OpenAI has released GPT-6 Cyber, a restricted security model it classifies as “Critical” for cybersecurity under its own risk policy. The company says the model found 81 previously unknown high-severity Firefox bugs. The harder question is no longer whether such a model works, but how tightly access to it can be controlled.
On November 5, OpenAI introduced GPT-6 Cyber, a model trained to find vulnerabilities in software, build working exploits for them and confirm that they work, while staying inside the scope a human researcher sets. It is not a general release. It is available initially through OpenAI’s API and its Codex coding agent to “a select group of approved Daybreak Red customers,” the most permissive tier of the company’s Daybreak cyber programme.
The notable detail is the label OpenAI attached to it. The company says it classifies GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from High for its predecessor, GPT-5.6 Cyber. That is OpenAI saying, in its own terms, that it has shipped a model at the top of its cyber-risk scale to paying customers, and relying on access rules, monitoring and network restrictions to keep that capability with defenders.
What “Critical” means in OpenAI’s framework
The Preparedness Framework is OpenAI’s internal policy for tracking capabilities that could cause severe harm and for deciding what safeguards a model needs before it is developed further or deployed. In cybersecurity it has two thresholds. In an August 7 post, OpenAI described the Critical threshold as a model that “can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.” A zero-day is a flaw that the software’s maintainers do not yet know about, so no patch exists.
GPT-6 Cyber is not the first time OpenAI has confronted that line. In the same August post, the company said it could not rule out Critical capability in Astra, then an upcoming model, and described pausing internal work that did not meet stricter security controls. What is new is that a model OpenAI explicitly classifies as Critical for cyber is now in outside hands, even if only selected ones.
Two caveats matter. First, the classification is OpenAI’s own judgment under its own policy, not an independent certification. Second, “Critical” describes capability, not intent. The same skills that let a model find and validate a bug in a browser are the skills an attacker would want.
The numbers OpenAI is citing
All of the following figures come from OpenAI and its customers; none has been independently replicated.
- ExploitGym: On this benchmark, which tests whether a model can exploit a specified vulnerability in a remote target, GPT-6 Cyber scored 48.5%, against 32.1% for GPT-5.6 Cyber.
- Web penetration testing: On a new OpenAI evaluation in which models probe web applications without source code, GPT-6 Cyber found 40.3% of vulnerabilities, versus 32.0% for GPT-6 Astra, OpenAI’s mainline model.
- RemoteExploitBench: Using known flaws in software such as GitLab, PostgreSQL and Jenkins in a controlled environment, OpenAI says GPT-6 Cyber completed 95% of tasks while GPT-6 Astra running under its Daybreak Blue settings refused all of them.
- Staying in scope: In a “honeypot” test that tempts the model with deliberately exploitable services outside its assigned task, GPT-6 Cyber stayed in bounds in 99.93% of cases without its deployment safety prompt (GPT-5.6 Cyber: 94.49%) and 100% with it.
The last result is arguably the more important one for buyers. A security agent that occasionally attacks the wrong system is a liability, whatever its benchmark score. But a 0.07% out-of-scope rate in a lab test is not the same as a guarantee in a sprawling corporate network, and OpenAI itself still recommends sandboxing, action review and human oversight for high-risk work.
The Firefox findings are the most checkable claim
OpenAI says that during a research campaign GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities that Mozilla classified as high severity, and showed that 30 already-known issues were more severe than previously reported. It says it sent proposed patches with its reports and that Mozilla began landing fixes shortly afterwards.
Mozilla’s public record supports the broad outline, though not every specific. Its security advisory for Firefox 159, published October 27, lists roughly 40 high-impact bugs credited to “Amy Burnett of OpenAI” or “OpenAI Codex Security,” most of them use-after-free memory errors in components such as the DOM, layout, SVG and the JavaScript engine. The advisory does not say which OpenAI model found each bug, so it cannot confirm the 81 figure on its own. Mozilla also notes it has changed its advisory format to issue a separate CVE for every internally identified memory-safety bug, which makes the list longer than past releases would have been.
