On 5 November 2026, OpenAI launched GPT-6 Cyber, a version of GPT-6 Astra trained specifically for authorized security work: finding vulnerabilities, building exploits to prove them, and penetration-testing websites. But it is not open to every company: access is limited to the Daybreak Red program, for organizations OpenAI approves after identity checks and security requirements such as single sign-on and multi-factor authentication. What matters to most Saudi companies right now is not using it but what it reveals: in OpenAI's tests the model exploited 48.45% of targets, fell to 36.94% when stronger protections were switched on, and succeeded against no fully hardened target. Patching and hardening are still the strongest defence.
What is GPT-6 Cyber?
According to the system card OpenAI published, the model was trained with reinforcement learning on tasks such as reproducing crashes, building working exploits and searching codebases for vulnerabilities, with training signals that keep it within the scope the user authorized and stop it taking actions nobody asked for. In the defensive-use evaluation it completed 100% of general security assistance and vulnerability patching tasks, 96% of exploit development tasks and 97% of red-teaming tasks.
OpenAI rates the model "Critical" in cybersecurity under its Preparedness Framework, the same rating it gave GPT-6 Astra, the highest risk level in that area.
What do the test results say?
| Test | What it measures | GPT-6 Cyber | GPT-6 Astra |
|---|---|---|---|
| ExploitGym | Exploiting a specified vulnerability in a remote target | 48.45% | 42.43% |
| ExploitGym Hardened | The same test with stronger protections such as address-space randomization and stack canaries | 36.94% | 29.69% |
| SEC-Bench Pro | Finding vulnerabilities in large JavaScript engines such as V8 | 87.02% | 85.38% |
| Recently disclosed flaws | Building a working exploit for recently disclosed flaws in Chrome and V8 | 42% | 39% |
In an external evaluation by Irregular on real software and hardware, the model solved 90 of 288 challenges, and its successful attacks included zero-day vulnerabilities in browsers, mobile phones and cloud databases. But Irregular observed no successful attack on fully hardened targets, and the model solved none of the 15 hardest challenges. OpenAI itself admits that reliably exploiting recently disclosed flaws "remains challenging" for the model: it is a powerful tool, not an unstoppable attacker, and the difference is made by how fast you patch and how well you harden.
Who can use it?
The system card says GPT-6 Cyber is available only to approved Daybreak Red users and organizations. OpenAI reviews applications based on an organization's cybersecurity use cases, security practices and legal attestations, and requires organizations to have:
- Single sign-on (SSO) and multi-factor authentication.
- Managed devices, and least-privilege access for every employee.
- Protected, rotated credentials, monitoring of employee use, and reporting of suspected misuse.
- API access restricted to IP addresses the company approves.
OpenAI also added checks that block high-risk assistance involving industrial controls, essential services and election systems, and tested them with Dragos, a specialist in industrial control security. Even if you never apply, these requirements are a good checklist to measure your own account security against.
Individuals get access only by invitation from OpenAI, after identity and liveness checks, proof of professional suitability and a legal attestation, and their accounts must be protected with at least one physical FIDO2 security key. The message is clear: even OpenAI does not trust a password alone to protect a tool this powerful.
What does this mean for your company?
- Disclosed flaws will be exploited faster. A model that builds a working exploit for 42% of recent browser flaws means the gap between disclosure and exploitation is shrinking, as we saw with the PHP2Shell flaw and the FortiGate flaws found by AI.
- Hardening works. Stronger protections cut the model's success from 48.45% to 36.94%, and fully hardened targets were not breached in Irregular's evaluation. Do not switch off operating system and browser protections to make work easier.
- Defenders gain too. If you run a software company or an app, ask your penetration-testing provider which AI tools it uses, and set the authorized test scope in writing.
5 steps to protect your company's software now
- Turn on automatic updates for browsers and operating systems on staff devices; the browser is one of the targets the model was tested on most.
- Know everything exposed to the internet, from servers and firewalls to admin panels, and update it first when a fix is released.
- Apply what OpenAI requires to your own accounts: single sign-on, multi-factor authentication, least privilege and managed devices.
- Test your software before an attacker does. Ask your developer or security provider to review the code for vulnerabilities, with a written scope and clear approval.
- Prepare a response plan that names who decides to stop a service or isolate a server if a critical flaw is announced in a system you use.
For the bigger picture, read how to protect your company from AI risks. At Origami we review companies' software and servers and close vulnerabilities before someone else finds them. Contact us if you would like a review of your systems.
Frequently asked questions
What is GPT-6 Cyber?
A version of GPT-6 Astra that OpenAI trained for authorized security work, such as finding vulnerabilities, building exploits to prove them and penetration-testing websites, launched on 5 November 2026.
Can my company use GPT-6 Cyber?
Only if OpenAI approves it for the Daybreak Red program, after reviewing its use cases, security practices and legal attestations, with requirements such as single sign-on, multi-factor authentication and managed devices.
Does GPT-6 Cyber make hacking easier for attackers?
OpenAI limits access to approved parties and adds safeguards and monitoring. But capabilities like these generally shorten the time between a flaw being disclosed and exploited, so fast patching matters more.
What is the main lesson for companies from the test results?
That hardening works: stronger protections cut the model's success from 48.45% to 36.94%, and it succeeded against no fully hardened target in Irregular's evaluation.
