OpenAI now gives defenders two routes to its frontier cyber capability. One runs through GPT-6 Astra, the mainline flagship, with a Daybreak Blue wrapper. The other runs through GPT-6 Cyber, a security-trained model reserved for Daybreak Red.
The choice is not "good model versus bad model." It is a choice between a general model with careful guardrails and a specialist with fewer refusals and tighter vetting. This post compares them using OpenAI's GPT-6 Cyber announcement. Background: our full GPT-6 Cyber report.
TL;DR: which one is for what?
| Question | GPT-6 Astra (mainline, Daybreak Blue) | GPT-6 Cyber (Daybreak Red) |
|---|---|---|
| What is it? | OpenAI's flagship general model | A model trained to find and validate exploitable vulnerabilities |
| ExploitGym | 42.4% (with Daybreak Blue); 0.0% with safeguards enabled | 48.5% |
| RemoteExploitBench | Refused 100% of tasks (Daybreak Blue) | Completed 95% |
| Best at | Code review, triage, patch development, validating fixes | Exploit development, authorized testing, large-scale vulnerability research |
| Refusals | Fewer than the default model, but exploit development is blocked | Built for deeper exploit work inside authorized scope |
| Access | Mainline; Daybreak Blue alpha expanding to more organizations and individuals | Select Daybreak Red customers now, wider soon |
| Rating | Critical-level cyber capability, per OpenAI's earlier disclosure | Critical in cybersecurity under the Preparedness Framework |
| Network control | Standard account controls | IP allowlisting required by default for the API |
What does each tier actually do?
OpenAI's language is precise. Mainline models such as GPT-6 Astra already support code review, vulnerability triage and patch development. Daybreak Blue "helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals." Daybreak Red "enables deeper exploit development and authorized security testing with GPT-6 Cyber."
That maps onto two common security jobs:
- Blue work: find a bug in a code review, confirm it is real, write a patch, and prove the patch holds. The model needs to read exploit-adjacent material and answer follow-up questions without refusing, but it does not need to attack a live target.
- Red work: build a working exploit, run it against a remote target in an authorized test, and chain steps together. That is the work that most frontier models refuse by default.
The Red/Blue structure came from OpenAI's August restructuring of Daybreak, which we covered in GPT-5.6 Cyber and the Daybreak Red/Blue split. The May launch is in our Daybreak and Codex Security explainer.
How do the benchmark numbers compare?
OpenAI's chart lists five configurations on ExploitGym:
| Configuration | ExploitGym |
|---|---|
| GPT-5.6 with Daybreak Blue | 30.3% |
| GPT-5.6 Cyber | 32.1% |
| GPT-6 Astra with safeguards enabled | 0.0% |
| GPT-6 Astra with Daybreak Blue | 42.4% |
| GPT-6 Cyber | 48.5% |
Read the 0.0% carefully. It does not mean Astra cannot exploit anything. OpenAI does not explain the zero in the text we saw, but it fits the 100% refusal rate on RemoteExploitBench: with safeguards on, the model most likely declines the exploit tasks. The meaningful comparison for defenders is Astra with Daybreak Blue (42.4%) against GPT-6 Cyber (48.5%): about 6 points.
The bigger divergence is on RemoteExploitBench, a new benchmark OpenAI built from known vulnerabilities in GitLab, PostgreSQL and Jenkins in a controlled environment. Astra with Daybreak Blue refused all of the tasks. GPT-6 Cyber completed 95%, and its only failure was an exploit it could not get working remotely. That gap is deliberate. Blue is built not to do this.
On the new web penetration testing evaluation, where models probe web applications with no source code access, GPT-6 Cyber reached 40.3% recall of vulnerabilities against 32.0% for GPT-6 Astra.
OpenAI's summary: GPT-6 Cyber "outperforms GPT-6 Astra on most cyber tasks, even when Astra does not refuse the request." Specialization helps beyond the refusal policy.
Which has stronger safeguards?
They are different layers. Astra with Blue is mostly protected by the model's own refusal training and by the program's vetting. GPT-6 Cyber gets extra controls because it will do more:
- Cyber-specific misalignment monitoring that checks actions against the user's authorization.
- Targeted monitoring for emerging threats, such as exploit attempts on live PHP servers during a coordinated disclosure.
- Private Safety Processing, an automated misuse review. Zero Data Retention API customers generally must use it, and encrypted records stay in customer storage for 30 days.
