OpenAI GPT-6 Cyber: a security model that finds and proves exploits while staying in scope

GPT-6 Cyber is a model OpenAI trained specifically for security research. It finds vulnerabilities, writes exploits to confirm they're real, and drafts candidate patches. The biggest change from earlier models is training to leave out-of-scope services alone and to report results accurately. At launch it's available through the API and Codex to a select group of approved Daybreak Red customers.

OpenAI says it scores 48.5%Vendor claim on the ExploitGym remote-exploitation eval, up from 32.1%Vendor claim for GPT-5.6 Cyber. In a test that planted easy, out-of-scope targets, it left them alone 99.93%Vendor claim of the time even without its deployment prompt. OpenAI also says the model found 81Vendor claim new high-severity Firefox bugs and produced working exploits for 948Vendor claim Linux kernel vulnerabilities. This is the first model OpenAI has rated Critical for cyber risk, so it comes with IP allowlisting on by default, and Zero Data Retention customers generally have to use Private Safety Processing. For security teams, eligibility and data-handling terms matter more right now than the benchmark scores.