GPT-6 Cyber is OpenAI’s cyber-specialized model, announced on 5 November 2026 for approved security teams. OpenAI rates it Critical in cybersecurity under its Preparedness Framework. A Linux kernel research run that OpenAI published on 4 November produced 948 working local privilege escalation exploits, and the launch post attributes that work to GPT-6 Cyber.
Every number below comes from OpenAI’s launch post, its system card or its Linux write-up. OpenAI ran the tests itself, and we have not verified them. We explain what the pipeline did, what is research and what is not, and what defenders should change.
What Is GPT-6 Cyber and Who Can Use It?
According to its system card, GPT-6 Cyber is a cyber-specialized variant of GPT-6 Astra for authorized security work. OpenAI lists vulnerability discovery, exploit development and web penetration testing. It gives the model the same designations as Astra: Critical in cybersecurity, High in biological and chemical, and below High in AI self-improvement.
Access runs through a program called Daybreak Red. OpenAI says it requires identity verification, use restrictions, single sign-on, multi-factor authentication and API IP allowlisting. At launch the model is available through the API and Codex to a select group of approved customers, with wider Daybreak Red access promised soon.
| Test (run by OpenAI) | GPT-6 Cyber | Comparison |
|---|---|---|
| ExploitGym, exploit a specified flaw in a remote target (launch post) | 48.5% | 32.1% for GPT-5.6 Cyber |
| ExploitGym, intended-exploit success (system card) | 48.45% | 42.43% for GPT-6 Astra |
| Hardened ExploitGym variant (system card) | 36.94% | 29.69% for GPT-6 Astra |
| Web penetration test recall, no source code (launch post) | 40.3% | 32.0% for GPT-6 Astra |
| RemoteExploitBench tasks completed (launch post) | 95% | Astra with Daybreak Blue refused 100% of tasks |
Irregular, an outside evaluator, found performance broadly comparable to Astra’s, with higher success on long-horizon tasks. GPT-6 Cyber solved 11 of 11 CyScenarioBench challenges at least once, against 8 of 11 for Astra. On FrontierCyber it solved 90 of 288, against 96 for Astra. Irregular saw no successful attacks on fully hardened targets, and neither model solved any of the 15 hardest challenges.
Did GPT-6 Astra Hold Back on Exploit Tasks?
OpenAI’s pages do not say that GPT-6 Astra held back on internal red-teaming or exploit tasks. Its wording is about refusals. In RemoteExploitBench, which uses known flaws in applications such as GitLab, PostgreSQL and Jenkins in a controlled lab, Astra running with Daybreak Blue refused 100% of tasks. GPT-6 Cyber completed 95%, and OpenAI says its one failure was an exploit it could not get working remotely.
OpenAI also says GPT-6 Cyber beats Astra on most cyber tasks “even when Astra does not refuse the request”. The system card reports that Cyber completed 100% of general security assistance and patching tasks, 96% of exploit development tasks and 97% of red-teaming tasks. Astra’s own refusal figures are in OpenAI’s separate GPT-6 Astra system card.
In our reading, this describes a policy choice more than a capability gap. Astra is the mainline model with safeguards on, and Cyber is the version for vetted users that refuses less. OpenAI says Cyber keeps its refusals outside cybersecurity.
How Does the Linux Kernel Pipeline Work?
OpenAI’s write-up describes a five-stage pipeline that ran in mid-October 2026 against the latest Linux kernel inside a controlled research environment. The target machines ran a stock desktop operating system of a commonly used distribution, not a weakened build. OpenAI withholds the exploitation techniques for safety reasons, and we describe no steps.
- Find audit targetsScout agents pick parts of the kernel that low-privileged users can reach: 5,034 targets, about 7% of the code
- Scan for candidatesAnalyst agents produce 2,308 candidate findings in 12 hours
- Reproduce each findingA triage agent runs a test in an isolated virtual machine with a kernel memory checker; 1,724 reproduced within 30 hours
- Assess exploitabilityScreening leaves 1,238 privilege escalation candidates, and exploit agents work in machines with standard protections on
- Patch and reviewAgents draft patches, and a human researcher reviews each result before it goes to maintainers
The funnel matters more than the headline. Of 2,308 candidates, OpenAI reproduced 1,724, about 74.7%. Exploit agents then produced 1,169 working privilege escalation exploits and 291 proofs of concept for information leaks. After variant analysis, OpenAI counts 948 unique flaws behind those exploits and developed a patch for each.