- IP allowlisting required by default for Daybreak Red API access.
- Critical-system checks that block help which could compromise industrial controls or safety-critical systems.
On scope behavior, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of ExploitGym Honeypot tests without deployment prompts and 100% with them. That test grew out of the Hugging Face incident. OpenAI does not publish a matched Honeypot figure for Astra in the announcement.
Who gets which model?
| Audience | Path |
|---|---|
| Most security teams | Start with mainline GPT-6 Astra for review, triage and patching |
| Verified defenders who want fewer refusals | Daybreak Blue; OpenAI is expanding alpha access for Astra to more organizations and independent researchers |
| Authorized red teams, exploit researchers | Daybreak Red with GPT-6 Cyber, via API and Codex, select customers first |
| Critical infrastructure defenders | Daybreak Red for Critical Infrastructure, a new group with permission for authorized testing of critical systems |
| Resource-constrained public-sector and essential-service teams | The $1 billion Daybreak for Frontline Defenders grant program subsidizes access |
GPT-5.6 Cyber is also becoming available to all Daybreak Red customers. For that comparison, read GPT-6 Cyber vs GPT-5.6 Cyber. Government buyers should also see our report on Daybreak Red in AWS GovCloud.
What are the trade-offs?
Astra with Blue
- Lower barrier to entry and a lighter approval path.
- Covers the daily defensive loop well.
- Will not help with remote exploit development.
GPT-6 Cyber with Red
- Stronger on exploits and on web penetration testing recall.
- Requires approval, network allowlisting and more process.
- Rated Critical, so your own risk team may want extra review before approval.
- Every figure is from OpenAI's own evaluations, and the Honeypot test may be affected by evaluation awareness.
One more point: OpenAI's own first-party results mix models. The 948 Linux kernel exploits came from GPT-6 Cyber, and the 5x comparison baseline was GPT-5.6 Sol, not Astra. Do not read it as an Astra-versus-Cyber result. Our Linux kernel exploit write-up has the details.
How to decide in one meeting
Ask three questions. First, does the work need a working exploit against a live or lab target, or only an understanding of the flaw and a verified fix? Second, can your organization meet the extra controls Red brings, such as IP allowlisting, named owners and written scope? Third, do you have a human who will review every claimed result? If the answer to the first is no, stay on Astra with Daybreak Blue. If all three are yes, apply for Daybreak Red.
Our recommendation
Start on Astra. It handles review and patching, and you learn what your team actually needs. Apply for Daybreak Red only when you have an authorized offensive workflow, such as a red-team engagement or large-scale vulnerability research, that Blue refuses. When you do, put it in a sandbox, require human sign-off, and log every action. If you are weighing the whole market, see our comparison of cyber AI models.
Figures are from OpenAI's November 5, 2026 announcement and may change. This is analysis for security teams, not a procurement recommendation.
A worked example: one vulnerability, two tiers
Imagine a team receives a report of a suspected flaw in a self-hosted Jenkins server it runs.
On the Blue path, an analyst uses GPT-6 Astra to read the advisory, map it to the version in production, and confirm the affected code path. The model helps write a patch or a configuration workaround and then helps validate that the fix holds against the described behavior. The team never needs a working remote exploit. RemoteExploitBench shows that Astra with Daybreak Blue refuses that part, and for this job that is acceptable.
On the Red path, the same team is running an authorized penetration test and needs proof that the flaw is reachable from the network. GPT-6 Cyber can develop and run an exploit against the lab or the approved target. OpenAI's benchmark shows it completing 95% of comparable tasks on Jenkins, GitLab and PostgreSQL in a controlled environment. Here the team needs IP allowlisting, a written scope, and an operator who reviews each action.
Most organizations spend most of their time on the first path. That is the main reason to start with Astra.
Common mistakes when choosing a tier
- Buying Red to avoid refusals on ordinary work. Blue exists for exactly that. Use it for review, triage and fix validation before asking for Red.
- Reading 0.0% as incapable. The Astra figure with safeguards enabled reflects refusal behavior, not skill.
- Treating scores as promises. 48.5% on ExploitGym means the model fails on most tasks of that kind. Plan for a human to confirm every result.
- Skipping the sandbox. OpenAI recommends sandboxing, action review and human oversight for high-risk workflows, whichever model you use.
- Forgetting the audit trail. If an agent acts on a target, you will want a record of what it did and why. A runtime layer can supply that; see GPT-6 Cyber vs AgentBeam.