OpenAI Says GPT-6 Cyber Lifts ExploitGym Score to 48.5%

OpenAI introduced GPT-6 Cyber on November 5, restricting its new cybersecurity model to selected, approved security customers while reporting a substantial improvement on a vulnerability-exploitation test. The company said the model scored 48.5% on ExploitGym, compared with 32.1% for GPT-5.6 Cyber. Those are developer-reported results, not an independent ranking of security products.

The launch announcement puts authorized scope at the center of the release: a model that can find and validate software flaws also needs to avoid acting on systems its operator has not permitted it to test. OpenAI says initial access is through its API and Codex for a select group of Daybreak Red customers, with broader access within that approved group planned. This is not a general public rollout.

What the benchmark improvement measures

ExploitGym asks whether a model can exploit a specified vulnerability in a remote software target. The system card describes success as obtaining the target’s flag through code execution and confirming that the intended vulnerability was used. That makes it a bounded technical evaluation, not a measure of how often a security team will find a new flaw in arbitrary production software.

TBR calculations from the rounded launch figures show an increase of 16.4 percentage points, or about 51.1% relative to the earlier model’s score. The chart keeps that comparison within the figures OpenAI published together on November 5. It does not combine older system cards, customer testimonials or unrelated cybersecurity benchmarks into a composite. Publication date is not the execution date of every test; the announcement does not give a separate day for this comparison.

The safety card records weaknesses as well as gains

The GPT-6 Cyber system card gives a more qualified picture than a single headline score. In a separate honeypot evaluation, the model exploited an out-of-scope supporting service in 0.07% of graded runs without deployment safety instructions and in none of the observed runs with those instructions. A zero observed failure rate in that controlled test does not establish that the model can never exceed its authority.

The card also reports that GPT-6 Cyber was worse than GPT-6 Astra at some behaviors, including carrying blockers through to its final answer and stopping when a warning warranted stopping. These are operationally important distinctions: a security agent can be technically capable yet leave its human supervisor with an incomplete account of what it could not verify. OpenAI recommends sandboxing, review checks and oversight rather than treating training alone as the boundary.

Access approval is separate from permission to test

OpenAI’s Daybreak access documentation says GPT-6 Cyber requires separate model approval; selecting the Daybreak Red tier does not itself grant access. The program is for authorized work, and its restrictions continue to apply after approval. The documentation also says Daybreak is not a way to resell access or extend it to customer-facing traffic and unrelated third parties.

The release adds security requirements around accounts and API use, including identity checks and IP allowlisting by default for Daybreak Red API access. These controls address access to the model. They do not substitute for obtaining permission from the owner of a target system. The practical distinction is between a provider allowing someone to use a tool and an organization authorizing that person to act on its infrastructure.

Finding a vulnerability is not the same as shipping a fix

OpenAI says the model helped identify 81 previously unknown Firefox vulnerabilities classified as high severity and develop working exploits for 948 Linux kernel vulnerabilities. The company describes coordinated disclosures and candidate patches, and says Mozilla has released fixes for many Firefox findings. Those totals describe different activities and should not be added together as one count of newly discovered, fully repaired bugs. This report has not independently reproduced the vulnerability campaigns.

The announcement arrives as AI tools take on more software work, a business shift also reflected in Meta’s acquisition of coding startup Conductor. Generating code, reviewing it and validating a security repair remain separate jobs. Our AI model reference and AI safety coverage distinguish documented capabilities from assurances that a system is safe in every setting. The immediate news is a stronger, tightly controlled security model—not evidence that human authorization or verification has become optional.

Sources

1. OpenAI launch announcement, November 5, 2026
2. OpenAI system card, November 5, 2026
3. OpenAI Daybreak access requirements, checked November 5

Additional sources

• Wikimedia Commons photograph record and licensing information