OpenAI rates its new GPT-6 Cyber model "Critical" for cyber risk and limits it to vetted security teams

OpenAI released GPT-6 Cyber on November 5. The company describes it as a model for finding exploitable vulnerabilities and writing fixes, trained to stay inside the scope an operator authorizes. A Russian-language AI channel that tracks lab releases summarized it more directly: the model searches for unknown vulnerabilities, analyzes code, and develops exploits on its own.

The headline number comes from OpenAI itself. GPT-6 Cyber scores 48.5% on ExploitGym, a test of whether a model can exploit a known flaw on a remote target. GPT-5.6 Cyber, released in August, scored 32.1%. OpenAI also says the model beats its general-purpose flagship, GPT-6 Astra, on most cyber tasks. Coverage disagrees on the Astra baseline. Some outlets cite a figure that appears to come from a separate web penetration-testing benchmark, so the Astra gap is not settled.

The claims from field testing go further. According to Fortune, researchers used the model to find 81 high-severity Firefox flaws and to build working exploits for 948 Linux kernel vulnerabilities, 588 of them previously unknown. Reports differ on whether the 588 are a subset of the 948. Neither Mozilla's advisories nor the kernel maintainers' patch logs, as cited in this coverage, yet show the full count.

OpenAI moved the model's cybersecurity rating from "High" to "Critical" under its Preparedness Framework. Access goes first to a small group of approved teams in the Daybreak Red program. OpenAI says it trained the model to refuse less often than GPT-6 Astra and to resist reward hacking, meaning the model should not report success on a task it did not actually complete.

The release rests on two claims that together raise the commercial value of access: that the model is dangerous enough to require OpenAI's highest risk rating, and that it is safe enough to give to selected customers with fewer refusals. The confirmed facts so far are the release itself, the rating, and the restricted access. The benchmark results and the exploit counts remain unverified vendor assertions.