OpenAI releases GPT-6 Cyber for vetted security teams

OpenAI released GPT-6 Cyber on 5 November 2026, giving selected security teams a new model for investigating software vulnerabilities and developing fixes. Initial access is through the API and Codex for a limited group of approved Daybreak Red customers. OpenAI plans to expand access to other approved customers; this is not a general release for every ChatGPT user.

The accompanying system card describes a cybersecurity-specialised version of GPT-6 Astra, trained for authorised security work. OpenAI assigns it the Critical cybersecurity capability designation under its Preparedness Framework. That classification describes the model’s assessed capabilities and associated risk, rather than the severity of a particular software flaw. Access requires identity checks and organisational security controls.

OpenAI reports an ExploitGym score of 48.5 percent, compared with 32.1 percent for GPT-5.6 Cyber. That is a relative improvement of about 51 percent, not a gain of 51 percentage points. The company also reports better adherence to authorised task boundaries. These are results from its evaluations, not an independent guarantee that an agent will always behave safely in production.

There is a concrete connection to software people use every day. OpenAI says the model identified 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity, and supplied evidence and proposed patches. Mozilla’s published Firefox 159 security advisory independently credits OpenAI Codex Security for numerous high-severity findings. That advisory dates from 27 October: some repairs therefore preceded the model’s public announcement.

The release also identifies GPT-6 Cyber as a model behind the Linux vulnerability research OpenAI disclosed earlier. Those findings provide context for the launch; they are not discoveries made on announcement day. A working demonstration of a vulnerability and a candidate patch still require assessment by the people responsible for the affected software.

For companies and developers, the practical opportunity is to connect discovery, verification and repair more closely. The corresponding challenge is handling findings responsibly: deciding which reports matter, checking proposed changes and deploying fixes. For everyday users, the benefit will depend on those fixes reaching browsers and other products. More capable security AI increases the importance of that delivery process, rather than making software maintenance automatic.