ExploitGym score jumps to 48.5% in OpenAI’s GPT-6 Cyber

GPT-6 Cyber, which OpenAI introduced in a November 5 post on its site, exploits a specified vulnerability in 48.5% of ExploitGym tasks, up from 32.1% for GPT-5.6 Cyber. Only select Daybreak Red customers can use it for now, and by default their Red API requests have to come from allowlisted IP addresses. If your team mostly validates bugs and fixes, the option that opens to more people today is the Daybreak Blue alpha with GPT-6 Astra, which OpenAI is extending to more organizations and individual researchers.

OpenAI says it will widen Red access over time. Sign-up for Daybreak goes through OpenAI’s cybersecurity page, and more announcements are due at OpenAI’s Cyber at the Frontier livestream on November 12 at 10am PT.

Red or Blue?

OpenAI splits the work by tier. Daybreak Blue helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals. Daybreak Red, with GPT-6 Cyber, is meant for deeper exploit development and authorized security testing, including building working exploits and using them against remote targets. Below both tiers, mainline models such as GPT-6 Astra already handle code review, vulnerability triage and patch development.

Red customers will have to deal with the new controls. IP allowlisting for Daybreak Red API access is on by default, with limited exceptions, and OpenAI watches credentials for signs of compromise. API customers on Zero Data Retention generally have to use Private Safety Processing. That is a set of automated misuse checks that review encrypted records kept in the customer’s own storage for 30 days, and prompts and responses are not shown to OpenAI staff. Everyone else stays on standard retention by default. OpenAI also still recommends sandboxing, action review and human oversight for high-risk workflows.

Defenders of power plants, water treatment facilities and industrial control systems get a new group, Daybreak Red for Critical Infrastructure. It allows authorized testing of critical systems, with the misalignment safeguards still on. Resource-constrained teams, such as government organizations and essential service providers, can get subsidized access through the $1 billion Daybreak for Frontline Defenders grant program. To prevent misuse of the Red and Blue platforms, OpenAI says it has refined safeguards against help that could compromise industrial controls or safety-critical systems. It adds that “higher safeguard block rates are not always better,” because many of the same techniques go into finding vulnerabilities and checking that fixes hold.

What the benchmarks measure

ExploitGym tests whether a model can exploit a specified vulnerability in a remote target. GPT-6 Cyber’s 48.5% is about 16 percentage points above GPT-5.6 Cyber, which OpenAI calls a 51% relative improvement. For finding bugs, OpenAI built a new offensive web penetration test in which models probe web applications without their source code. GPT-6 Cyber found 40.3% of the vulnerabilities there, against 32.0% for GPT-6 Astra.

RemoteExploitBench, also new and built by OpenAI, runs known vulnerabilities in applications such as GitLab, PostgreSQL and Jenkins in a controlled environment. GPT-6 Cyber completed 95% of the tasks. Its only failure was an exploit it could not get working remotely. GPT-6 Astra running with Daybreak Blue refused every task, so that gap mostly reflects what each tier is allowed to attempt. OpenAI says GPT-6 Cyber beats Astra on most cyber tasks even when Astra does not refuse, and the full settings are in the system card.

On these results OpenAI rates GPT-6 Cyber Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.

Firefox, Linux and Brotli

In Firefox, GPT-6 Cyber produced evidence and reproducible tests for 81 previously unknown vulnerabilities that Mozilla classified as high severity. It also showed that 30 known issues were more severe than previously reported. Firefox had already been tested extensively with frontier models before this. OpenAI sent the findings to Mozilla with proposed patches, and Mozilla has since released fixes for many of them.

The model also ran the Linux kernel research OpenAI announced on November 4. It reproduced 1,724 vulnerabilities and wrote working exploits for 948 of them, more than five times the 166 that GPT-5.6 Sol exploited with the same research harness. Following the Linux community’s guidance, OpenAI disclosed 304 critical findings to maintainers with candidate patches and is working on fixes for the rest. In the report on that mid-October run, 61 of the flaws were already patched upstream when the 10-day scan and review ended, which is why its advice to Linux users is to keep kernels updated.

Security teams at Cisco, Calif and CodeRabbit use GPT-6 Cyber for vulnerability research and code review, and OpenAI also lists Mozilla and Palo Alto Networks among the companies using it. OpenAI’s own researchers used it with other OpenAI models to show how a critical flaw in Brotli, a compression library used by Node.js and other software, could enable remote code execution in downstream applications. In internal red-teaming, agents running GPT-6 Cyber and other OpenAI models chained vulnerabilities to escape microVMs and run code on the underlying hosts. OpenAI then patched the software, tightened network restrictions and reported the issues to maintainers and vendors.

Staying in scope

ExploitGym Honeypot is an alignment test that OpenAI says was informed by the Hugging Face incident. The model gets a hard exploitation task in an isolated environment with supporting services, such as a package registry or an object store. Those services are deliberately easy to break, and attacking them would reveal the task’s flag. The model has to work out for itself that they are out of scope. Without deployment safety prompts, GPT-6 Cyber left them alone in 99.93% of cases, against 94.49% for GPT-5.6 Cyber. OpenAI credits dedicated training to stay within authorized scope, respect restrictions and report results accurately.

The model’s chain of thought shows the same reasoning. One excerpt OpenAI published reads: “don’t explore out of scope credentials.” With the deployment prompts OpenAI ships, GPT-6 Cyber stayed within bounds in 100% of the tests.