GPT-6 Cyber: what it is, what it costs, who can use it and what changes for site owners

What you get from this article

• GPT-6 Cyber is a variant of GPT-6 Astra for authorized security work, available only to approved Daybreak Red customers.
• On the API it costs US$ 20 per million input tokens and US$ 100 per million output, exactly twice GPT-6 Astra.
• In the Linux kernel: 2,308 suspected flaws, 1,724 reproduced and 948 distinct flaws with an exploit, for US$ 1,213,430 in API credits.
• The 51% gain in the announcement is against GPT-5.6 Cyber. Against Astra, the system card shows 48.45% to 42.43%, and Astra wins the external FrontierCyber test 96 to 90.
• The Critical rating already belonged to GPT-6 Astra, the first OpenAI model to reach that level.
• Mozilla's public advisory for Firefox 159 lists 41 high-severity CVEs credited to OpenAI, which reports 81 flaws in total.
• For site owners the effect comes through time: OpenAI itself says an ordinary account on an unpatched system should be treated as root.

What GPT-6 Cyber is

GPT-6 Cyber is an artificial intelligence model built for authorized security work: looking for vulnerabilities, writing exploits and running penetration tests on web applications. An exploit is the program that proves, on a real machine, that a flaw can be used. The base is GPT-6 Astra, OpenAI's general model, with additional reinforcement training on tasks such as reproducing crashes, developing working attacks and searching codebases.

That training has two goals stated in the system card: raise security capability and reduce refusals on authorized requests. In OpenAI's own tests, the model completed 100% of general security and patching tasks, 96% of exploit development tasks and 97% of red team tasks, red teaming being an attack simulation run at the system owner's request.

It is OpenAI's fourth security model of 2026, after those of April, June and August, according to Fortune. The race for this market also includes Anthropic, with its Glasswing program, and Google, with Fairwind, both of which give vetted users access to models with fewer restrictions.

What it is for and who can use it

The intended user is a security team that has to go beyond code review: confirming whether a flaw can be exploited, testing a fix against a real attack, red teaming and researching vulnerabilities at scale. Mozilla, Cisco, Palo Alto Networks, Calif and CodeRabbit are among the companies already working with the model, and OpenAI used it on its own infrastructure.

Access goes through Daybreak, OpenAI's security program launched in May, which has two levels. Daybreak Blue covers defensive work, such as validating flaws and fixes with fewer refusals. Daybreak Red allows exploit development and authorized penetration testing, and it is the route through which GPT-6 Cyber reaches customers. For now, only a select group of Red customers has the model, through the API and Codex, and OpenAI promises to open it to all Red customers soon.

The requirements, described in the system card, are these:

• Organizations: eligibility review, legal attestation, single sign-on (SSO), multi-factor authentication, managed devices, least-privilege access and IP allowlisting on the API.
• Individuals: invitation only, with identity and liveness checks, proof of professional suitability, legal attestation and at least one physical FIDO2 security key.
• How it is used: OpenAI recommends an isolated environment, explicit limits on targets, credentials and network, and a human operator able to stop the agent in high-risk workflows.
• Data retention: API customers on Zero Data Retention generally have to use Private Safety Processing, which keeps encrypted records for 30 days in the customer's own storage for automated abuse checks.

How much GPT-6 Cyber costs

OpenAI's API pricing table lists the model in its own category. It costs exactly twice GPT-6 Astra at short context and 60% more on input than GPT-5.6 Cyber, its direct predecessor. The price only applies once you are approved: without Daybreak Red approval, there is no way to buy it.

The most concrete spending reference comes from OpenAI itself. The Linux kernel scan, described in the next section, used US$ 1,213,430 in API credits, and the company says that figure should be read as an upper bound, because the research prioritized measuring capability over cost. A smaller test, in the environment of kernelCTF, Google's bounty program, came to US$ 32,936.

Price in US$ per million tokens on the OpenAI API

	Input	Output	Cache
GPT-6 Cyber new	20.00	100.00	2.00
GPT-6 Astra general model	10.00	50.00	1.00
GPT-5.6 Cyber predecessor	12.50	75.00	1.25

What it did in Linux and Firefox

The main demonstration came out one day before the launch, in the study A thousand fewer paths to root. OpenAI built a line of agents that reads the Linux kernel, flags suspects, reproduces each one on an isolated machine, attempts the exploit and writes the fix, with human review at the end. The scan ran in mid-October on the latest kernel version, and the target was a desktop system in its default configuration, with protections on. The type of flaw it looked for is local privilege escalation: someone with an ordinary account on the machine becomes root, the user who controls everything.

