OpenAI unveils GPT-6 Cyber, a security-focused model, with limited access for select Daybreak Red customers

OpenAI released GPT-6 Cyber, a model trained to find software vulnerabilities, build working exploits and suggest patches. Access is via API and Codex, but only for a select group of Daybreak Red customers, with gradual expansion promised and no dates given. GPT-5.6 Cyber is now open to all Daybreak Red users, Daybreak Blue alpha access for GPT-6 Astra is widened, and a "Daybreak Red for Critical Infrastructure" subgroup has been created. OpenAI's own figures: 48.5% on ExploitGym (32.1% for GPT-5.6 Cyber), 81 previously unknown severe Firefox flaws (Mozilla patched them), and 948 working exploits from 1,724 reproduced Linux kernel vulnerabilities, at roughly $1.21M of compute. OpenAI rates the model "Critical" for cybersecurity under its Preparedness Framework.

If the numbers hold, automated exploit development is now cheap: about $1,279 per exploit against the $20k-70k OpenAI cites for typical bounties. That changes the economics for both defenders and attackers, and it puts pressure on patch cycles at software maintainers. Most organisations cannot use the model yet, so the near-term effect is limited to a small gated group and to the policy debate that a "Critical" rating invites. The Mozilla patches are the strongest outside confirmation, since real fixes shipped, but they cover one finding set, not the whole claim.

Every performance figure is OpenAI's own and nobody has tested the model independently, so the benchmark gains and the "novel techniques" claim are unverified. The $1,279 versus $20k-70k comparison is also loose: it sets a bulk compute average against bounty prices that cover different work, and the $1.21M total is left out of the framing. The "limited window for defenders" line is also a convenient reason for gated, paid access.

1. 01Independent evaluations of GPT-6 Cyber (for example from Epoch AI, academic groups or government bodies) that reproduce the ExploitGym and web-app results.
2. 02Confirmation from Mozilla and Linux kernel maintainers on how many of the reported flaws were real, severe and new, plus any CVEs credited to the model.
3. 03Changes to Daybreak Red access: dates and criteria for wider rollout, how customers are vetted, and any reported misuse or leaks of the model's exploit-building ability.