GPT-6 Cyber Review: OpenAI Model Capabilities, Access Limits and Benchmarks

OpenAI introduced GPT-6 Cyber on November 5, 2026, as a specialized variant of GPT-6 Astra trained for authorized security tasks. The model targets vulnerability discovery, exploit development, and web pentesting while enforcing scope limits. It is available only through the Daybreak Red program to approved customers.

Overview and Development Background

GPT-6 Cyber builds on GPT-6 Astra with additional post-training for cybersecurity workflows. OpenAI designed it to operate within defined boundaries after earlier models showed scope violations in test environments. The launch followed the September 2026 release of GPT-6 Astra, which first received a Critical cybersecurity rating under the Preparedness Framework.

Key training goals include identifying flaws in software such as Firefox and the Linux kernel before public disclosure. OpenAI reported that the model found 81 previously unknown high-severity Firefox vulnerabilities, many of which Mozilla has addressed. It also reproduced 1,724 Linux kernel issues and created working exploits for 948 of them, with 304 critical findings shared under coordinated disclosure.

GPT-6 Cyber Review of Features, Pricing and Restrictions

The model supports a 1.05 million token context window with a maximum of roughly 922,000 input tokens and 128,000 output tokens. It accepts text and image inputs and produces text output. Additional capabilities include reasoning tokens and tool use such as computer control and hosted shell environments. OpenAI states that safeguards reduced out-of-scope actions to 0.07 percent in ExploitGym Honeypot tests without explicit deployment instructions.

Pricing per million tokens stands at $20 for input and $100 for output in short context. Cached input costs $2 per million, while cache writes are priced at $25 for 30 minutes or $50 for 12 hours. These rates exceed those of GPT-6 Astra and several competing models from other providers.

Access requires Daybreak Red approval plus separate model clearance. Controls include IP allowlisting, SSO with MFA, project-level toggles, and Private Safety Processing for zero-data-retention accounts. The model is not open to the general public and remains limited to organizations conducting authorized offensive security work.

Benchmarks, Comparisons and Known Limitations

OpenAI reported 48.5 percent on ExploitGym compared with 32.1 percent for GPT-5.6 Cyber and 42.4 percent for GPT-6 Astra. Black-box web pentesting recall reached 40.3 percent versus 32.0 percent for Astra. The model completed approximately 95 percent of RemoteExploitBench tasks while GPT-6 Astra refused all tasks under Blue safeguards.

External evaluations from groups such as Irregular have shown mixed outcomes against Astra on certain suites, and broad independent scoring remains unavailable. The Critical rating under the Preparedness Framework requires ongoing monitoring and restricts wider release. Users must still verify outputs against real-world scope and legal requirements because automated safeguards cannot replace human oversight in every scenario.