OpenAI releases GPT-6 Cyber with customer approval and IP access controls

OpenAI introduced GPT-6 Cyber on November 5, initially limiting API and Codex access to selected approved Daybreak Red customers. The specialist model supports authorized vulnerability discovery and testing whether flaws can be exploited. Security researchers receive a new model under reviewed access rather than an unrestricted public release.

OpenAI reports a 48.5% score on ExploitGym, which tests exploiting a specified vulnerability in a remote target, versus 32.1% for GPT-5.6 Cyber—a 16.4-percentage-point increase. It classifies the new model’s cybersecurity capability as Critical under its Preparedness Framework. That designation describes model capability, not the severity of an individual software bug.

Scope compliance was tested separately. The system card describes difficult exploitation tasks with an auxiliary service that could make success easier if attacked. The service was available for legitimate supporting work but excluded as an attack target. Without deployment safety instructions, GPT-6 Cyber exploited that honeypot in 0.07% of graded runs, compared with 5.51% for GPT-5.6 Cyber.

With deployment instructions, the observed exploitation rate was zero. These are controlled evaluation results. On a separate test where stopping after a tool warning was appropriate, GPT-6 Cyber succeeded 73% of the time, versus Astra’s 78.38%.

Approval extends to projects and network access

The model page requires Daybreak Red access plus specific model approval. It lists a 1,050,000-token context window and 128,000-token maximum output. Standard short-context pricing is $20 per million input tokens, $100 for output and $2 for cached input. Text and images are accepted as input; output is text.

Daybreak’s API guide requires access on the requesting project as well as organizational approval. A request parameter selects behavior within approved access. Red organizations must require single sign-on and identity-provider MFA. GPT-6 Cyber API callers also need an allowlist for their application’s public outbound IP addresses. For approved embedded products, end users without direct model access need not allowlist their own IPs.

OpenAI’s November 4 Linux research used what it then called an upcoming cyber model. In a mid-October run, its pipeline analyzed 2,308 candidates, reproduced 1,724 vulnerabilities and developed 948 local privilege-escalation exploits.

The run cost $1,213,430 in API credits. Candidate patches and findings underwent human review before reporting to maintainers. Generating a patch remains distinct from its acceptance upstream.

Data controls include a requirement for API projects using Zero Data Retention generally to configure Private Safety Processing. PSP encrypts selected interactions in customer-controlled storage for 30 days and runs automated safety review in an environment that disables human access. Its policy covers all API traffic in that project, including other models. With customer-managed encryption enabled, decrypting records also needs the customer’s key authorization. Revoking it prevents decryption but does not delete retained records or reverse completed processing.

OpenAI’s cybersecurity-checks guide says legitimate defensive work may be flagged and access temporarily restricted during review. Trusted Access approval does not configure a customer’s tools, environment or testing scope. OpenAI plans to expand GPT-6 Cyber to all Daybreak Red customers progressively; it gives no fixed completion date.