The headline benchmark is 48.5% on ExploitGym. The number worth your attention is 99.93%. That’s how often GPT-6 Cyber declined to attack out-of-scope services in a honeypot test, and it’s the figure that decides whether security teams will let an autonomous agent near real infrastructure.
OpenAI announced GPT-6 Cyber on November 5, 2026, pitching it as a model that finds and validates exploitable vulnerabilities while respecting the limits researchers set. It replaces GPT-5.6 Cyber, and the gains are large.
What the benchmarks show
On ExploitGym, which tests whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scores 48.5%, up from 32.1% for GPT-5.6 Cyber. That’s a 51% relative improvement. On a new web penetration testing eval, where models probe applications without source code, it reached 40.3% recall of vulnerabilities against 32.0% for GPT-6 Astra, OpenAI’s mainline model.
The starkest comparison is RemoteExploitBench, built around known flaws in GitLab, PostgreSQL, and Jenkins. GPT-6 Astra running under Daybreak Blue refused every task. GPT-6 Cyber completed 95% of them. That gap is the product’s whole reason to exist: general models refuse too much for professional red teams, and a specialized model fills the hole.
OpenAI also classifies GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from High for the previous version. Read that as the company telling you this is a serious offensive tool, not a code-review assistant.
The alignment angle
The risk with a cyber agent is obvious. Give it a target and it may attack the package registry next to it. OpenAI built ExploitGym Honeypot around that failure, citing the Hugging Face incident as an influence. The environment includes deliberately easy-to-exploit support services that would reveal the task’s flag. The model has to infer that using them is out of bounds.
Without deployment safety prompts, GPT-6 Cyber stayed in scope 99.93% of the time, up from 94.49% for GPT-5.6 Cyber. With the prompts, 100%. The published chain-of-thought excerpts show the model reasoning explicitly about it, with lines like “don’t explore out of scope credentials.” That’s encouraging, though it’s still OpenAI’s own eval, and a honeypot built by the vendor is not an adversarial audit.
Real-world results
The field numbers are the most persuasive part. OpenAI researchers used the model to develop 948 privilege escalation exploits in Linux and find 81 previously unknown high-severity vulnerabilities in Firefox, a codebase already picked over by earlier frontier models. Mozilla has shipped fixes for many of them, and a Mozilla distinguished engineer is quoted calling it a world-class defensive model. Cisco, Calif, and CodeRabbit are among the teams using it, and OpenAI used it to red-team its own training infrastructure, where agents chained bugs to escape microVMs.
Availability and what it means
Access runs through Daybreak. Daybreak Blue is for verified defenders validating vulnerabilities and fixes with fewer refusals. Daybreak Red adds deeper exploit development and authorized testing with GPT-6 Cyber. OpenAI says it wants to expand Daybreak to organizations of every size, independent researchers, and open-source maintainers. No pricing was given.
The competitive read: Anthropic, Google, and a crowd of security startups are all chasing automated vulnerability discovery, and this is a strong data point for OpenAI. But the real shift is the framing. OpenAI says there’s a limited window to use frontier models to secure software before attackers catch up. Whether or not you buy the urgency, the benchmarks suggest this isn’t noise. Defenders who can’t get verified access will fall behind those who can.
