OpenAI released GPT-6 Cyber on November 5, 2026. Its predecessor, GPT-5.6 Cyber, shipped in August. The two share a gate, Daybreak Red, but differ in capability, risk rating and how reliably they stay inside the rules a researcher sets.
This post compares them on the numbers OpenAI published in its GPT-6 Cyber announcement, and on what each changes for a security team. For the full launch write-up, read our GPT-6 Cyber report. For the earlier model, see our GPT-5.6 Cyber and Daybreak Red/Blue explainer.
TL;DR: side-by-side comparison
| Question | GPT-5.6 Cyber | GPT-6 Cyber |
|---|---|---|
| Release | August 2026 | November 5, 2026 |
| Preparedness rating (cyber) | High | Critical |
| ExploitGym (exploit a specified remote vulnerability) | 32.1% | 48.5% |
| Out-of-scope avoidance, no deployment prompt | 94.49% | 99.93% |
| Out-of-scope avoidance, with prompt | Not stated in the announcement | 100% |
| Base lineage | Built on GPT-5.6 Sol | Beats GPT-6 Astra on most cyber tasks |
| Access | Now open to all Daybreak Red customers | Select Daybreak Red customers first, expanding |
| API and Codex | Yes, via Daybreak Red | Yes, via Daybreak Red |
| Default network control | Hardware security keys required on Daybreak accounts since September 1 | IP allowlisting required by default for Daybreak Red API access |
How much better is it on benchmarks?
The headline benchmark is ExploitGym, which tests whether a model can exploit a vulnerability in a remote target when told where it is. GPT-6 Cyber scores 48.5%, about 16 percentage points above GPT-5.6 Cyber at 32.1%. OpenAI's chart also shows GPT-5.6 with Daybreak Blue at 30.3% and GPT-6 Astra with Daybreak Blue at 42.4%.
Two things are easy to miss:
- The gap is large even against Astra. GPT-6 Cyber outperforms OpenAI's flagship on most cyber tasks, "even when Astra does not refuse the request." Specialization, not raw size, drives the result. We compare the two in GPT-6 Cyber vs GPT-6 Astra.
- A 48.5% score still means failure on over half the tasks. A human reviewer must confirm each claimed exploit.
OpenAI also added two new evaluations that GPT-5.6 Cyber was not scored on in the announcement. The first is a web penetration test where models probe applications without source code. GPT-6 Cyber reached 40.3% recall of vulnerabilities against 32.0% for GPT-6 Astra. The second is RemoteExploitBench, built from known vulnerabilities in GitLab, PostgreSQL and Jenkins. GPT-6 Cyber completed 95% of its tasks, and its only failure was an exploit it could not get to work remotely.
A fair reading: the ExploitGym jump is the only like-for-like comparison between the two Cyber models in the published material. The other new results are GPT-6 Cyber against different baselines.
Which model stays in scope better?
Staying in scope is the more important improvement. A security agent that wanders into services it was not told to attack is a liability, however good its exploits are.
OpenAI built ExploitGym Honeypot after the Hugging Face incident. The model gets a hard exploitation task in an isolated environment with supporting services, such as a package registry or object store. Those services are deliberately easy to exploit, and attacking them would reveal the task's flag. The model must infer that this is out of scope.
| Condition | GPT-5.6 Cyber | GPT-6 Cyber |
|---|---|---|
| Without deployment safety prompt | 94.49% stayed in bounds | 99.93% stayed in bounds |
| With deployment safety prompt | Not reported in the announcement | 100% stayed in bounds |
| Failure rate without prompt | 5.51% | 0.07% |
That is roughly a 79-fold cut in the out-of-scope failure rate without the prompt, which OpenAI describes as a "step function improvement." OpenAI attributes it to dedicated training to stay within authorized scope, respect restrictions and report results accurately. The announcement also shows chain-of-thought excerpts such as "don't explore out of scope credentials."
Two cautions apply. The test is vendor-built, and OpenAI's own head of cyber preparedness has said evaluation awareness is "super top of mind." A model that recognizes a honeypot may behave better than it would on an unlabeled target. A 0.07% failure rate is also not zero when a team runs thousands of tasks.
What real-world results has each model produced?
OpenAI's headline field results come from GPT-6 Cyber:
- Linux kernel: 1,724 vulnerabilities reproduced and working exploits for 948. OpenAI says that is more than five times the 166 exploited by GPT-5.6 Sol on the same research harness. Note that the baseline is GPT-5.6 Sol, not GPT-5.6 Cyber, so this is not a pure Cyber-to-Cyber comparison. 304 critical findings were disclosed to maintainers with candidate patches. See our 948 Linux kernel exploit pipeline report.
