OpenAI's GPT-6 Cyber: a hacking-capable model for vetted defenders only

OpenAI released GPT-6 Cyber on 5 November 2026, a version of its GPT-6 Astra model trained specifically for security work. According to its system card, it is built for authorised vulnerability discovery, exploit development and web penetration testing, and only vetted defenders can use it.

What it is

GPT-6 Cyber is GPT-6 Astra with extra training to make it better at security tasks and less likely to refuse legitimate security requests, while staying within what the user is authorised to test. OpenAI rates it “Critical” for cybersecurity under its Preparedness Framework, its internal scale for how much harm a model could enable. That is the top level, which is why access is restricted.

On OpenAI's evaluations it scores higher than Astra on most security tests. For example, it passed 87% of tasks on SEC-Bench Pro (Astra: 85%) and solved all 11 challenges at least once on one external test set, against 8 for Astra. On another external test set, its successful attacks included zero-days (previously unknown flaws) affecting browsers, phones and cloud databases, but it did not break into any fully hardened target.

Who can use it

Access runs through Daybreak Red, OpenAI's trusted-access programme for its most capable security models. The system card lists the requirements:

• Individuals need an invitation, identity and liveness checks, a legal attestation, and a physical security key to sign in.
• Organisations must use single sign-on, multi-factor authentication, managed devices and least-privilege access, rotate credentials and report suspected misuse.
• API access requires IP allowlisting by default. The model is also available in Codex, where OpenAI recommends its sandboxing and auto-review features.

Who should care

• Security teams and penetration testers at larger organisations, who may qualify and could test far more of their own systems with the same staff.
• Every business with software online. Tools like this mean flaws in your systems are likely to be found faster, by defenders and eventually by attackers.

Limits and caveats

• Not generally available. No public pricing or self-serve sign-up; it's invitation and approval only.
• Benchmarks have caveats. OpenAI notes that one exploit test may be inflated because the model may have seen historical vulnerabilities in training, and that some scores aren't directly comparable with earlier system cards.
• It doesn't always stop when it should. The card reports it pauses for warnings slightly less often than Astra (73% vs 78%) and is weaker at reporting blockers in its final answers.
• Extra safeguards apply. OpenAI added checks that block high-risk help involving industrial control systems, essential services and election systems, plus monitoring for activity outside the user's authorised scope.

What to do this week

1. If you run a security team, ask your OpenAI contact about Daybreak Red eligibility, and check the account security requirements before applying.
2. If you don't, assume AI-assisted bug finding is speeding up: shorten your patch cycle for internet-facing systems.
3. Get permission paperwork in order. Any AI-assisted testing, internal or by a supplier, should have a written scope of what may be tested.
4. Ask your security suppliers whether they use models like this, and how they log and review the AI's actions.

Sources

• OpenAI Deployment Safety Hub: GPT-6 Cyber System Card