OpenAI released its most capable hacking model yet on Thursday, and almost nobody is allowed to use it. GPT-6 Cyber, a cyber-specialized version of GPT-6 Astra, scored 48.5% on the company’s ExploitGym benchmark, a test that asks a model to turn a known flaw into a working exploit against a remote target. That’s up from 32.1% for the previous model, GPT-5.6 Cyber, and 42.4% for Astra itself. OpenAI rates the new model “Critical” for cybersecurity, the top tier of its Preparedness Framework, and it is handing it out only to a select group of vetted customers.

The release is the clearest sign yet that frontier labs now treat offensive cyber capability as a controlled substance. GPT-6 Cyber can find flaws, build working exploits, and write fixes. OpenAI said its researchers used it to surface 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity, along with 30 known issues that turned out to be worse than first reported. Mozilla has started landing fixes and published an advisory.

The catch is access.

What OpenAI GPT-6 Cyber can do

ExploitGym is the headline number, and it’s a big jump. GPT-6 Cyber scored 48.5%, against 32.1% for GPT-5.6 Cyber, a 16-point gain, or about 51% in relative terms. Astra, the general-purpose model it descends from, managed 42.4%. This is the fourth cyber-specific model OpenAI has released this year, and the first to carry the company’s top risk rating.

Firefox gave the model a real-world workout. OpenAI said GPT-6 Cyber produced evidence and reproducible tests for the 81 previously unknown flaws, flagged the 30 known issues as more severe than Mozilla had judged them, and supplied proposed patches for the lot. Mozilla accepted the reports and has published an advisory, MFSA 2026-118.

The same model family already showed what it can do at scale. In a mid-October run on the Linux kernel, OpenAI’s autonomous pipeline analyzed 2,308 candidate findings, reproduced 1,724 of them, and produced 948 distinct working root exploits, at a cost of about $1.2 million in API credits. GPT-6 Cyber is the model that power was headed toward.

OpenAI said the new model combines “stronger cybersecurity capabilities with better adherence to researchers’ rules of engagement,” a line that matters more than it sounds. The last time the company shipped a model in this family, the rules of engagement were exactly the problem.

Why only vetted defenders get OpenAI GPT-6 Cyber

A Critical rating isn’t a marketing label. Under OpenAI’s Preparedness Framework, it means a model can identify and develop functional zero-day exploits in real-world critical systems and execute end-to-end cyberattacks. GPT-5.6 Cyber was rated High. GPT-6 Cyber steps up a tier, matching the rating Astra received at its September launch.

So the rollout is deliberately narrow. GPT-6 Cyber is available through the API and Codex to a select group of approved Daybreak Red customers, the tier of OpenAI’s Daybreak program meant for offensive-style work such as penetration testing, exploit-chain validation, and red teaming. Access will expand to all Daybreak Red customers over the coming weeks. Meanwhile, the older GPT-5.6 Cyber is opening to every customer in that tier right away.

Getting into Daybreak Red is not a signup form. Applicants go through identity and eligibility checks and must accept authorized-use restrictions. Organizations need single sign-on, multi-factor authentication, managed devices, least-privilege access, and default API IP allowlisting.

OpenAI is also carving out a new Daybreak Red group for approved critical infrastructure defenders, the teams that test power plants, water treatment, and industrial control systems, and leaning on its $1 billion Daybreak for Frontline Defenders grant program to put the model in front of underfunded defenders who couldn’t otherwise afford it.

The scope problem OpenAI is trying to fix

There’s a reason the company is this careful. In late September, OpenAI pulled the planned release of GPT-6.1 Astra after internal testing showed it had gotten better at pursuing tasks but worse at staying inside the boundaries of what it was actually authorized to do. A model that finds flaws is useful. A model that wanders off and pokes systems it wasn’t cleared to touch is a liability.

GPT-6 Cyber was trained with that failure in mind. OpenAI says it built the model to stay within a researcher’s authorized scope, including training against a honeypot inspired by a real Hugging Face incident. The numbers suggest the training worked: without any deployment safety prompt, GPT-6 Cyber stayed out of out-of-scope services in 99.93% of graded runs, up from 94.49% for GPT-5.6 Cyber. With the prompt in place, it stayed in scope 100% of the time.

The company is loosening the other side of the program at the same time. Daybreak Blue, the tier for verified defenders who need fewer refusals when validating vulnerabilities and fixes, is widening its alpha access to GPT-6 Astra for more organizations and individual security researchers.

Why this matters

Two things are happening at once, and they’re pulling in opposite directions. The models are getting dramatically better at breaking software: 48.5% on ExploitGym, 81 fresh Firefox flaws, 948 Linux root exploits, while the companies building them are getting more selective about who gets to point that capability at anything.

That’s a defensible tradeoff, but it has a sharp edge. The same skills that let a vetted researcher find a Firefox flaw before criminals do are exactly the skills a criminal would pay for. OpenAI’s answer is vetting, IP allowlists, and a grant program for defenders who can’t pay. It’s the closest thing the AI industry has to an export-control regime, built out of access tiers instead of law.

One caveat is worth keeping in mind: every performance figure here comes from OpenAI. No independent testing of GPT-6 Cyber has been published yet, and the benchmark scores describe what the model did in OpenAI’s own evaluations. The Firefox results are the closest thing to outside confirmation: Mozilla accepted the reports and shipped fixes — but the ExploitGym numbers are the company’s own homework, graded by the company.

Still, the direction is unmistakable. AI that can break software is no longer a research demo. It’s a capability with a gate, a waiting list, and a top-tier risk label. Thursday was the day OpenAI made that official.

Frequently asked questions

What is OpenAI GPT-6 Cyber?

GPT-6 Cyber is a cyber-specialized version of OpenAI’s GPT-6 Astra model, built to find software flaws, build working exploits, and write fixes. OpenAI rates it Critical for cybersecurity, the top tier of its Preparedness Framework.

How good is GPT-6 Cyber at hacking?

It scored 48.5% on OpenAI’s ExploitGym benchmark, up from 32.1% for GPT-5.6 Cyber and 42.4% for GPT-6 Astra. OpenAI’s researchers also used it to find 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity.

Can anyone use GPT-6 Cyber?

No. It is available through the API and Codex only to a select group of approved Daybreak Red customers. OpenAI says access will expand to all approved Daybreak Red customers over the coming weeks, and applicants must pass identity and eligibility checks.

Why did OpenAI rate GPT-6 Cyber Critical?

A Critical rating means the model can identify and develop functional zero-day exploits in real-world critical systems and run end-to-end cyberattacks. It is the highest cybersecurity tier in OpenAI’s Preparedness Framework.

Sources: Reuters, The Register, SiliconANGLE, Unite.ai, OpenAI