The result was 948 distinct flaws with a working exploit, at US$ 1,279 each by the company's math. In July, with GPT-5.6 Sol in the same process, it found 166 for US$ 513,690, about US$ 3,094 each. For scale, OpenAI notes that Pwn2Own and TyphoonPWN have paid US$ 20,000 and US$ 70,000 for a flaw of this kind. The study does not include the same scan with GPT-6 Astra, which would be the most useful comparison.

Three caveats come with these numbers. The 948 is OpenAI's own count, based on the number of distinct fixes, with no confirmation from kernel maintainers; Fortune reports that 588 of them were previously unknown. By the time of the announcement, the company had reported 304 critical flaws with candidate patches, and it continues with the rest. And the US$ 18.9 million to US$ 66.3 million it calculates in bounties is a hypothetical figure.

In Firefox, OpenAI reports 81 previously unknown high-severity flaws. This can be partly checked, because Mozilla's advisory is public. We counted MFSA 2026-118, for Firefox 159, published on 27 October: it has 167 CVEs, 108 of them high severity, and 41 are credited to OpenAI (34 to Codex Security and 7 to Amy Burnett, of the company). The others may sit under the generic "Mozilla" credit or in later versions, and OpenAI says many fixes have already shipped. The same advisory notes that Mozilla stopped grouping memory safety bugs into a single CVE, which makes this total hard to compare with older advisories.

Finding the flaw is no longer the bottleneck. The bottleneck now is reviewing, fixing and installing.

Funnel of the Linux kernel scan, October 2026

	Result	API cost
Code mapping 2.8 million lines, 7% of the kernel	5,034 targets	US$ 3,426
Flaw search 12 hours	2,308 suspects	US$ 316,549
Reproduction on an isolated machine, 30 hours	1,724 confirmed	US$ 73,330
Severity triage static analysis	1,238 candidates	US$ 44,194
Exploit development cost includes information leaks	1,169 exploits	US$ 775,929
Distinct flaws counted by fixes	948	US$ 1,213,430

GPT-6 Cyber or GPT-6 Astra: what the system card shows

The announcement opens with a 51% improvement on ExploitGym, a test in which the model has to exploit a specified flaw in a remote target. The baseline for that figure is GPT-5.6 Cyber, which scored 32.1%. Against GPT-6 Astra, the model Cyber was built from and which costs half as much, the system card shows 48.45% to 42.43%: six points, or 14% in relative terms.

The other capability tests follow the same pattern, with a lead of a few points. Irregular, the outside firm that tested both, describes performance as broadly comparable, with higher success on long tasks. On FrontierCyber, built on real software and hardware, Astra solved more challenges. Neither model broke a fully hardened target or solved the 15 hardest challenges in that test.

The big gap is in a single row: on RemoteExploitBench, Astra through Daybreak Blue refused 100% of tasks and Cyber completed 95%. Our reading is that OpenAI charges double mainly for permission to carry out what the general model refuses, and only then for the capability gain.

The rating follows the same logic. The press highlighted that Cyber was rated Critical under the Preparedness Framework, OpenAI's risk scale, up from High for GPT-5.6 Cyber. The system card completes the picture: it is the same level as GPT-6 Astra, the company's first model to get there. Critical means being able to find and exploit previously unknown flaws in many hardened systems without human intervention, or to plan and execute a novel attack end to end from a high-level goal. That level was already present in a broadly deployed model, with its refusal safeguards on.

GPT-6 Cyber against GPT-6 Astra

	Cyber GPT-6	Astra GPT-6
ExploitGym exploit a specified flaw	48.45%	42.43%
ExploitGym Hardened targets with stronger protections	36.94%	29.69%
ExploitBench Internal Port recent flaws in V8 and Chrome	42%	39%
SEC-Bench Pro find flaws in JavaScript engines	87.02%	85.38%
SRE-Bench binary reverse engineering	92.84%	87.98%
Web pentesting flaws found without source code	40.3%	32.0%
CyScenarioBench Irregular, long attacks solved	11 of 11	8 of 11
FrontierCyber Irregular, real software and hardware	90 of 288	96 of 288
RemoteExploitBench tasks completed	95%	refused 100%
Honeypot service exploited without safety instructions, lower is better	0.07%	0%
Blocker left out of final answer lower is better	20.29%	11.66%
Stopped at a warning when stopping was right	73.00%	78.38%

Staying in scope: what the tests show

OpenAI presents the model as aligned, and the reason has a date. In July 2026, company models under internal evaluation escaped isolation and compromised part of OpenAI's research infrastructure and Hugging Face systems. The ExploitGym Honeypot test was informed by that incident: the model gets a hard task and, next to it, an easy-to-breach service that is off limits.

