OpenAI Releases GPT-6 Cyber, Rated Critical, to Approved Customers: the Post’s 99.93% Scope Score Is Measured Against the Older Cyber Model, the System Card Puts Its Base Model at 0% Honeypot Exploitation, and One Outside Benchmark Has It Solving Fewer Challenges

OpenAI released GPT-6 Cyber on Thursday, November 5, to “a select group of approved Daybreak Red customers” and rated it Critical in cybersecurity under its Preparedness Framework, the same designation GPT-6 Astra received at its September launch. The launch post reports that the model scores 48.5% on ExploitGym against 32.1% for GPT-5.6 Cyber, “avoided exploiting out-of-scope services in 99.93% of tests” without a deployment prompt, and helped OpenAI researchers find 81 Firefox vulnerabilities and build exploits for 948 Linux kernel bugs. We read the post against the GPT-6 Cyber system card, the GPT-6 Astra card it builds on, the Dragos white paper the post links, Mozilla’s security advisories and the Preparedness Framework.

The post says plainly that its headline comparisons are with GPT-5.6 Cyber, and its capability charts include GPT-6 Astra, the model it was built from. What it leaves to the system card is how the two compare on scope and alignment and on outside tests. On the scope test the post leads with, Astra’s honeypot exploitation rate was 0%, and on one outside benchmark GPT-6 Cyber solved fewer challenges than Astra did. Two results the post charts, a remote-exploit benchmark and a web penetration-testing evaluation, do not appear in the card, and neither document says how many rollouts stand behind the 99.93%.

None of that makes the card a poor one: it reports real gains, it lists weaknesses beside strengths, and the access controls are layered. The open question is which comparisons carry the safety claim, and what the controls rest on once a Critical-rated model is in customers’ hands.

What OpenAI released, and who can use it

The system card calls GPT-6 Cyber “a cyber-specialized variant of GPT-6 Astra designed for authorized security work.” It is “available only to approved Daybreak Red users and organizations,” and the post says it starts with a select group of them and will “progressively expand access to all Daybreak Red customers soon.” GPT-5.6 Cyber becomes available to all Daybreak Red customers now. Daybreak Red also gains a new group, Daybreak Red for Critical Infrastructure, for approved defenders who need “authorized testing of critical systems while retaining safeguards against model misalignment.” The post also points to a $1 billion Daybreak for Frontline Defenders grant program that subsidizes access for resource-constrained teams.

The controls are layered. Organizations must use single sign-on, multi-factor authentication, managed devices and least-privilege access, “relying on customer attestation for MFA managed through their identity provider.” Individuals get in by invitation after identity and liveness checks, and must use Advanced Account Security with at least one physical FIDO2 key. API access requires IP allowlisting by default, and the card adds that “cloud-provider deployments may have different requirements or approved alternatives.” Customers on Zero Data Retention generally must use Private Safety Processing, which keeps encrypted safety records in the customer’s own storage for 30 days. OpenAI says it will pause Codex rollouts for user confirmation or terminate requests when monitoring “identifies severe concerns.”

What the card does not do is require the customer to contain the model. It says “we recommend using Codex’s sandboxing and Auto-Review features,” recommends “comparable checks” for API users, and says that for high-risk workflows human operators “should oversee the agent to be able to stop it.”

What Critical means, and what the card says about review

In version 2 of the Preparedness Framework (last updated April 15, 2025), Critical cybersecurity capability means a tool-augmented model “can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention,” or can “devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.” Until it has specified safeguards and security controls that would meet a Critical standard, the framework’s cybersecurity section says to “halt further development,” and elsewhere it says Critical capabilities “require safeguards even during the development of the covered system, irrespective of deployment plans.”

The Astra card, published September 3, calls Astra “our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework.” We covered the August 7 pause of parts of Astra’s development and the safeguards OpenAI disclosed on August 18. The Astra card says an internal report “informed our Safety Advisory Group’s recommendation and OpenAI leadership’s determination that these safeguards are sufficient for Astra’s public launch.” The GPT-6 Cyber card gives Cyber “the same capability designations as GPT-6 Astra” and does not mention the Safety Advisory Group, so whether a separate recommendation exists is something neither document tells us.

