourced attacker. If your threat model still treats "unprivileged shell" as a contained incident, that assumption is weaker than it was a month ago.

On cost, $100 per million output tokens is steep next to general-purpose models, but OpenAI's own numbers put a successful exploit at about $359 in credits on average. The report also says every result went through human review before disclosure, so budget for expert triage time, not just tokens.

Limitations

This piece relies on OpenAI's announcement, system card, developer docs and Linux report, Mozilla's blog, and reporting from The Verge, The Hacker News, SecurityWeek and CSO Online, all checked on November 7. We could not access GPT-6 Cyber. Pricing and access terms may change. Some outlets cite additional figures, such as how many of the 948 bugs were previously unknown, that we could not find in OpenAI's own materials, so we left them out.

Last verified 2026-11-07.