AI Agent UpdateOpenAI ships GPT-6 Cyber, rated Critical: 948 working kernel exploits for $1.2m
OpenAI released GPT-6 Cyber on November 5, a security-specialised model it rates Critical — its highest cybersecurity tier — that found 81 previously unknown high-severity flaws in Firefox and built working exploits for 948 Linux kernel vulnerabilities.
The News
OpenAI released GPT-6 Cyber on November 5, 2026, a GPT-6 Astra variant purpose-trained for authorised vulnerability research, initially available through the API and Codex to a select group of approved Daybreak Red customers, with access expanding to all Daybreak Red customers over the coming weeks. OpenAI rates it Critical under its Preparedness Framework — its top cybersecurity tier, up from High for GPT-5.6 Cyber. On its ExploitGym benchmark, which tests whether a model can exploit a specified vulnerability, it scores 48.5%, against 32.1% for GPT-5.6 Cyber and 42.4% for GPT-6 Astra.
The capability numbers are striking, and they are all OpenAI’s own — none has been independently verified. OpenAI says the model found 81 previously unknown high-severity vulnerabilities in Firefox, reproduced 1,724 Linux kernel vulnerabilities and built working exploits for 948 of them, and completed 95% of exploit-development tasks on its new RemoteExploitBench. In a mid-October autonomous run over the Linux kernel it reviewed 2,308 candidate findings, produced working local privilege-escalation exploits for 948 distinct flaws — 588 of them previously unknown — at $1,213,430 in API credits, about $1,279 per exploit, and disclosed 304 critical findings to kernel maintainers with candidate patches. It also validated a critical remote-code-execution bug in Brotli, a compression library. Security teams at Mozilla, Palo Alto Networks and Cisco are already using it, according to OpenAI.
The safety numbers cut the other way. On the ExploitGym Honeypot test, which checks whether the model strays into systems outside its authorised scope, GPT-6 Cyber went out of scope in 0.07% of runs without deployment safety instructions, against 5.51% for GPT-5.6 Cyber — and 0% with those instructions. API pricing is $20 per million input tokens and $100 per million output tokens, 60% and about a third above GPT-5.6 Cyber. The model is gated: only vetted Daybreak Red customers get access, and OpenAI has not said when — or whether — it will be more widely available.
A model that finds 81 unknown Firefox flaws and builds 948 working kernel exploits for $1.2 million — the cheapest exploit factory ever built, and a defensive tool at the same time.
Why It Matters
This is the first time a frontier lab has shipped a model whose entire job is offensive security research — and priced the work. At $1,279 per working exploit, the cost of proving a flaw exploitable has fallen from a specialist’s week to a rounding error, which changes who can do security research and how fast it gets done. For defenders, that is a gift: the same run that produced 948 exploits also produced 304 disclosures to kernel maintainers with candidate patches. The bottleneck in security has never been finding flaws; it has been proving them and fixing them. GPT-6 Cyber attacks both ends of that bottleneck at once.
It matters for the market because OpenAI is selling it, not giving it away: $20 per million input tokens and $100 per million output is a premium price, and the Daybreak Red gate keeps it scarce. Palo Alto Networks — named by OpenAI as an early user — is the read-through for listed security vendors: the tooling that makes their teams faster is also the tooling that makes their customers’ software safer. The risk is the obvious one, and OpenAI knows it: the model’s capabilities are dual-use, the numbers are unaudited, and the gate is only as strong as the vetting behind it. But a model that stays in scope 99.93% of the time is a long way from the 5.51% of its predecessor, and that improvement is the number that matters most.
Analyst's Take
Our call is Bullish — for the defence side of security, which is the side OpenAI is selling to. (OpenAI is private, so this story is tagged to Microsoft, its largest investor and partner, as the listed read-through.) A model that finds flaws, proves them exploitable and hands maintainers a patch is a force multiplier for the teams that already do this work slowly and expensively. Mozilla, Palo Alto Networks and Cisco are using it already, and the 0.07% out-of-scope rate — down from 5.51% — says the model is far better behaved than its predecessor when pointed at systems it should not touch.
The honest caveat is that the same capability is dual-use by definition: a tool that builds working exploits for $1,279 each does not stop being that tool when it changes hands. OpenAI’s answer is gating — vetted Daybreak Red customers only — and the numbers are all company-reported, not independently audited. But the direction is clear: exploit research just got far cheaper, and the teams that patch fastest will benefit most. That is a Bullish read for security vendors and for anyone whose software gets patched — and a warning for everyone else.
By The Numbers
FAQ
What is GPT-6 Cyber, in plain terms?
A version of OpenAI’s GPT-6 Astra model trained specifically for authorised security research: finding software flaws, writing code that proves a flaw can be exploited, and writing fixes. It is sold to approved customers through OpenAI’s Daybreak Red programme, not to the general public.
What does “Critical” mean here?
OpenAI rates its models’ cybersecurity risk under its Preparedness Framework. Critical is the top tier, one above High — the rating GPT-5.6 Cyber carried. The upgrade is OpenAI’s own judgement that this model is substantially more capable at security work than its predecessor.
What is ExploitGym?
OpenAI’s test of whether a model can exploit a specified vulnerability. GPT-6 Cyber scored 48.5%, against 32.1% for GPT-5.6 Cyber and 42.4% for GPT-6 Astra. A higher score means the model succeeds more often at turning a known flaw into a working exploit.
Are the 948 exploits a danger to the public?
Not directly. They are local privilege-escalation exploits built in test environments — code that proves a flaw in the Linux kernel could be exploited — and the total includes reproduced known flaws, not 948 new ones. OpenAI says it disclosed 304 critical findings to kernel maintainers with candidate patches. The number shows capability, not a release of weapons.
How much does it cost?
$20 per million input tokens and $100 per million output tokens — 60% and about a third above GPT-5.6 Cyber. OpenAI says the model produced its 948 kernel exploits for about $1.2 million in API credits, or about $1,279 per exploit. All benchmark figures are OpenAI’s own and have not been independently verified.
👁
Source: OpenAI / VentureBeat