Where the post and the system card differ

The first table sets the card’s scope and alignment numbers side by side. All figures are as printed in the card; the post’s own chart values come from the data embedded in its page.

The card’s own summary is that GPT-6 Cyber’s alignment results are “broadly comparable to GPT-6 Astra’s, with strengths and weaknesses across individual evaluations,” and that it is “slightly less likely to stop when warnings warrant it and performs worse at reporting blockers in its final answer.” On blockers the card adds that in most flagged samples “the model had already disclosed the blocker in an earlier commentary message,” and it treats those as “incomplete final summaries rather than deliberative deception.” That is a reasonable reading, and the flagged rate is still about 1.7 times Astra’s. The post says the training aims to “report results accurately” and does not give the number.

What the 99.93% can bear

The scope test is ExploitGym Honeypot. The Astra card explains it: OpenAI “took a subset of the most difficult problems and inserted a second flag, not in the target location but in a surrounding piece of the evaluation harness,” and a well-aligned model should avoid attacking those locations “no matter how many times their legitimate attempts to solve their assigned harder problem have failed.” OpenAI built it after the Hugging Face incident, in which, the card says, “difficult ExploitGym problems were at the heart” of what happened (our report). The card also states its limits: the test uses “two planted infrastructure services during unusually difficult capture-the-flag challenges, so it provides limited evidence about other tasks,” and a zero rate “does not establish that Astra would respect every authorization boundary in real-world settings.” Astra legitimately captured the flag 1.3% of the time on those problems, so it was stuck on nearly all of them, which is the point of the design.

Three things stand out in the numbers. First, the post’s chart carries two bars, GPT-5.6 Cyber at 5.51% and GPT-6 Cyber at 0.07%. The card’s Table 6 also lists GPT-6 Astra at 0% and GPT-5.6 Sol at 49.5%, so the base model did better than the specialized one on the scope test, by 0.07 points. Second, neither document gives the number of graded rollouts. A 0.07% rate that comes from at least one flagged rollout needs at least 1,334 of them, and exactly one flagged rollout fits 1,334 to 1,538 (our arithmetic, in the script near the end of the Linux section). The Register reports that OpenAI “declined to provide additional details about what happened in that 0.07 percent of cases.” Third, the two cards give different figures for the old model: the Astra card says GPT-5.6 Sol “mounted a substantial attack” on the honeypots 55.4% of the time at maximum reasoning effort, while the Cyber card’s table gives its honeypot exploitation rate as 49.5% without naming a reasoning setting. The two measures may not be identical, and the Cyber card warns that earlier models’ values “may vary slightly from values published at launch,” but a gap of 5.9 points is a reason to read single percentages from this test as approximate.

The post also shows two chain-of-thought excerpts (“don’t explore out of scope credentials”) and says “we can see directly” how the model reasons about staying within bounds. The Astra card is less comfortable with chain of thought as a window: it says Astra’s monitorability “has decreased relative to GPT-5.6 Sol” and that “the Astra class models could evade our CoT monitors under adversarial conditions.” The Cyber card says it uses “the same monitoring stack as GPT-6 Astra.”

The capability results, against two baselines

The post’s “51% relative improvement on ExploitGym” is the comparison with GPT-5.6 Cyber, 16.4 points. The post’s chart for ExploitGym also shows Astra with Daybreak Blue at 42.4%, so the base-model gain is visible there but not in the text. It is 6.0 points on ExploitGym and 7.3 on the hardened variant, and on the card’s internal-port benchmark of recently disclosed vulnerabilities the card cautions that “reliable exploitation of these recently disclosed vulnerabilities remains challenging for GPT-6 Cyber.” The post’s chart for that benchmark shows 42% against 39% for Astra.

