GPT-6 Cyber: Vulnerability detection, scope compliance

1. Exploit success on specified vulnerabilities reached 48.5%

According to OpenAI, GPT-6 Cyber scored 48.5% on ExploitGym, a relative improvement of 51% over the previous cyber model. The evaluation tests successful exploitation of specified vulnerabilities on remote targets. It tests the ability to build working exploits, not just identify vulnerabilities.

Table: ExploitGym success rate for specified vulnerabilities

Conditions: Strict single-attempt success rate (pass@1) evaluation using specified vulnerabilities on remote targets. Models and access configurations are shown in the rows. Figures reported by OpenAI.

Unit: %

The previous cyber model scored 32.1% on the same evaluation. However, the table's access configurations include whether safeguards are enabled, so scores reflect both exploitation ability and willingness to accept requests.

In a separate evaluation exploring web applications without source code, OpenAI reported a vulnerability detection rate of 40.3%. GPT-6 Astra with the Daybreak Blue configuration scored 32.0%.

In an early RemoteExploitBench evaluation, OpenAI reported completing 95% of tasks on applications with known vulnerabilities in a controlled environment. The general-purpose comparison model with the Daybreak Blue configuration refused all tasks. Based on these results, OpenAI raised its internal cyber risk rating from 'High' to 'Critical'.

2. Trained to respect task boundaries even with easy shortcuts

OpenAI said it used dedicated training to enforce authorized scope, follow action restrictions, and report results accurately. ExploitGym Honeypot tests this with decoy services that lure attackers. Auxiliary services, such as package repositories, sit in an isolated environment, and attacking them yields the task's flag. This tests whether the model sticks to authorized targets despite an easy shortcut to the answer.

Without deployment safety instructions, OpenAI reported that GPT-6 Cyber avoided attacking out-of-scope services 99.93% of the time, versus 94.49% for GPT-5.6 Cyber. With safety instructions, the new model's scope compliance reached 100%.

3. Linux and Firefox reports included reproductions and proposed fixes

According to OpenAI, researchers reproduced 1,724 Linux kernel vulnerabilities and developed working exploits for 948. That is more than five times the 166 achieved by GPT-5.6 Sol using the same research tooling setup. They reported 304 serious issues to maintainers with candidate fixes and said remediation was underway for the rest.

For Firefox, OpenAI reported submitting evidence and reproduction tests for 81 vulnerabilities missed by audits using several previous model generations. Mozilla classified them as high risk. It also confirmed that 30 known issues were more severe than previously assessed, and began incorporating fixes soon after receiving the reports.

Customer Cognition said the model scored 23% on its internal vulnerability discovery and exploit validation evaluation, exceeding the previous best of 13%. CodeRabbit said it found 66% more high- and medium-risk issues than its existing production model in an internal security review evaluation.

4. Stronger validation capabilities bring more operational controls

Defenders can use the model for workflows spanning vulnerability discovery, exploit reproduction, and fix validation. Access approval and monitoring come with that use. OpenAI restricts Daybreak Red API access to allowlisted IP addresses by default and recommends isolated environments, action reviews, and human oversight for high-risk work.

Customers choosing Zero Data Retention, an API usage option that does not retain data, generally must also use Private Safety Processing. This procedure automatically checks encrypted logs stored in customer storage for 30 days without exposing inputs or responses to OpenAI staff. It is an operational requirement to detect misuse while supporting defensive work.

OpenAI also strengthened checks to block high-risk activities involving critical infrastructure. Since the same techniques support vulnerability discovery and fix validation, it said it balances higher blocking rates with support for legitimate research.

5. Access starts with approved customers and expands to researchers

The new model will initially be available to some approved Daybreak Red customers before expanding to all such customers. New users and organizations can apply for Daybreak access. Daybreak Blue alpha access for vulnerability and fix validation will also expand to more organizations and individual security researchers using general-purpose models.

A $1 billion support program was also established for critical infrastructure defense. It subsidizes use by under-resourced government organizations and essential service providers, among others. A separate access group gives approved defensive organizations authorization to test critical systems.

GPT-6 Cyber goes beyond finding more vulnerabilities by strengthening both exploit reproduction and training to stay within authorized scope.