Jakarta, ThedailyID — OpenAI has introduced GPT-6 Cyber, a new artificial intelligence model designed to improve Daybreak, its automated cybersecurity research service. The model helps security professionals identify software vulnerabilities, validate potential exploits, and accelerate security patching.
GPT-6 Cyber represents a major upgrade over GPT-5.6 Cyber. OpenAI says the latest model can identify and validate vulnerabilities that attackers could exploit while delivering more reliable findings and accurate reports within researchers’ authorized limits.
“Daybreak Red is designed to support more advanced security workflows, including developing working exploits and using them against remote targets,” OpenAI said on its official website on Thursday, November 5.
Stronger Performance in Cybersecurity Tests
OpenAI evaluated GPT-6 Cyber through several assessments, including ExploitGym, RemoteExploitBench, ExploitGym Honeypot, ExploitBench, and SRE Bench. The company also conducted web penetration tests to assess the model’s ability to investigate applications without access to their source code.
In ExploitGym, which measures a model’s ability to exploit specific vulnerabilities, GPT-6 Cyber achieved a score of 48.5%. This marks an improvement from the 32.1% recorded by GPT-5.6 Cyber.
OpenAI also reported stronger results across other vulnerability discovery and remote exploitation assessments. Furthermore, GPT-6 Cyber outperformed GPT-6 Astra in most cybersecurity tasks.
The company also focused on ensuring the model follows researchers’ rules of engagement. This includes respecting authorized environments, staying within permitted boundaries, and accurately reporting its activities.
To evaluate these safeguards, OpenAI developed ExploitGym Honeypot, inspired by an incident involving Hugging Face. The test placed the model in an isolated environment with access to supporting services, such as package registries and object storage, that contained exploitable vulnerabilities.
Without deployment security instructions, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of cases, compared with 94.49% for GPT-5.6 Cyber. When researchers provided explicit warnings, the model stayed within authorized boundaries in 100% of sessions.
Findings Across Firefox and Linux
Beyond controlled testing, OpenAI has also used GPT-6 Cyber to identify vulnerabilities in open-source software on a larger scale.
The company said the model discovered 81 vulnerabilities in Firefox. OpenAI shared its findings and proposed patches with Mozilla, which began implementing fixes after receiving the reports.
GPT-6 Cyber also reproduced 1,724 vulnerabilities in the Linux kernel and generated 948 working exploits. In addition, the model demonstrated remote code execution (RCE), a type of attack that allows an attacker to run code on a target system remotely.
However, these capabilities also raise concerns about potential misuse by cybercriminals. OpenAI said it had strengthened safeguards across Daybreak Red and Blue to prevent assistance that could compromise industrial controls, safety-critical systems, equipment, or essential services.
Daybreak Access Remains Restricted
OpenAI first launched Daybreak on May 11, 2026, as a collaborative initiative involving cybersecurity partners. One of its notable efforts was the Patch the Planet program, which helped address the PHP2Shell vulnerability alongside the PHP Foundation.
During the coordinated disclosure of the critical PHP vulnerability, OpenAI monitored attempts to develop exploits against active PHP servers while supporting cybersecurity defenders as they patched affected systems.
GPT-6 Cyber is available through OpenAI’s API and Codex. However, access to the model through Daybreak Red remains restricted to trusted cybersecurity professionals.
Meanwhile, Daybreak Blue remains available to the wider public but operates under tighter limitations. OpenAI has withheld the latest model update from this service to reduce the risk of AI-assisted hacking and potential misuse.