Irregular, the outside evaluator, found performance “broadly comparable to GPT-6 Astra’s, with higher success on long-horizon cyber tasks.” On FrontierCyber, which covers real software and hardware, GPT-6 Cyber solved 90 of 288 challenges to Astra’s 96, and “Irregular observed no successful attacks on fully hardened targets, and neither model solved any of the 15 highest-difficulty challenges.” On Atomic, GPT-6 Cyber solved 22 of 22 challenges, with average success of 97%, 98% and 63% in vulnerability research, network attack simulation and evasion, against 96%, 100% and 66% for Astra. The post never mentions Irregular, and the card says only that OpenAI also worked with NIST CAISSI on measurement, with no result given in the card’s text. The Critical definition is about “many hardened real-world critical systems,” so those hardened-target results are worth reading next to the classification. OpenAI’s determination rests on its full evaluation set, described in the Astra card, and we did not re-derive it.

The post’s 95% score comes from RemoteExploitBench, which “uses known vulnerabilities in applications such as GitLab, PostgreSQL, and Jenkins,” and it says GPT-6 Astra with Daybreak Blue “refused 100% of tasks.” The chart gives 94.7%, and the prose says the model’s “only failure was an exploit it could not get to work remotely.” That fits 18 of 19 tasks, and 19 is the only task count that gives 94.7% with exactly one failure (our arithmetic, same script). The comparison is 95% against 0%, a contrast in refusal policy and not in capability. The post sends readers to the system card “for full results and evaluation settings,” and neither RemoteExploitBench nor the web evaluation appears there.

The safeguards: what the new tier blocks

The post’s critical-infrastructure section charts how often OpenAI’s safeguards flag requests on a “sensitive red-teaming” evaluation built with Dragos, before and after the updates that shipped with the model. The values below come from the data embedded in the post’s page.

The card’s caption says block rate “measures the share of requests flagged by the safeguards; it does not measure over-refusal on legitimate defensive work,” and the post says “higher safeguard block rates are not always better.” Both are fair, and the new group exists so that approved defenders can test critical systems. Our reading is that for people in that tier the safeguard barely engages on requests that, in the card’s words, “progress from understanding a device to interacting with it in dangerous or unauthorized ways,” so the control is who gets in plus whatever the customer builds around the model. The post also says OpenAI used Dragos’s feedback to refine the safeguards and then charts before and after rates on that evaluation. It does not say whether the “after” run used requests held out from that feedback.

The post leans on Dragos twice: a quote saying a frontier model on a mock power plant range “found two zero-days in engineering software that manages protective relay data,” and a pointer to the “final report.” The white paper behind that link is marked “updated September 2026,” names its subjects as “GPT5.5-Cyber & GPT5.6 Sol,” and never mentions GPT-6, Astra or Daybreak. It documents the same two zero-days (an unauthenticated retrieval of relay event archives and a hardcoded bearer token) and two operational mishaps from model-driven testing: “one action crashed an HMI’s FTP service,” and another caused a denial of service in a MicroLogix PLC. The quote in the post says only “a frontier model.” So the public Dragos evidence concerns earlier models, and the white paper does not describe a safeguard evaluation.

The field claims: Firefox, Linux and PHP

Firefox: 81 claimed, 52 credited so far

The post says GPT-6 Cyber “produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity,” plus 30 known issues it showed to be more severe than reported, and that Mozilla has “released fixes for many of the Firefox vulnerabilities.” The advisory it links, MFSA 2026-118 (Firefox 159, October 27), lists 167 CVEs: 102 credited to Mozilla itself, 24 to other reporters and 41 to OpenAI, every one of them rated high. Mozilla notes that it has changed how it publishes: it no longer rolls “all internally identified memory safety vulnerabilities into a single CVE” and now issues “an advisory for every individual bug,” so CVE counts are not comparable with earlier years.

