GPT-6 Cyber Is Real, Rated 'Critical', and You Can't Use It Yet
OpenAI released GPT-6 Cyber on November 5, 2026, rating it 'Critical' for cybersecurity. It scored 48.5% on ExploitGym and found 81 Firefox bugs, but access is locked to approved Daybreak Red defenders only. Here's what that means for security students.
On November 5, 2026, OpenAI published a launch page for a new model and rated it "Critical" for cybersecurity. That is the highest level on its own risk scale. Then the same page listed what the model did to real software, and the numbers are large.
If you are studying security, that gap between "very capable" and "locked away" is the part worth reading closely.
OpenAI's GPT-6 Cyber is a security model that OpenAI rates 'Critical', and it is open only to approved Daybreak Red defenders. It scored 48.5% on ExploitGym, found 81 new Firefox bugs and built what OpenAI says are 948 working Linux exploits (TechCrunch calls them "potential issues"). Students cannot try it, so the useful question is what it changes for security careers.
GPT-6 Cyber launched on November 5 with a 'Critical' rating
OpenAI released GPT-6 Cyber on 2026-11-05 and classed it 'Critical' in cybersecurity, one level above the 'High' given to GPT-5.6 Cyber, according to OpenAI's announcement. The Verge confirms the release went out at 5:00 PM UTC that day. The OpenAI page is linked as an archived copy because the original page may change.
The Preparedness Framework is OpenAI's internal checklist for grading how much harm a model's skills could help someone cause. A "Critical" grade in cybersecurity means OpenAI judges the model strong enough at attack work to need tight controls before release.
One naming note before you search for it. TechCrunch calls the model "ChatGPT Cyber". OpenAI and The Verge both use GPT-6 Cyber, and this post follows the vendor.
ExploitGym scores show a jump over GPT-5.6 Cyber
GPT-6 Cyber scored 48.5% on ExploitGym, ahead of GPT-6 Astra at 42.4% and GPT-5.6 Cyber at 32.1%, as The Verge reports. ExploitGym is a benchmark of exploit-writing tasks. An exploit is code that turns a software bug into a working attack, and the score is the share of tasks the model completes.
| Model | ExploitGym score | Went out of bounds in testing |
|---|---|---|
| GPT-6 Cyber | 48.5% | Less than 1% of the time |
| GPT-6 Astra | 42.4% | Not reported |
| GPT-5.6 Cyber | 32.1% | About 5% of the time |
"Out of bounds" means the model touched a system outside the area it was allowed to test. Say you are hired to test a bank's test server, but your tool also touches the bank's real server. In a real job, that is the difference between an authorised test and a crime. OpenAI's page describes the jump over GPT-5.6 Cyber as roughly a 51% relative improvement (OpenAI).
A second result explains why a separate model exists at all. On a new test called RemoteExploitBench, GPT-6 Astra refused 100% of the tasks, while GPT-6 Cyber completed 95% (OpenAI). The public model says no to this work on purpose.
You will not find GPT-6 Cyber on the Artificial Analysis leaderboard. It is gated, so no independent ranking exists, and I make no ranking claim for it here.
Real results: 948 Linux exploits and 81 Firefox bugs
In real software, the model reproduced 1,724 Linux kernel vulnerabilities, built working exploits for 948, and found 81 new high-severity Firefox flaws, per OpenAI's page. These are not practice puzzles. Linux runs most servers in both India and the US, and Firefox runs on millions of laptops.
| Finding | What it means |
|---|---|
| 304 critical Linux findings disclosed | Reported to the kernel maintainers so they can be fixed |
| 30 known Firefox issues | Already-reported bugs the model showed were more dangerous than first rated |
| A critical Brotli bug | A remote code execution flaw in a compression library, found together with other models |
| $1.2 million in tokens | What OpenAI said the Linux bug hunt cost to run |
Remote code execution means an attacker can run their own code on your machine from somewhere else. It is the most serious kind of bug. TechCrunch also describes the Linux work as scanning the kernel and preparing patches, and calls the 948 "potential issues", a softer wording. To be clear: 1,724 bugs were reproduced, and OpenAI says 948 of them became working exploits.