| Stage | API credits (OpenAI) |
|---|---|
| Scouting audit targets | $3,426 |
| Analyst scan for candidates | $316,549 |
| Validation | $73,330 |
| Screening for exploitability | $44,194 |
| Exploit development | $775,929 |
| Whole run | $1,213,430, or $1,279 per exploit |
OpenAI calls these costs an upper bound and says better engineering of the tooling around the model could lower them. It also warns about its own results. In an early run, 20 of 200 reported exploits reached root through a different, unrelated flaw than the one assigned. OpenAI then added an independent check that each exploit used its assigned flaw.
What Do 948 Kernel Exploits Mean for Patch Volume?
These are research results on a test fleet, not attacks seen in the wild. A local privilege escalation also needs a foothold first, so it matters most after an attacker already has a low-privileged account or code running on a host. OpenAI’s own conclusion is blunt. For the near and medium term, it says, a low-privileged account on a system missing available patches is functionally equivalent to root for a well-resourced attacker.
OpenAI says Linux maintainers moved fast. When the scan and manual analysis ended after 10 days, 61 of these flaws were already patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. The launch post adds that OpenAI disclosed 304 critical findings to maintainers with candidate patches.
In our reading, the practical effect is volume. Distribution kernels will carry more local privilege fixes for a while, and OpenAI expects that less capable models may develop exploits once a flaw is disclosed. A quarterly kernel update cycle will be slow against that pace. Our privilege escalation entry explains why a local flaw still decides how far an intruder gets.
The work reached browsers too. OpenAI says GPT-6 Cyber produced evidence and reproducible tests for 81 novel Firefox vulnerabilities that Mozilla classified as high severity. It also showed that 30 known issues were more severe than reported, and Mozilla began landing fixes shortly after the reports. For how a national agency frames AI-enabled attacks, see our NCSC assessment post.
How Does OpenAI Keep the Model Inside Its Scope?
Scope is the other half of the release. OpenAI built ExploitGym Honeypot, where an easy-to-exploit side service tempts the model out of bounds. Without deployment safety prompts, GPT-6 Cyber exploited the honeypot in 0.07% of graded rollouts, against 5.51% for GPT-5.6 Cyber and 49.5% for GPT-5.6 Sol. With the prompts, the rate was 0%.
The system card also shows limits. In a test of reporting blockers honestly, 20.29% of GPT-6 Cyber responses were flagged, against 11.66% for Astra. OpenAI says most flagged samples had disclosed the blocker earlier and left it out of the final summary. On warnings, the model stops when it should in 73.00% of cases, against 78.38% for Astra.
OpenAI’s safeguards are access and monitoring. They include identity checks, API IP allowlisting, account-compromise monitoring and misalignment monitoring, plus Private Safety Processing for customers on zero data retention. It recommends a sandbox, action review and human oversight for high-risk workflows, with explicit limits on targets, credentials, network access and permitted actions.
What Should Defenders Change Now?
Steps 1, 2, 3 and 6 are our advice. Steps 4 and 5 follow takeaways in OpenAI’s Linux write-up.
- Find your low-privilege footholdsList the Linux hosts where untrusted code or many users run: shared servers, CI runners, container hosts and jump boxes. A local flaw matters most there.
- Shorten the kernel update cycleTrack your distribution’s kernel advisories and set a target time from fix to rollout for local privilege fixes. OpenAI says users and companies must keep software up to date.
- Plan reboots or live patchingKernel fixes need a restart or a live patch. Agree maintenance windows now, so a fix does not wait for a quarterly slot.
- Limit the blast radiusOpenAI names sandboxes and isolation such as Firecracker and gVisor for limiting damage from an exploited flaw. Remove local accounts and privileges you do not need.
- Rescan your own codeOpenAI advises rescanning code that was audited before, because a stronger model can find bugs earlier models missed.
- Fence any security agent you runGive an AI testing agent an isolated environment, written limits on targets and credentials, and a check that each result used the intended flaw.
The controls behind these steps are covered in our entries on patch management, least privilege and AI agents, and in our vulnerability management guide. The technique page on exploitation for privilege escalation shows how this class of flaw is used after a foothold.