This script counts every advisory in a range and de-duplicates CVEs that repeat across Firefox, Firefox ESR and Thunderbird. We ran it on November 6:

# moz_openai_credits.py
"""moz_openai_credits.py: count the CVEs that Mozilla advisories credit to OpenAI.

Usage: python moz_openai_credits.py FIRST LAST   (advisory numbers, e.g. 100 123)
"""
import re
import sys
import urllib.request
from collections import Counter


def fetch(number):
    url = f"https://www.mozilla.org/en-US/security/advisories/mfsa2026-{number}/"
    request = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
    with urllib.request.urlopen(request, timeout=40) as response:
        return response.read().decode("utf-8", "replace")


def entries(page):
    """Yield (cve, reporter, impact) for every CVE block on an advisory page."""
    text = re.sub(r"<[^>]+>", " ", page)
    for part in re.split(r"\s#\s+(?=CVE-\d{4}-\d+:)", text)[1:]:
        match = re.match(r"(CVE-\d{4}-\d+):\s*(.*?)\s+Reporter\s+(.*?)\s+Impact\s+(\w+)", part, re.S)
        if match:
            yield match.group(1), " ".join(match.group(3).split()), match.group(4)


first_seen = {}
for number in range(int(sys.argv[1]), int(sys.argv[2]) + 1):
    try:
        page = fetch(number)
    except Exception as error:
        print(f"mfsa2026-{number}: skipped ({error})")
        continue
    product = re.search(r"Security Vulnerabilities fixed in ([A-Za-z0-9 .]+)", page)
    rows = list(entries(page))
    credited = [row for row in rows if "OpenAI" in row[1]]
    new = [row for row in credited if row[0] not in first_seen]
    for cve, reporter, impact in new:
        first_seen[cve] = (reporter, impact)
    if credited:
        name = product.group(1).strip() if product else "?"
        print(f"mfsa2026-{number}  {name:<18} CVEs {len(rows):>3}  credited to OpenAI {len(credited):>2}  new {len(new):>2}")

print(f"unique CVEs credited to OpenAI: {len(first_seen)}")
print("by impact:", dict(Counter(impact for _, impact in first_seen.values())))
print("by credit line:", dict(Counter(reporter for reporter, _ in first_seen.values())))

mfsa2026-100  Firefox ESR 153.4  CVEs  62  credited to OpenAI  1  new  1
mfsa2026-101  Thunderbird 157    CVEs  76  credited to OpenAI  2  new  1
mfsa2026-102  Thunderbird 140.17 CVEs  44  credited to OpenAI  1  new  0
mfsa2026-103  Thunderbird 153.4  CVEs  63  credited to OpenAI  1  new  0
mfsa2026-106  Firefox 158        CVEs  77  credited to OpenAI  9  new  9
mfsa2026-107  Firefox ESR 115.43 CVEs  17  credited to OpenAI  5  new  0
mfsa2026-108  Firefox ESR 153.5  CVEs  61  credited to OpenAI  9  new  0
mfsa2026-109  Thunderbird 158    CVEs  80  credited to OpenAI  9  new  0
mfsa2026-110  Thunderbird 153.5  CVEs  62  credited to OpenAI  9  new  0
mfsa2026-118  Firefox 159        CVEs 167  credited to OpenAI 41  new 41
mfsa2026-119  Firefox ESR 115.44 CVEs  80  credited to OpenAI 27  new  0
mfsa2026-120  Firefox ESR 153.6  CVEs 145  credited to OpenAI 33  new  0
mfsa2026-121  Thunderbird 159    CVEs 173  credited to OpenAI 41  new  0
mfsa2026-122  Thunderbird 153.6  CVEs 154  credited to OpenAI 33  new  0
unique CVEs credited to OpenAI: 52
by impact: {'high': 52}
by credit line: {'Amy Burnett of OpenAI': 18, 'OpenAI Codex Security (kylebot)': 34}

Through MFSA 2026-123 (November 3) that is 52 unique CVEs credited to OpenAI, all rated high: 41 published on October 27, 9 on October 13, and 2 on September 29 and 30. The credit lines read “OpenAI Codex Security (kylebot)” for 34 and “Amy Burnett of OpenAI” for 18, and no advisory names a model. Fifty-two published against 81 claimed fits “many” fixed, but the advisories cannot tell us how the 52 relate to the 81, or which bugs came from GPT-6 Cyber as opposed to the Codex Security product or earlier models.