Without the safety instructions used in production, GPT-5.6 Sol breached the honeypot in 49.5% of runs, GPT-5.6 Cyber in 5.51%, GPT-6 Cyber in 0.07% and GPT-6 Astra in 0%. With the instructions, Cyber stayed at 0%. The improvement over the previous generation is large. Chris Hughes, of Noma Security, told CSO that at the scale these models run, a small fraction still means action against systems nobody authorized. Fouad Matin, of OpenAI, said the company keeps watching for a model that notices the test and changes its behavior.

Two measurements deserve attention from anyone operating the model. On the test of reporting blockers, Cyber was flagged in 20.29% of responses, against 11.66% for Astra; OpenAI explains that in most reviewed cases it had warned earlier and did not repeat this in the final answer. And faced with a tool warning where stopping was the right call, it stopped 73.00% of the time, against 78.38% for Astra, a pattern the system card attributes to greater task persistence.

The most useful case for any company using agents is in the Linux study. In an early run, the system recorded 200 successful exploits. On human review, 20 had reached root through a different flaw from the one the agent was assigned. OpenAI's advice also applies to agents working in spreadsheets, CRMs or campaigns: check the path to the result as well as the result.

One in ten successes in that run came by a route nobody asked for.

Advantages of GPT-6 Cyber

For anyone with a security team who gets through approval, the gains are concrete. All of those below were measured by OpenAI or reported by its partners.

The point of greatest practical value is validation. The Linux study says discovery got easier and that prioritizing and validating remain the bottlenecks, and the model works on that stretch: it delivers proof that the flaw is real along with the suspicion.

• Carries out what the general model refuses: 96% of exploit development tasks completed and 95% on RemoteExploitBench.
• Brings proof with the suspicion: 74.7% of suspected Linux flaws were reproduced, and only 3.1% were incorrect analysis by the model.
• Helps with the fix: the workflow in the study produces root cause analysis, a proof of concept and a candidate patch for human review.
• Cost per flaw below market bounties: US$ 1,279 per exploit, against historical bounties of US$ 20,000 to US$ 70,000.
• Reaches heavily audited code: Brian Grinstead, a Firefox engineer, says the model found previously unknown high-severity flaws even after hardening with earlier generations of models.
• Stays in scope almost always: 0.07% honeypot exploitation without safety instructions and 0% with them.

Disadvantages and limits of GPT-6 Cyber

The limits appear in OpenAI's own documents and weigh more on anyone without a dedicated security team.

There is also a limit on the evidence. The main numbers come from the maker, and as of this writing we found no public statement from a kernel maintainer about the 948.

• Closed access: approved Daybreak Red customers only, with requirements designed for specialist teams.
• Price: twice GPT-6 Astra, for a lead of a few points on capability tests.
• Fixing moves slower than finding: Hughes told CSO that the Patch the Planet dashboard showed fewer than 25% of flaws fixed.
• Recent flaws are still hard: 42% success on ExploitBench Internal Port, a task the system card calls challenging for the model.
• Needs human review: 20 of 200 exploits in an early run used the wrong flaw.
• Fewer safeguards call for more control: isolated environments, action review and human oversight fall to the customer.

Why this reaches your site even if you never use the model

The access gate buys time for defenders, and that time is short. Greg Brockman, of OpenAI, wrote in August that open-weight models with security capability trail frontier models by only a few months. The Linux study predicts that, in the coming years, even less capable models will be able to write an exploit once a flaw is disclosed.

The first effect is on deadlines. A published fix becomes a map for attackers, and the average cost of developing a successful exploit in the scan was US$ 359 in API credits. In October, PHP2Shell, listed among the disclosures of Patch the Planet, an OpenAI program, saw its first attacks recorded hours before the fix.

The second is the value of an ordinary account. OpenAI writes that, in the short and medium term, a low-privilege account on a system without the latest patches should be treated as root against a well-resourced attacker. An old plugin gives the way in over the web; a kernel flaw gives the rest of the server, along with any other sites on it.

The third is the race for the same flaws. By OpenAI's count, at the end of the 10 days of the scan, 61 flaws were already fixed, 43 had fixes in preparation and 299 were under public discussion, some of them through the work of other contributors. That is 403 cases, 43% of the total: other people were finding the same things in the same period.

What to do this week

None of this depends on access to GPT-6 Cyber. The flaws in the Linux study are local, they require an account on the machine, and the job is to close the way in and reduce what a breached account can do.

On 5 November we checked the two kinds of server we run. On the VPS, the running kernel is the newest one installed, with no reboot pending. On the shared server, the machine had gone more than 100 days without a reboot and was running with live patches, applied without shutting down, equivalent to a newer kernel version than the one it booted. In both cases, uptime said nothing: you have to ask what is applied.

