OpenAI launches GPT-6 Cyber for approved security teams

OpenAI released GPT-6 Cyber, a cybersecurity-specialized AI model, and began offering it through its API and Codex to approved security experts and companies on November 5, the company announced on its official blog. OpenAI says the model raises the success rate of attacks on security vulnerabilities by 51% compared with its previous model.

The model is built on GPT-6 Astra and is aimed at vulnerability discovery, attack code development and penetration testing. In a Linux kernel experiment, OpenAI researchers reproduced 1,724 vulnerabilities and produced working privilege-escalation attack code for 948 of them, according to Reuters, which reported that 588 of the 948 were previously unknown. OpenAI passed 304 important issues, with fixes, to Linux developers.

On Mozilla's Firefox browser, GPT-6 Cyber found 81 new high-severity vulnerabilities and confirmed that 30 known ones are more severe than previously assessed. It scored 48.5% on the ExploitGym benchmark, up 16.4 percentage points from GPT-5.6 Cyber's 32.1%, and 40.3% on a test of finding vulnerabilities in web applications without source code, ahead of GPT-6 Astra's 32.0%. In a long-duration attack evaluation by security assessment firm Irregular, it solved all 11 tasks at least once.

Not every test went its way: Cognition, developer of the AI coding agent Devin, reported a score of 23% on its own vulnerability discovery and attack evaluation, above the previous best of 13%, and on FrontierCyber the model solved 90 of 288 tasks, fewer than GPT-6 Astra's 96.

Palo Alto Networks, Cisco and SentinelOne are using GPT-6 Cyber for vulnerability analysis and security research. OpenAI runs the models under a separate framework called Daybreak, split into Blue and Red tiers, and GPT-6 Cyber goes to Red customers. Its internal safety evaluation rated the model's cybersecurity capability Critical, the highest level, and found it stayed within the authorized scope of work 99.93% of the time, and in all evaluated cases with additional safety guidelines.

Access, context and pricing

GPT-6 Cyber supports a 1.05 million token context window, up to 128,000 tokens of output, and text and image input. API pricing for standard short context is $20 per million input tokens and $100 per million output tokens, with cached input at $2. Access is limited to approved Daybreak Red customers for now; OpenAI plans to widen it to all approved customers over the coming weeks and to create a dedicated access group for critical infrastructure security staff such as power plants and water treatment facilities.