OpenAI announced GPT-6 Cyber on November 5, a specialized version of GPT-6 Astra for authorized vulnerability discovery, exploit development and web security testing. The company is making it available initially to select approved customers through its restricted Daybreak Red program rather than releasing it as a general-access model. The launch pairs stronger security capabilities with training intended to keep an agent within the boundaries set by its operator.
In OpenAI's ExploitGym evaluation, the new model scored 48.5%, compared with 32.1% for GPT-5.6 Cyber. That is an improvement of 16.4 percentage points on the developer's test, not a measure of how often it can compromise arbitrary real systems. OpenAI also reports better scope adherence in a separate honeypot evaluation. These results are company-published measurements and should be read alongside their test conditions.
The system card classifies its cybersecurity capability as Critical under OpenAI's Preparedness Framework. Access controls vary by account type: individual and organizational users face different verification and security requirements, while organizational controls include single sign-on and multi-factor authentication. Daybreak Red API access uses IP allowlisting by default. Those controls and evaluations are separate claims: a benchmark gain does not itself establish that deployment is safe.
For security teams, the practical question is whether a more capable agent can help investigate and repair weaknesses while respecting an explicit authorization boundary. OpenAI's release addresses both sides of that problem, but restricted availability and developer-run tests limit what outside users can conclude today. Independent evaluation and evidence from actual authorized deployments remain necessary to judge reliability beyond the published demonstrations.