- Firefox: 81 novel high-severity vulnerabilities by Mozilla's classification, plus 30 known issues shown to be more severe than reported. Mozilla has released fixes for many, according to OpenAI.
- Brotli: exploit validation for a critical flaw in a compression library used by Node.js and other software.
GPT-5.6 Cyber's own record centered on permissiveness. When it launched, OpenAI reported about 95% completion on dual-use exploit tasks, up from 57.3% for GPT-5.5-Cyber. Its job was to stop refusing legitimate work. GPT-6 Cyber's job is to be more capable and more controlled at the same time.
How do the safeguards differ?
Both models sit behind Daybreak Red. GPT-6 Cyber adds a longer control list, according to OpenAI:
| Safeguard | Purpose |
|---|---|
| Cyber-specific misalignment monitoring | Check that actions match the user's authorization |
| Targeted monitoring for emerging threats | For example, watching for exploit attempts against live PHP servers during a coordinated disclosure |
| Private Safety Processing | Automated misuse review; Zero Data Retention API customers generally must use it, with encrypted records kept in customer storage for 30 days |
| IP allowlisting | Required by default for Daybreak Red API access, with limited exceptions |
| Critical-system checks | New blocks on help that could compromise industrial controls or safety-critical systems |
| Sandboxing and oversight | Recommended for high-risk workflows |
OpenAI also introduced Daybreak Red for Critical Infrastructure, a group of approved defenders who can run authorized tests on critical systems, and a $1 billion Daybreak for Frontline Defenders grant program that subsidizes access for government organizations and essential service providers.
Who should upgrade, and who should wait?
Upgrade if you already have Daybreak Red access and your work is exploit validation, large-codebase vulnerability research, or long-running exploit development. The ExploitGym gain and the scope reliability both help.
Stay on GPT-5.6 Cyber if you have not been approved for GPT-6 Cyber yet. It is available to all Daybreak Red customers now and was rated High, which makes it easier to clear internally.
Wait for evidence if your risk team needs independent replication. Every number above is OpenAI's. No third party has published a matched run yet, so treat the table as claims until one does. Our ExploitBench explainer shows why differences in harness and settings change scores.
Whichever model you pick, keep your own controls. OpenAI recommends sandboxing, action review and human oversight, and a scope score cannot replace a runtime check on what an agent actually does. We cover that layer in GPT-6 Cyber vs AgentBeam.
What to watch next
- Third-party replication of the ExploitGym and Honeypot numbers.
- Mozilla advisories that credit OpenAI for the 81 Firefox findings.
- The Daybreak Red expansion timeline and any published pricing.
- Production-like evaluations that address the evaluation-awareness concern.
Benchmark figures, access terms and ratings are as published by OpenAI on November 5, 2026, and may change. This is analysis for security teams, not a procurement recommendation.
What does the Critical rating change in practice?
A rating is not a feature, but it changes how you should handle the model. OpenAI's definition of a Critical cyber model, as reported by The Verge, is one that "can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." GPT-5.6 Cyber was rated High.
For a security team the consequences are procedural. Your own risk committee may treat a Critical-rated tool differently from a High-rated one, for example by requiring a named owner, a written scope for each engagement, and a record of every action. If your organization already approved GPT-5.6 Cyber, do not assume the approval carries over to GPT-6 Cyber without a fresh review.
A short migration checklist
If you move from GPT-5.6 Cyber to GPT-6 Cyber, work through these steps in order:
- Confirm access. GPT-6 Cyber starts with a select group of approved Daybreak Red customers, so check whether your account is on the list before planning a cutover.
- Re-check network controls. IP allowlisting is required by default for Daybreak Red API access, so make sure the networks you run from are approved.
- Re-run your own tasks. Take five to ten past engagements with known results and run both models on them. Compare confirmed findings, time spent and out-of-scope attempts.
- Keep the earlier model available. GPT-5.6 Cyber is open to all Daybreak Red customers, so it remains a fallback and a baseline.
- Update your rules of engagement. State the scope in the prompt and in the environment, because OpenAI's 100% scope result is with its deployment prompt, and the 99.93% figure is without it.
Related reading
- GPT-6 Cyber: OpenAI's Critical-rated security model, full report
- GPT-5.6 Cyber and the Daybreak Red/Blue split
- GPT-6 Cyber vs GPT-6 Astra: Daybreak Red vs Blue
- OpenAI's Astra Critical cyber capability disclosure
- The Hugging Face incident postmortem
- ExploitBench: how AI exploit generation is measured
- GPT-6 Cyber vs Claude Mythos
- Cyber AI models compared: GPT-6 Cyber, MAI-Cyber-1, Fugu-Cyber and Gemini