That price tag deserves a second look. Tokens are the units AI companies charge for. A bug hunt costing $1.2 million in tokens is a company budget, not a student budget. Do not set it beside the $5,000 figure from the Charge Robotics CTO below: that was one Ubuntu bug, found with a different model, so the two costs cannot be compared.
Who can use GPT-6 Cyber today: approved Daybreak Red defenders
Access is limited to selected Daybreak Red customers through the API and Codex, with an IP allowlist, and it is not in ChatGPT or on OpenRouter, according to The Verge and OpenAI. An IP allowlist means OpenAI only accepts requests coming from network addresses the customer has registered in advance.
OpenAI has published no price and no per-token figure. Daybreak Red is for companies doing authorised defensive security work, and TechCrunch reports only "thousands" of professionals are in the wider Daybreak program.
Money is on the table, but not for individuals. The $1 billion Daybreak for Frontline Defenders grant pays for critical-infrastructure teams to use these tools. New checks also block high-risk activity such as attacks on power plants and water treatment facilities (The Verge). OpenAI says access will widen to all Daybreak Red customers in the coming weeks, and GPT-5.6 Cyber is now open to that whole group.
Pros
- Attackers cannot simply sign up and point it at a hospital or a bank.
- Every user is a known company, so misuse can be traced.
Cons
- Students and independent researchers cannot learn how these tools behave.
- Small companies outside the program fall behind those inside it.
Google made the same choice with its own security model, which I covered in Gemini 4 Carbon puts cyber defenders first. Open-weight models take the other road, as the Kimi K3.1 Pro post explains.
What this changes for offensive-security careers
Hunting for bugs by hand is the part of penetration testing the model is best at, so the work is moving toward checking and fixing what AI finds. That is my read, and I hold it loosely.
Say you are applying for a junior pentest role next year. The company may already run a model over its code before you arrive. Your value is deciding which findings are real, explaining the risk to a manager who is not technical, and writing a fix that does not break anything else.
Here is the counterpoint. TechCrunch reports that the CTO of Charge Robotics used a different model, GPT 5.6 Sol through Daybreak Blue, to find a severe Ubuntu bug in two hours. He spent about $5,000 finding exploits. A skilled person chose the target, judged the output and knew when to stop. The tool did not replace that.
I will not guess how many jobs this adds or removes. Nobody has data for that yet. If you are starting out, the path in how to become a penetration tester still holds. Put more weight on reporting and fixing than you would have a year ago.
What you can do now to build security skills
Start with free, self-paced hands-on labs and use mainline GPT-6 Astra for code review, vulnerability triage and patch practice. OpenAI names those three as uses for Astra.
Pick a free lab path
Platforms such as TryHackMe (tryhackme.com) have free beginner rooms that work from India and the US. Start with its Pre Security path, and finish all of it before you switch to another path, so you learn the basics in order and do not skip the dull parts.
Read vulnerable code on purpose
Run OWASP Juice Shop, the deliberately insecure practice web app from the OWASP community (search for its official project page on owasp.org) on your own machine. It is a web app built to be broken, so you can attack it legally.
Ask Astra to triage, then check it
Paste a small vulnerable function and ask what is wrong and how serious it is. Then confirm the bug yourself. Treat the answer as a lead, not a verdict.
Write the patch yourself
Fix the bug, then try your original attack again. If it still works, the fix is wrong.
Publish a short write-up
Explain the bug, the risk and the fix in plain words on a blog or GitHub. A public write-up gives an interviewer something concrete to ask you about.
Remember that Astra refuses real attack work, as the RemoteExploitBench result showed. Use it to understand and fix code you own, never to test systems you have no permission to touch.
Should students worry about GPT-6 Cyber?
Worry less about the model and more about skipping the basics. In my opinion, trust and credentials are what will get you near tools like this, since Daybreak lets in vetted companies, and companies hire people they can trust with permission.
Two things are worth watching: the expansion to all Daybreak Red customers, and whether OpenAI ever publishes a price. If you are weighing the career on pay, our cyber security analyst salary guide for India covers that separately.
A question for you: if a model finds the bugs, which part of security work do you most want to own? Tell me in the comments.
