GPT-6 Cyber: OpenAI's Best Exploit Model, at 10x the Price of Sol

The Takeaway

GPT-6 Cyberis OpenAI's strongest published cyber model and its most expensive, most gated API model. On OpenAI's own numbers, self-reported by OpenAI, it scores 48.5% on ExploitGym (GPT-6 Astra 42.4%, GPT-5.6 Cyber 32.1%) and completes 95% of remote exploit tasks that Astra refuses outright. The headline change is scope discipline: 99.93% in-scope on OpenAI's honeypot test. At $20 / $100 per 1M tokens it costs 10x GPT-6.1 Sol and 2x Astra, and it sits behind Daybreak Red plus a separate model approval, rolling out first to a select group. Most security teams should keep Sol or Astra under Daybreak as the default and reserve GPT-6 Cyber for authorized exploit development and remote testing.

On November 5, 2026 OpenAI released the API model gpt-6-cybervia the API and Codex. Docs tagline: investigate a vulnerability, reproduce it in an authorized test environment, or verify a fix. Announcement subtitle: a cybersecurity model trained to find and validate exploitable vulnerabilities, while staying within the scope that researchers set. See OpenAI's announcement and model page.

Who gets it first: a select group of approved Daybreak Red customers. OpenAI says access expands to all Daybreak Red customers "soon," with no date. ChatGPT availability is not mentioned.

At a Glance

What the Benchmarks Say

Every score below is self-reported by OpenAIunless marked as Google's. None of these numbers has been independently verified by third parties or by LLM Stats. OpenAI says full results and evaluation settings are in a system card that was not yet available at publication.

Exploitation

On ExploitGym, OpenAI self-reports GPT-6 Cyber at 48.5% versus GPT-5.6 Cyber 32.1% (+16.4 points; OpenAI calls it a 51% relative improvement) and versus GPT-6 Astra 42.4% (+6.1, from OpenAI's Astra launch table, run without the 6-hour limit). GPT-5.6 Sol sits at 30.3% on that same Astra table.

On RemoteExploitBench (new OpenAI benchmark; known vulnerabilities in applications such as GitLab, PostgreSQL and Jenkins in a controlled environment), GPT-6 Cyber completed 95%; Astra refused 100%. Its one failure was an exploit it could not get working remotely. The 95% vs 0% gap is a permissions gap as much as a capability gap: public Astra is built to refuse that work.

Discovery

Offensive web penetration testing (new OpenAI-built eval; models probe black-box web apps without source code): recall 40.3% for GPT-6 Cyber versus Astra 32.0% (+8.3). No outside results.

Staying in scope

On ExploitGym Honeypot, GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without the deployment prompt versus 94.49% for GPT-5.6 Cyber; 100% with the deployment prompt. Out-of-scope rate: 0.07% vs 5.51%. OpenAI ties the gain to dedicated training to stay within authorized scope; the eval was informed by the Hugging Face incident.

In the field

OpenAI-reported counts, not benchmarks. Linux kernel: 1,724 vulnerabilities reproduced, working exploits for 948 versus 166 for GPT-5.6 Sol on the same harness (about 5.7x), with 304 critical findings disclosed with candidate patches. Firefox: 81novel high-severity vulnerabilities (Mozilla's classification) plus 30known issues shown to be more severe; Mozilla is shipping fixes. Agents using GPT-6 Cyber and other OpenAI models escaped microVMs in OpenAI's own controlled red-team campaigns, and OpenAI used the findings to patch its infrastructure.

Customer figures, attributed only: Cognition's Steven Hao cites 23% versus a previous best of 13% on Cognition's internal benchmark. CodeRabbit's Harjot Gill cites 66% more high and medium severity security issues than its production model. Calif's Thai Duong: "the best model we've used so far for long running exploit development tasks." Users named by OpenAI include Cisco, Calif, CodeRabbit, plus quotes from Firefox, Palo Alto Networks, SentinelOne, and Perplexity.

Against Gemini 4 Carbon

Google self-reports Gemini 4 Carbon at 53.5% on ExploitGym with a 6-hour cap and 54.8%with a 10-hour extended cap, on Google's harness with mitigations off (Google announcement). That is 5.0 to 6.3 points above GPT-6 Cyber's 48.5%, but the two labs ran different harnesses and OpenAI does not state GPT-6 Cyber's time limit, so this is not a head-to-head. Both labs' charts list GPT-6 Astra at 42.4%. Carbon is limited to vetted defenders through Google's Fairwind Program and has no public API, model page or date. See our Carbon launch post.

