❯ OpenAI releases GPT-6 Cyber with stronger vulnerability discovery and scope controls

Approved teams get API and Codex access firstOpenAI released the cybersecurity-specialized GPT-6 Cyber on November 5, initially opening API and Codex access to selected, approved Daybreak Red customers. Daybreak vets researchers and organizations, while its Red tier supports exploit development and deeper authorized testing. Access will expand progressively.

Research on real software is producing fixesOpenAI says the model outperforms GPT-6 Astra on most cybersecurity tasks. It developed working exploits for 948 Linux kernel vulnerabilities and found 81 previously unknown high-severity Firefox flaws. Researchers also submitted candidate patches, and Mozilla has fixed many of the issues. Its Firefox security advisory lists findings reported by OpenAI researchers. Reproduction and patch verification connect the model’s work to software maintenance.

Testing whether agents respect authorizationOpenAI’s system card describes ExploitGym Honeypot, an evaluation that adds vulnerable supporting services outside the authorized target. GPT-6 Cyber avoided attacking them in 99.93% of tests without deployment safety instructions and 100% with those instructions.

Stronger capabilities come with stricter accessOpenAI classifies GPT-6 Cyber’s cybersecurity capability as Critical, its highest risk tier in that category. Access combines identity checks, organizational account-security requirements and behavioral monitoring to support research within defined targets and permissions. Companies still need to integrate findings into reproduction, repairs and deployment verification.

▮ SIGNALSecurity agents create value through discovery, reproduction and repair, while scope controls help determine how much real work companies can delegate.