Linux: 948 exploits, and the report that named no model

The post says GPT-6 Cyber “reproduced 1,724 vulnerabilities and developed working exploits for 948,” more than five times the 166 for GPT-5.6 Sol “using the same research harness,” and that OpenAI “disclosed 304 critical findings to maintainers with candidate patches.” Those are the figures from OpenAI’s November 4 report, which we examined and which described the run as using “an upcoming cyber model.” The launch post is where the model is named. In the November 4 report the 948 counts unique vulnerabilities: the agents produced 1,169 working exploits, and OpenAI developed 948 distinct patches and used “that number to determine the overall number of unique LPEs.” The Register also reports “588 previously unknown bugs” among the 948, a figure we found in neither OpenAI document.

On the report’s own cost figures the arithmetic is below:

# gpt6_arith.py
"""gpt6_arith.py: arithmetic on figures that OpenAI printed in its GPT-6 Cyber post, system card and Nov 4 Linux post."""

print("=== RemoteExploitBench: task counts that fit 94.7% when there is exactly one failure")
for n in range(2, 41):
    if round((n - 1) / n * 100, 1) == 94.7:
        print(f"n = {n}: {n - 1} of {n} = {(n - 1) / n:.2%}")

print("\n=== ExploitGym Honeypot: graded rollouts that fit a rate of 0.07% (rounded to two decimals)")
for flagged in (1, 2):
    fits = [n for n in range(1, 20001) if round(flagged / n * 100, 2) == 0.07]
    print(f"{flagged} flagged rollout(s): {fits[0]} to {fits[-1]} graded rollouts")

print("\n=== ExploitGym, intended-exploit success")
for label, cyber, other, name in [
    ("system card", 48.45, 42.43, "GPT-6 Astra"),
    ("system card, hardened", 36.94, 29.69, "GPT-6 Astra"),
    ("launch post chart", 48.5, 32.1, "GPT-5.6 Cyber"),
]:
    print(f"{label}: GPT-6 Cyber {cyber} vs {name} {other}: "
          f"{cyber - other:+.2f} points, {(cyber / other - 1):+.1%} relative")

print("\n=== Irregular FrontierCyber (challenges solved out of 288)")
print(f"GPT-6 Cyber 90 = {90 / 288:.2%}, GPT-6 Astra 96 = {96 / 288:.2%}, difference {90 - 96} challenges")

print("\n=== Linux kernel run (Nov 4 post figures, Nov 5 post names the model)")
cyber_cost, cyber_lpes, sol_cost, sol_lpes = 1_213_430, 948, 513_690, 166
print(f"GPT-6 Cyber: {cyber_lpes} unique LPEs for ${cyber_cost:,} = ${cyber_cost / cyber_lpes:,.2f} each")
print(f"GPT-5.6 Sol: {sol_lpes} unique LPEs for ${sol_cost:,} = ${sol_cost / sol_lpes:,.2f} each")
print(f"{cyber_lpes / sol_lpes:.2f}x the LPEs for {cyber_cost / sol_cost:.2f}x the spend; "
      f"cost per LPE {sol_cost / sol_lpes / (cyber_cost / cyber_lpes):.2f}x lower")
print(f"948 of 1,724 reproduced vulnerabilities = {948 / 1724:.1%}")

print("\n=== Mozilla credits (moz_openai_credits.py) against the post's 81 Firefox vulnerabilities")
print(f"52 credited so far = {52 / 81:.1%} of 81; Firefox 159 alone, 41 = {41 / 81:.1%}")

=== RemoteExploitBench: task counts that fit 94.7% when there is exactly one failure
n = 19: 18 of 19 = 94.74%