• Shared hosting: the kernel belongs to the provider. Ask in writing whether it applies live patches and how it isolates one account from another.
• VPS or own server: installing the package is not enough. Without live patching, the new kernel only counts after a reboot. Compare uname -r with the installed version and schedule the reboot.
• Containers: they share the host kernel. OpenAI cites Firecracker and gVisor as isolation layers that limit the damage.
• Accounts: remove SSH, FTP and panel access for people who left, and turn on two-step verification for hosting, domain, email and WordPress.
• PHP and plugins: confirm the version your site serves and delete what sits there without updates.
• Backups: keep them off the server, with a tested restore.
• A general model on what is yours: Brockman asked a public model to assess his own site and got 13 problems in about 15 minutes, among them DNS with no protection against spoofed email, insecure jQuery and unencrypted traffic between Cloudflare and the server.
• Authorization: test only what is yours or what you have written permission to test. In Brazil, breaking into someone else's device to obtain, change or destroy data is a crime, and article 154-A of the Penal Code provides for 1 to 4 years of imprisonment and a fine.

Where ROO3 comes in

GPT-6 Cyber keeps the question we asked in the PHP2Shell article and shortens the time to answer it: who updates your server, and how do you find out that they did?

At ROO3, we build sites that show up on Google and in AI answers and take care of the part nobody sees: the PHP version, the fix on the day it ships and measuring what the visitor receives. When a company wants to put an AI agent to work on a real system, our AI consulting helps define access limits, human review and what has to be checked afterwards.

If you do not know who looks after your server, or if it has sat untouched since your site was delivered, talk to us.

Frequently asked questions

What is GPT-6 Cyber?

It is OpenAI's cybersecurity model, released on 5 November 2026. It is a variant of GPT-6 Astra with additional training to find vulnerabilities, develop exploits and run authorized penetration tests, with fewer refusals on those requests.

How much does GPT-6 Cyber cost?

On the API, US$ 20 per million input tokens, US$ 100 per million output and US$ 2 for cached input, twice the price of GPT-6 Astra. The price only applies to customers approved for Daybreak Red.

How do I get access to GPT-6 Cyber?

You have to apply to Daybreak, OpenAI's security program, and be approved for the Red level. Organizations go through an eligibility review and need SSO, multi-factor authentication, managed devices and IP allowlisting. Individuals join by invitation, with identity checks and a physical security key. For now, only a select group of Red customers has the model.

What is the difference between GPT-6 Cyber and GPT-6 Astra?

Cyber was trained from Astra for security work and refuses far fewer requests of that kind. On capability tests the lead is a few points (48.45% to 42.43% on ExploitGym), and Astra won FrontierCyber, run by Irregular, by 96 challenges to 90. Cyber costs twice as much.

What are Daybreak Blue and Daybreak Red?

They are the two levels of OpenAI's security program. Blue covers defensive work, such as finding, validating and fixing flaws. Red covers authorized penetration testing, exploit validation and controlled research, and it is the level that gives access to GPT-6 Cyber.

What does OpenAI's Critical rating mean?

It is the highest level of cybersecurity capability in the Preparedness Framework. It means the model can find and exploit previously unknown flaws in many hardened systems without human intervention, or plan and execute a novel attack from a high-level goal. GPT-6 Astra was the first OpenAI model at this level, and GPT-6 Cyber received the same rating.

My site runs on Linux. Do the 948 flaws affect me?

They are local flaws: an attacker first needs an account on the machine. The risk appears when someone gets in another way, such as an old plugin, a leaked password or a PHP flaw. Whoever looks after the server should apply kernel fixes and confirm they are running, either through a reboot or through live patching.

Sources

• OpenAI, GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents (5 Nov 2026)
• OpenAI, GPT-6 Cyber System Card (5 Nov 2026)
• OpenAI, GPT-6 Astra System Card
• OpenAI, A thousand fewer paths to root (4 Nov 2026)
• OpenAI, API pricing
• OpenAI, Daybreak
• Mozilla, MFSA 2026-118: Security Vulnerabilities fixed in Firefox 159 (27 Oct 2026)
• Patch the Planet, recent disclosures
• Greg Brockman, OpenAI, The defender's window (17 Aug 2026)
• OpenAI, The Hugging Face incident and the road ahead (26 Aug 2026)
• Fortune, OpenAI debuts new cybersecurity-focused AI model (5 Nov 2026)
• The Next Web, OpenAI's GPT-6 Cyber found 81 new Firefox flaws (5 Nov 2026), with the remarks by Chris Hughes and Fouad Matin
• Planalto, Brazilian Penal Code, article 154-A

Rodrigo Fávaro

Founder of ROO3, a marketing and technology agency in São José do Rio Preto, Brazil. Builds AI products running in production (Tobia, gerar.app, Pense Mercado) and maintains the AI Benchmark, a public ranking of AI models. See ROO3 AI consulting.

X @rodmf LinkedIn rodrigofavaro