What changed
OpenAI announced GPT-6 Cyber, a cybersecurity model that significantly improves upon GPT-5.6 Cyber. The model demonstrates a 51% relative improvement on ExploitGym, a benchmark that tests the ability to exploit vulnerabilities. It also shows a step function improvement in staying within task boundaries, avoiding out-of-scope services in 99.93% of tests without deployment prompts and 100% with them.
What this means in practice
GPT-6 Cyber is already being used to secure real-world software, uncovering and validating thousands of exploits in critical codebases like Linux and Firefox. Researchers used it to develop 948 privilege escalation exploits in Linux and identify 81 previously unknown high-severity vulnerabilities in Firefox. Mozilla has released fixes for many of these Firefox vulnerabilities. Security teams at Cisco, Calif, and CodeRabbit are also using GPT-6 Cyber for vulnerability research and code review. The model is part of the Daybreak initiative, which aims to bring advanced security research to organizations of all sizes, independent researchers, and open-source maintainers.
Limitations and availability
The model is classified as Critical in cybersecurity under OpenAI's Preparedness Framework, up from High for GPT-5.6 Cyber. It outperforms GPT-6 Astra on most cyber tasks, including vulnerability discovery and exploit development. GPT-6 Cyber is available for use in security research and code review workflows, with additional tools like Daybreak Blue and Daybreak Red supporting different security workflows. The model's capabilities are already being leveraged to secure OpenAI's own infrastructure and find vulnerabilities in open-source software at scale.