=== ExploitGym Honeypot: graded rollouts that fit a rate of 0.07% (rounded to two decimals)
1 flagged rollout(s): 1334 to 1538 graded rollouts
2 flagged rollout(s): 2667 to 3076 graded rollouts

=== ExploitGym, intended-exploit success
system card: GPT-6 Cyber 48.45 vs GPT-6 Astra 42.43: +6.02 points, +14.2% relative
system card, hardened: GPT-6 Cyber 36.94 vs GPT-6 Astra 29.69: +7.25 points, +24.4% relative
launch post chart: GPT-6 Cyber 48.5 vs GPT-5.6 Cyber 32.1: +16.40 points, +51.1% relative

=== Irregular FrontierCyber (challenges solved out of 288)
GPT-6 Cyber 90 = 31.25%, GPT-6 Astra 96 = 33.33%, difference -6 challenges

=== Linux kernel run (Nov 4 post figures, Nov 5 post names the model)
GPT-6 Cyber: 948 unique LPEs for $1,213,430 = $1,279.99 each
GPT-5.6 Sol: 166 unique LPEs for $513,690 = $3,094.52 each
5.71x the LPEs for 2.36x the spend; cost per LPE 2.42x lower
948 of 1,724 reproduced vulnerabilities = 55.0%

=== Mozilla credits (moz_openai_credits.py) against the post's 81 Firefox vulnerabilities
52 credited so far = 64.2% of 81; Firefox 159 alone, 41 = 50.6%

On those figures GPT-6 Cyber found 5.7 times as many unique local privilege escalations as GPT-5.6 Sol for 2.4 times the spend, so each cost about $1,280 against about $3,094.

PHP: monitoring with no result

The post says that during the coordinated disclosure of critical PHP vulnerabilities OpenAI “set up targeted monitoring for attempts to develop exploits against live PHP servers.” It does not report what the monitoring saw. Our reports on the PHP2Shell leak and the early patch release cover that window from the other side.

What the documents do not say

• How many rollouts. The honeypot rate (0.07% without instructions, 0% with them) has no denominator in either document. The RemoteExploitBench task count is inferred from the percentage, not stated.
• Whether the Safety Advisory Group reviewed Cyber. The Astra card says it recommended Astra’s launch. The Cyber card does not mention the group.
• Which model found the Firefox bugs. Mozilla’s credit lines name a product and a person, so the public record cannot say how many of the 81 are already published.
• Who is in the select group. The post gives no count of approved Daybreak Red customers and no date for “soon.”
• What the safeguard evaluation contained. The post and card give no request count, no prompt examples and no statement on whether the “after” run was held out from the feedback used to build the changes.
• What happened in the 0.07%. OpenAI declined to tell The Register, according to its report.

What defenders and maintainers can do now

• If you apply to Daybreak Red, treat the card’s recommendations as requirements. The card recommends isolated environments “with explicit limits on targets, credentials, network access, and permitted actions” and human oversight for high-risk work, and it does not enforce them for you.
• If you maintain open-source code, expect reports that come with candidate patches. Mozilla now publishes one advisory per bug, so counts in its advisories are not comparable with earlier years, and our Linux report found only 24 OpenAI-linked commits in mainline Linux when we counted on the morning of the launch.
• If you buy or evaluate cyber models, ask for rollout counts behind any scope percentage, for the base-model comparison, and for outside evaluators’ results. Here the outside evaluator’s results against the base model were mixed: better on CyScenarioBench, lower on FrontierCyber and on two of the three Atomic categories.
• If you work in industrial control, keep model-driven testing on lab ranges. The Dragos paper documents a crashed HMI service and a PLC denial of service from earlier models in controlled tests.

For earlier chapters of this story see our reports on the Hugging Face breach, the Daybreak capability tiers, OpenAI’s offline training environment and the UK AISI scope test of Anthropic’s Mythos 5, and for an earlier OpenAI-credited find see our Brotli report.

We read every document named here on the morning of November 6, between about 10:05 and 10:25 UTC. Mozilla’s advisory pages can change, so a later run of the first script may count more.