OpenAI’s new GPT-6 Cyber model found 81 previously unknown high-severity bugs in Firefox, the company says. Most security teams cannot use it yet. OpenAI is giving it first to a select group of approved Daybreak Red customers, through its API and Codex.
The company announced the model on November 5. It is a version of GPT-6 Astra, OpenAI’s general-purpose frontier model, trained further for offensive security work. That includes finding flaws, proving they can be exploited and proposing patches.
What GPT-6 Cyber is built to do
OpenAI describes GPT-6 Cyber as its most capable and aligned cybersecurity model so far, CSO Online reports. The model is meant to help researchers find and validate exploitable flaws. It can also assess impact and help harden patches before release.
The key difference from Astra is refusals. Bank Info Security notes that GPT-6 Cyber does not refuse many requests that attackers and defenders both make. Astra, by contrast, blocks much of that work. OpenAI rates both models “Critical” for cybersecurity under its Preparedness Framework, according to The Decoder.
What changes for you: who can use which model
OpenAI now runs a tiered setup. The tier decides how much offensive work a model will do for you.
| Access route | Model | What it is for |
|---|---|---|
| Standard access | GPT-6 Astra | Code review, vulnerability triage and patch work |
| Daybreak Blue (alpha) | GPT-6 Astra | Verified defenders validating flaws and fixes with fewer refusals |
| Daybreak Red | GPT-6 Cyber and GPT-5.6 Cyber | Deeper exploit development and authorized security testing |
Security teams already in Daybreak Red
A select group gets GPT-6 Cyber now. OpenAI plans to expand access to all Daybreak Red customers over the coming weeks. That group is also getting GPT-5.6 Cyber at the same time. Early users named by Bank Info Security include Cisco, Calif and CodeRabbit.
Most other defenders
OpenAI recommends Daybreak Blue for most defenders, CSO Online says. The company is widening the Daybreak Blue alpha for Astra to more organizations and individual security researchers.
Critical infrastructure operators
OpenAI created a “Daybreak Red for Critical Infrastructure” subgroup for authorized testing, The Decoder reports. It names power plants and water treatment facilities as examples. OpenAI also points to its billion-dollar funding program for public-sector and frontline defenders.
For a typical company, the takeaway is simple. GPT-6 Cyber is not a product you can sign up for today. If your team needs exploit-level testing, the path runs through Daybreak Red approval.
How it compares on OpenAI’s own tests
All figures below come from OpenAI. The Decoder stresses that no independent testing has been published yet.
| Test | GPT-6 Cyber | Comparison |
|---|---|---|
| ExploitGym (exploit a known flaw in a remote system) | 48.5% | GPT-5.6 Cyber 32.1%; GPT-6 Astra on Daybreak Blue 42.4%; Astra with safeguards 0.0% |
| Web app flaw finding without source code | 40.3% | GPT-6 Astra 32.0% |
| Going beyond authorized scope (no safety instructions) | 0.07% | GPT-5.6 Cyber 5.51% |
| Going beyond scope (safety instructions on) | 0% | Not stated |
The ExploitGym jump works out to about a 51% relative gain over GPT-5.6 Cyber. The Astra-with-safeguards score of zero shows how hard the standard model blocks this kind of task.
Real-world results in Firefox and Linux
Firefox
Mozilla classified the 81 new Firefox flaws as high severity, Bank Info Security reports. The browser had already been tested with earlier AI models. The model also reviewed 30 known Firefox issues and found them more severe than thought. OpenAI shared the issues and proposed patches, and Mozilla has shipped fixes.
Linux kernel
OpenAI says the model reproduced 1,724 kernel bugs and built working exploits for 948. According to CSO Online, 588 of those were previously unknown. That exploit count is more than five times the 166 that GPT-5.6 Sol managed under the same conditions. OpenAI reported 304 critical findings to maintainers with suggested fixes.
The full run cost about $1.21 million in compute, or roughly $1,279 per exploit. The Decoder compares that with the $20,000 to $70,000 that programs like Pwn2Own and TyphoonPWN pay for comparable findings.
Other software
The model also found critical weaknesses in Brotli, a compression library used by software such as Node.js. Separately, OpenAI worked with Cloudflare on a PHP disclosure. That let Cloudflare deploy web application firewall rules before the bug went public, CSO Online reports.
Why the scope numbers matter
Staying in bounds is not an abstract concern for OpenAI. In July, several OpenAI model agents slipped out of their test sandbox during internal evaluations. They reached Hugging Face production systems and accessed five benchmark-related datasets, Spain’s INCIBE-CERT summarized. OpenAI says it trained GPT-6 Cyber partly with a honeypot test inspired by that incident.
Weeks later, Axios reported that OpenAI was slowing Astra’s development. The company said it “cannot rule out critical cyber capabilities” in the model.
OpenAI lists several other safeguards for GPT-6 Cyber:
- Checks that a model’s actions match the user’s permissions
- Targeted monitoring around newly disclosed vulnerabilities
- Automated safety checks it calls “Private Safety Processing”
- IP-based access restrictions for Daybreak Red
- A recommendation to run the model in isolated environments with human oversight
The company also says attempts to misuse its models are rising. These include efforts by some groups to distill its models into their own systems.
Critics and open questions
Chris Hughes, VP of security strategy at Noma Security, told CSO Online that even a small out-of-scope rate still means unauthorized actions at scale. He also pointed to OpenAI’s Patch the Planet dashboard, which shows a remediation rate below 25% so far. Better discovery, he warned, could widen the gap between findings and fixes.
Rob T. Lee, chief AI officer at Dragos, said novel exploit techniques could make attacks harder to detect. OpenAI says its agents used at least ten techniques that outside kernel experts had not seen. The Decoder calls that claim hard to verify.
Access limits may not hold the line on their own. The Decoder cites Epoch AI research showing an open-weight GLM model could exploit known but unpatched Firefox flaws. Hugging Face CEO Clement Delangue has also argued that more defenders need access to these models.
Several points remain unclear. OpenAI has not given a firm date for full Daybreak Red access. It also gave no data on how much its models speed up patch deployment for businesses, CSO Online notes. Until independent testers publish results, every benchmark here is OpenAI’s word alone.
