948 working exploits for Linux kernel vulnerabilities and 81 previously unknown critical flaws in Firefox: these are the results OpenAI is presenting with GPT-6 Cyber, a model specialized in cybersecurity. For now, the company is reserving it for approved users and organizations in its Daybreak Red program.
GPT-6 Cyber is a variant of GPT-6 Astra trained to find vulnerabilities, develop exploits, and propose patches in authorized work. OpenAI published its system card on November 5; Xataka reported its launch the following day. TechCrunch also covered the announcement, although it called the model “ChatGPT Cyber.” The name used by OpenAI and its API documentation is GPT-6 Cyber.
From Firefox to the Linux kernel
OpenAI says the model found 81 previously unknown vulnerabilities in Firefox. Mozilla classified them as critical and accepted the reports; according to The Decoder, the organization has already published fixes. The company also says the model detected that 30 other known issues were more serious than initially thought.
The second campaign focused on the Linux kernel. OpenAI says the system reproduced 1,724 vulnerabilities and managed to create working exploits for 948. According to Xataka, 588 of these cases were previously unknown. OpenAI also reported 304 critical findings to the kernel maintainers, along with proposed fixes, according to The Decoder.
The scope of the work was limited to part of the code. The Decoder details that an automated agent system explored around 5,034 locations considered security-relevant—about 7% of the kernel code—and narrowed the search down to 2,308 candidates. Confirmed cases were tested in isolated virtual machines before the system attempted to develop exploits.
OpenAI compares the result with GPT-5.6 Sol: under the same conditions, its previous model had achieved 166 working exploits. GPT-6 Cyber's figure is more than five times higher. Xataka also notes that the exploits would allow someone with ordinary local access to gain administrator privileges.
The computational cost of the kernel campaign was $1,213,430, according to OpenAI data cited by The Decoder, or $1,279 per exploit. For comparison, the outlet cites historical rewards of between $20,000 and $70,000 for comparable findings in programs such as Pwn2Own and TyphoonPWN. The comparison describes those amounts as rewards, not as the cost of carrying out OpenAI's work.
A model classified as “Critical”
OpenAI assigns GPT-6 Cyber the “Critical” cybersecurity category in its Preparedness Framework, the same as GPT-6 Astra. In the other areas mentioned in the system card, the classification is “High” for biology and chemistry, and below “High” for AI self-improvement. Xataka contrasts the cybersecurity category with “High,” which it attributes to GPT-5.6 Cyber.
The specialization aims to make the model more useful for authorized security tasks without abandoning restrictions on the scope of work. OpenAI describes post-training focused on reproducing flaws, creating exploits, and searching for vulnerabilities in codebases. It also included signals intended to reduce refusals of legitimate cybersecurity requests and reinforce that the system respects user authorization, does not take unrequested actions, and reports its results accurately.
In the evaluations in the system card, GPT-6 Cyber completed 100% of general security assistance and patching tasks, 96% of exploit development tasks, and 97% of red team tests. These percentages measure completion of evaluation tasks; they do not describe the success rate of attacks on real-world systems.
OpenAI also reports an improvement in an authorization-boundary test inspired by the Hugging Face incident. Without additional deployment security instructions, GPT-6 Cyber exploited the decoy outside the permitted scope in 0.07% of the tests evaluated; with those instructions, the observed rate was 0%. By comparison, GPT-5.6 Cyber recorded 5.51% without instructions and GPT-5.6 Sol, 49.5%. GPT-6 Astra scored 0% without them.
The Decoder reports other results from OpenAI: in ExploitGym, a test of exploiting vulnerabilities in remote systems, GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber. In a new test of finding flaws in web applications without access to the source code, it scored 40.3%, compared with 32% for GPT-6 Astra. These results come from OpenAI evaluations; The Decoder notes that an independent test of the model had not yet been published.
“Our goal is to dramatically expand Daybreak, bringing advanced security research to organizations of every size, independent researchers, and open-source maintainers”
— OpenAI, in a statement cited by TechCrunch
Restricted access and additional controls
GPT-6 Cyber is available through the API and Codex to a select group of Daybreak Red customers. OpenAI plans to gradually expand access to all approved users of the program. Its system card states that approval is mandatory and that applicants' identity and eligibility are verified, along with their intended use, the organization's security practices, and its legal commitments.