Brian Grinstead, a Distinguished Engineer on Firefox, is quoted in OpenAI’s announcement saying the model “uncovered previously unknown high-severity vulnerabilities” even after Firefox had been hardened “with multiple generations of frontier models.” If that holds, it suggests the backlog of undiscovered bugs in mature, heavily audited software is deeper than many defenders assumed. For ordinary users, the practical point is simple: keep Firefox updated to version 159 or later.
The Linux side of the campaign, in which OpenAI says GPT-6 Cyber developed working exploits for 948 kernel vulnerabilities out of 1,724 it reproduced and disclosed 304 critical findings with candidate patches, raises separate questions about maintainer workload. VibeCodAI examined that pipeline in an earlier piece on patching at machine speed.
Access control is now the safety mechanism
Because the model’s value and its danger are the same capability, OpenAI’s safety case rests largely on who can use it and how. The company describes several layers:
- Tiered access. Daybreak Blue gives verified defenders help validating vulnerabilities and fixes with fewer refusals. Daybreak Red allows deeper exploit development and testing against remote targets, and only approved Daybreak Red customers get GPT-6 Cyber for now.
- Network restriction. Daybreak Red API access requires IP allowlisting by default, meaning requests must come from approved networks, a defence against stolen API credentials.
- Monitoring. OpenAI says it checks whether a model’s actions match the user’s authorisation, runs targeted monitoring during sensitive disclosures, and uses automated misuse review. For zero-data-retention API customers it says a process called Private Safety Processing reviews encrypted records held in customer storage for 30 days without exposing prompts and responses to OpenAI staff.
- Critical-infrastructure limits. OpenAI says it has refined safeguards against help that could compromise industrial control systems, while creating a separate Daybreak Red group that lets approved infrastructure defenders test those systems.
That last point illustrates the tension. In testing OpenAI commissioned from industrial-security firm Dragos, a permissive Daybreak Red model placed on a mock power-plant network separated operational technology from ordinary IT systems and found two zero-days in software that manages protective relay data, according to Dragos’s Rob T. Lee. That is useful for defenders and exactly the reconnaissance an attacker needs. OpenAI acknowledges the trade-off directly: higher block rates “are not always better,” because many blocked techniques are also essential to legitimate security work.
OpenAI also says it is seeing more attempts to misuse its models, including by malicious cyber actors and groups trying to distil its models, meaning to train their own systems on its outputs. Distillation is a reminder that access controls protect a model only for as long as its capabilities stay unique.
What remains uncertain
Several things cannot be judged from the launch material. The benchmarks are largely OpenAI-built, and the full evaluation settings sit in a system card rather than peer-reviewed work. The vetting standard for Daybreak Red customers has not been published in detail, and OpenAI says it will “progressively expand access to all Daybreak Red customers soon,” which widens the circle by an amount it has not quantified. And the customer endorsements, from Cisco, CrowdStrike, Palo Alto Networks, SentinelOne, Perplexity, CodeRabbit, Calif and Cognition among others, are testimonials published by the vendor, not audits.
There is also a competitive question. If one lab can produce a model that finds high-severity browser bugs at this rate, others will follow, and not all will apply the same restrictions. OpenAI frames this as “a limited window to use frontier models to secure software.” That framing is self-serving, but it is not obviously wrong.
What to watch next
The useful signals over the coming months will be outside OpenAI’s control: how many further Firefox, Linux and open-source advisories credit model-assisted research; whether maintainers report that AI-generated reports and patches are improving or overwhelming their queues; how fast OpenAI broadens Daybreak Red; and whether any misuse of a Critical-rated model is publicly documented. GPT-6 Cyber shows that frontier labs now treat exploit-capable models as products to be licensed rather than research to be withheld. Whether licensing can hold the line is the question that the benchmarks do not answer.