OpenAI Releases GPT-6 Cyber Cybersecurity Model, Scoring 48.5% on ExploitGym
OpenAI has released the cybersecurity model GPT-6 Cyber to a small group of vetted customers. It scored 48.5% on the ExploitGym test, up from 32.1% for the previous generation GPT-5.6 Cyber, a relative performance improvement of 51%. Without special safety instructions, the model avoided out-of-bounds behavior in 99.93% of test cases; with safety instructions enabled, it complied with permission boundaries 100% of the time. In its Preparedness Framework, OpenAI rated its cybersecurity level as "Critical." In real-world testing, it discovered 81 previously unknown critical vulnerabilities in Firefox, reproduced 1,724 vulnerabilities in the Linux kernel, and developed working exploits for 948 of them. The total computational cost of the testing was approximately $1,213,430. The model was initially made available to Daybreak Red customers through the API and Codex.
Why read this
AI score 78
The original text provides specific benchmarks and real-world data for the new model on vulnerability discovery and permission compliance, which can be used to assess the capability boundaries of specialized security models.
Topics
Body · AI translation
OpenAI Releases GPT-6 Cyber Cybersecurity Model: 51% Improvement Over Predecessor, Capable of Both Attack and Defense
Phoenix Tech Download the App for Exclusive Early Access November 6, 2026, 06:51:26 From Beijing
GPT-6 Cyber
Phoenix Tech News, November 6 (Beijing Time) — According to Reuters, OpenAI on Thursday released GPT-6 Cyber to a small group of vetted customers. It is a model designed specifically to discover and exploit security vulnerabilities. Under its safety framework, OpenAI rated the model's cybersecurity level as "Critical."
OpenAI said this is a major leap in the field of security research. The new model is significantly better at discovering and fixing security vulnerabilities, and is also more reliable, strictly adhering to the permission boundaries set by researchers.
Compared with GPT-5.6 Cyber, GPT-6 Cyber made significant progress on multiple key cybersecurity benchmarks, including a 51% relative performance improvement on the ExploitGym test, as well as a leap in adhering to specified permission scopes.
OpenAI said that when training GPT-6 Cyber, the company specifically strengthened the model's ability to comply with operational security protection mechanisms. One training method drew on the Hugging Face incident to design a honeypot (to lure attackers into exposing their behavior). Without any special safety instructions, GPT-6 Cyber avoided out-of-bounds behavior in 99.93% of test cases, higher than the previous generation model's 94.49%. After safety instructions were enabled, the model complied with permission boundaries in 100% of tests.
Overall, in its own "Preparedness Framework," OpenAI rated GPT-6 Cyber's cybersecurity level as "Critical." This rating is the same as the one previously given to the GPT-6 Astra base model.
GPT-6 Cyber Leads with 48.5%
The ExploitGym benchmark is used to evaluate whether a model can exploit specific vulnerabilities in remote systems to launch attacks. According to OpenAI's data, GPT-6 Cyber scored 48.5%, higher than the previous generation GPT-5.6 Cyber's 32.1%. In a new test, researchers evaluated the model's ability to discover web application vulnerabilities without access to source code. OpenAI's published results show that GPT-6 Cyber's vulnerability discovery rate was 40.3%, while the standard model GPT-6 Astra, which has not received specialized cybersecurity training, was 32.0%.
Real-World Performance
According to OpenAI, GPT-6 Cyber has already achieved results in real-world security research. In a targeted test, although Firefox had previously undergone security testing by earlier AI models, GPT-6 Cyber still discovered 81 previously unknown critical vulnerabilities. In addition, the model found that 30 known issues were actually more severe than previously assessed. Mozilla accepted these vulnerability reports and has released fixes.
OpenAI said that in the Linux kernel, GPT-6 Cyber successfully reproduced 1,724 security vulnerabilities and developed actually runnable exploit programs for 948 of them. Under the same test conditions, this number is more than five times the 166 completed by GPT-5.6 Sol. The company said GPT-6 Cyber also reported 304 critical vulnerabilities to Linux maintainers, along with suggested fixes.
In this Linux kernel security research operation, OpenAI built a dedicated automated system in which reconnaissance agents and analysis agents worked together. First, the system scanned about 5,034 security-related code locations in the Linux kernel, accounting for about 7% of the entire codebase. It then narrowed the scope to 2,308 candidate targets and confirmed 1,724 vulnerabilities in isolated virtual machine environments. On this basis, the system further developed 948 actually runnable exploit programs; these results had previously been announced by OpenAI.
OpenAI said the computing cost of the entire testing process was $1,213,430, with an average cost of about $1,279 per exploit program. By comparison, vulnerability discovery competitions such as Pwn2Own and TyphoonPWN have historically offered bounties of $20,000 to $70,000 for similar-level vulnerability discoveries.
GPT-6 Cyber will initially be available through the API and Codex to a small group of Daybreak Red customers, and will then gradually expand to all Daybreak Red customers. At the same time, GPT-5.6 Cyber will also be made available to all Daybreak Red users. In addition, OpenAI will expand the Daybreak Blue Alpha testing scope of GPT-6 Astra, allowing more organizations and individual security researchers to participate. (Author/Xiao Yu)
For more first-hand news, welcome to download the Phoenix News app and subscribe to Phoenix Tech. For in-depth reports, please search "Phoenix Tech" on WeChat.