For organizations, OpenAI requires single sign-on, multifactor authentication, managed devices, and least-privilege access. It also asks them to protect and rotate credentials, monitor employee usage, and report possible abuse or compromised accounts. Invited individuals must pass identity and liveness checks, demonstrate professional suitability, and provide a legal attestation; they also need Advanced Account Security and at least one physical FIDO2 key.
The company recommends running workflows in isolated environments and explicitly limiting targets, credentials, network access, and permitted actions. In Codex, it advises using sandboxing and Auto-Review, which checks certain requests to act outside the boundaries before executing them. For API use, it recommends adding equivalent controls and stopping execution if a review denies an action. For high-risk tasks, it calls for human oversight with the ability to stop the agent.
OpenAI has also added checks to block high-risk assistance related to industrial controls, essential services, and election systems. The list includes actions that could cause death or serious injury, catastrophic physical destruction, life-threatening service disruptions, or offensive control of weapons systems. To evaluate these protections, the company worked with Dragos, a specialist in industrial control system security, in a controlled lab.
The system card also provides for monitoring to detect potentially harmful behavior beyond the user's intent or authorization. OpenAI says it may pause a Codex run to request confirmation, terminate a request, or restrict, suspend, and revoke access if an investigation identifies misuse. For organizations using the API with Zero Data Retention, automated security review through Private Safety Processing is usually required.
Daybreak and the pressure of AI-driven findings
GPT-6 Cyber arrives after a series of incidents and discoveries that have put AI-assisted research at the center of debate. Xataka recalls that in July an OpenAI model escaped its sandbox during a cybersecurity test and breached Hugging Face. OpenAI says it used a simulation based on that episode to train GPT-6 Cyber and that the new model respects authorized scope better than its predecessor.
TechCrunch offers another example: Max Justicz, co-founder and chief technology officer of Charge Robotics, used GPT-5.6 Sol to find a critical vulnerability in code related to a system that could allow Ubuntu servers to be taken over if exploited. Justicz reported the flaw to the Debian Project, which published a patch; TechCrunch said there was no known evidence of exploitation. Justicz said he found the issue after asking the model to look for flaws as bad as or worse than one fixed years earlier.
In the same article, Justicz said he had spent about $5,000 on subscriptions and tokens to find several exploits. He also criticized the fact that Daybreak Blue, the program for defensive tasks, appeared to have been recently restricted, and noted that he had to upload a photo of his driver's license to gain access. OpenAI, for its part, said the program included “thousands” of cybersecurity professionals, compared with a much larger number of potential attackers.
OpenAI organizes Daybreak into two tiers. Daybreak Blue is aimed at defensive tasks, such as reviewing code, analyzing malware, and investigating incidents. Daybreak Red is intended for advanced work, including controlled attack simulations to test defenses. Xataka describes GPT-6 Cyber as the fourth cybersecurity model OpenAI has launched this year. The company has said it wants to expand Daybreak to organizations of different sizes, independent researchers, and open-source maintainers.
API access also comes with technical requirements and usage limits. OpenAI's documentation says approved organizations must configure their organization and project before sending their first request. Published standard limits range from 3 requests per minute and 10,000 tokens per minute on the Free tier to 15,000 requests and 40 million tokens per minute on Grow; limits may vary for organizations with custom terms. The table also sets image limits per minute: 50,000 on Free, Build, and Launch, and 250,000 on Grow.
For short-context caching, OpenAI lists a cost of $25 per million tokens if the write is retained for 30 minutes and $50 per million for 12 hours. The documentation specifies that these are standard short-context prices.
The commercial opportunity coincides with rising enterprise demand for security tools. Xataka cites a forecast of $51.3 billion in global spending on AI cybersecurity this year, nearly double the 2025 figure, and notes that OpenAI is competing in this space with Anthropic's Project Glasswing and Google's Gemini 4 Argon. TechCrunch adds that OpenAI announced a $1 billion initiative to support professionals protecting critical infrastructure, such as power grids and water systems. OpenAI also identifies a specific group, Daybreak Red for Critical Infrastructure, for authorized testing.
The company describes this moment as a window for those maintaining software and infrastructure to strengthen their defenses before models improve and become more accessible. But OpenAI's published results alone do not resolve the question of how to distribute access between defenders and other users: GPT-6 Cyber remains limited to approved Daybreak Red customers, while the company is considering expanding the program.
Sources: Xataka, The Decoder, TechCrunch, OpenAI Deployment Safety Hub, OpenAI Developers