Caveats for this section: all scores self-reported; time limit, effort and token cap for GPT-6 Cyber's ExploitGym run not stated; the Astra comparison comes from a different OpenAI post; two of four evals are new and OpenAI-built; the system card with settings was not yet available.

Pricing

Standard short-context list prices per 1M tokens. Sources: OpenAI pricing and Google's Carbon announcement.

GPT-6 Cyber is 10x Sol, 2x Astra, and 1.6x input / 1.33x outputversus GPT-5.6 Cyber with 2.6x the context. Cache writes cost $25 per 1M for 30 minutes or $50 for 12 hours. OpenAI lists short-context prices only (no rate above 272K input tokens even though max input is 922K). Batch is supported but OpenAI lists no Batch price. Per-token price is not per-task cost, and OpenAI published no cost-per-task data. Palo Alto Networks' quote calls it "more cost-effective"; no figure was given. Predecessor framing: our GPT-5.6 Cyber launch post. Peer mainline pricing: GPT-6.1 Sol and GPT-6 Astra.

Access and Gating

Docs: "Your organization needs Daybreak Red access and approval to use GPT-6-Cyber. Your account team can confirm access." The Daybreak guide lists approval as Red plus additional model approval. Requests send access_programs.cyber = daybreak_red, and OpenAI's example includes a pseudonymous safety_identifier.

Rollout: initially available through the API and Codex to a select group of approved Daybreak Red customers; expanding to all Daybreak Red customers "soon" with no date. GPT-5.6 Cyber is now available to all Daybreak Red customers. Daybreak Blue alpha access for GPT-6 Astra is expanding. ChatGPT availability is not mentioned.

Setup: the org with Cyber access must require SSO and enforce MFA through its identity provider. An org owner enables Daybreak Red for the project, using a non-default project and its key. An IP allowlist is required for API use (end users of an approved embedded product need not allowlist). ZDR projects must set up Private Safety Processing (PSP reviews encrypted records kept in customer storage for 30 days without exposing prompts and responses to OpenAI staff).

Programs: a $1 billion Daybreak for Frontline Defenders grant program for resource-constrained teams such as government organizations and essential service providers, plus a new Daybreak Red for Critical Infrastructure group. Dragos ran OT evaluations with OpenAI. Apply at openai.com/daybreak.

Safeguards OpenAI lists: cyber-specific misalignment monitoring, targeted threat monitoring, credential-compromise monitoring, IP allowlisting by default, recommended sandboxing, action review and human oversight, and new checks on high-risk activity against critical systems such as power plants and water treatment.

Should You Use It? A Decision Guide

Key fact: reduced refusals on GPT-6.1 Sol and GPT-6 Astra already require Daybreak Red access (requests still send daybreak_blue), so a Red-approved team can run Sol at $2 / $10 without the extra Cyber approval.

• Code review, triage, patching, detection engineering: GPT-6.1 Sol or Astra, under Daybreak Blue or Red. Cyber is overkill at 10x Sol's price.
• Exploit development, exploit validation against remote targets, long-running red-team engagements: GPT-6 Cyber, if you are Red-approved and get the model approval. This is the work public Astra refuses.
• Already on GPT-5.6 Cyber: test GPT-6 Cyber on your own engagements; budget for 1.6x input and 1.33x output; gain 1.05M context. GPT-5.6 Cyber stays available to all Red customers, so there is no forced migration date.
• Not in Daybreak: you cannot use it. Apply, or use mainline models with standard safeguards.
• Waiting on Gemini 4 Carbon: there is no API to evaluate yet.
• Migration notes: one undated snapshot (behavior can change under the alias); reasoning effort levels are not published; IP allowlisting and SSO must be in place before the first request; ZDR requires PSP.

Caveats

• All numbers are self-reported by OpenAI (Carbon: self-reported by Google).
• OpenAI says full results and evaluation settings are in a system card that was not yet available at publication.
• ExploitGym time limit, effort and token cap for GPT-6 Cyber are not stated.
• Cross-lab Carbon numbers come from a different harness and are not directly comparable.
• Web pentest and RemoteExploitBench are new OpenAI-built evals with no outside results.
• Knowledge cutoff and reasoning effort levels are not published.
• No long-context or Batch price is listed.
• Access is limited to a select group, with no date for broader Red rollout.
• Single undated snapshot.

FAQ

Outlook

The story here is permissioned capability plus scope discipline, not a leaderboard. Watch: whether the system card that was not yet available at publication lands with its evaluation settings; the rollout to all Daybreak Red customers; whether OpenAI publishes long-context and Batch prices; independent ExploitGym reruns that put OpenAI and Google on one harness; Carbon's API. Do not treat any of those as dated promises.