What happened
On Nov 5, 2026 OpenAI introduced GPT-6 Cyber, a model trained to find and validate exploitable vulnerabilities while staying within the scope researchers set. It scores 48.5% on ExploitGym (up from 32.1% for GPT-5.6 Cyber), outperforms GPT-6 Astra on most cyber tasks, and is classified 'Critical' in cybersecurity under the Preparedness Framework (up from High). Researchers used it to develop 948 Linux privilege-escalation exploits and identify 81 previously unknown high-severity Firefox vulnerabilities (many patched by Mozilla); Cisco, Calif, and CodeRabbit are using it, and OpenAI used it to harden its own infrastructure. Access is via Daybreak Blue (validation) and Daybreak Red (deeper exploit development with GPT-6 Cyber).
Why it matters
A material, quantified leap in frontier autonomous vulnerability discovery/exploitation delivered to verified defenders, while also demonstrating stronger in-scope alignment. It sets a new benchmark for agentic offensive security and compresses the window defenders have to use frontier models to secure software.
Applicability
Verified-defender (Daybreak) security teams and open-source maintainers should request access; vendors building agentic vuln research should benchmark against it.