# GPT-6-Cyber

> Source: https://aiwiki.ai/wiki/gpt_6_cyber
> Updated: 2026-11-06
> Categories: AI Models, AI in Cybersecurity, OpenAI, Reasoning Models
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) - attribute to "AI Wiki (aiwiki.ai)"
> Cite as: AI Wiki. "GPT-6-Cyber." aiwiki.ai, 6 Nov 2026. https://aiwiki.ai/wiki/gpt_6_cyber
> From AI Wiki (https://aiwiki.ai), the free encyclopedia of artificial intelligence. Reuse freely with attribution.

**GPT-6-Cyber** is [OpenAI](https://aiwiki.ai/wiki/openai)'s cybersecurity-specialized variant of [GPT-6 Astra](https://aiwiki.ai/wiki/gpt_6_astra), announced on November 5, 2026. It is intended for authorized vulnerability research, exploit validation and security testing. Initial access was limited to selected Daybreak Red customers through the API and [Codex](https://aiwiki.ai/wiki/openai_codex).[1][2]

Its post-training uses reinforcement learning for security tasks and authorization compliance. OpenAI assigns it Critical cybersecurity, High biological and chemical, and below-High AI self-improvement designations under its [Preparedness Framework](https://aiwiki.ai/wiki/preparedness_framework).[2]

## Access and deployment

**GPT-6-Cyber is the model; Daybreak Red is an access program.** Approval for the program does not by itself enable every model or project. The documented setup requires organization approval, additional GPT-6-Cyber approval, project access, and an API key belonging to that project. Daybreak Red organizations must enforce SSO and MFA.[3]

For a Responses API request, the documented selection is `model: "gpt-6-cyber"` with `access_programs.cyber: "daybreak_red"`. That parameter selects an already approved program rather than granting access. The API setup also requires an allowlist for the application's public IP addresses. Approved products can serve end users who do not themselves have direct model access; those users do not have to allowlist their individual IPs.[3]

The November 5 announcement described wider Daybreak Red availability as a planned expansion.[1]

## Model and API capabilities

The model documentation lists the following specifications:[4]

| Property | Documented value |
| --- | --- |
| API model identifier | `gpt-6-cyber` |
| Context window | 1,050,000 tokens |
| Maximum input | 922,000 tokens |
| Maximum output | 128,000 tokens |
| Input | Text and images |
| Output | Text, including reasoning-token support |
| Supported endpoints | Responses and Chat Completions |
| Supported features | Streaming, function calling, structured outputs and prompt caching |
| Unsupported capabilities | Audio, video, Batch and fine-tuning |

Responses API tools include web and file search, hosted shell, apply patch, code interpreter, computer use, skills, MCP and tool search. The image-generation tool is also listed, but that does not make this model a direct Images API model.[4]

### API pricing

The published **standard short-context** text rates are in US dollars per million tokens:[4]

| Token category | Price |
| --- | ---: |
| Input | $20 |
| Cached input | $2 |
| Output | $100 |
| Cache write, 30-minute retention | $25 |
| Cache write, 12-hour retention | $50 |

These rates do not describe long-context pricing or a Batch discount. Tools can incur separate charges.[4]

## Reported cybersecurity evaluations

OpenAI reported these results at launch. They measure different tasks and should be read separately:[1]

| Evaluation | Task | GPT-6-Cyber | Reported comparator |
| --- | --- | ---: | --- |
| ExploitGym | Exploit a specified vulnerability in a remote target | 48.5% | GPT-5.6 Cyber: 32.1% |
| Web penetration testing | Discover vulnerabilities without application source code | 40.3% recall | GPT-6 Astra: 32.0% recall |
| RemoteExploitBench | Develop and use exploits against controlled remote applications | 95% completion | GPT-6 Astra with Daybreak Blue refused every task in the initial evaluation |

The last comparison combines capability and refusal behavior; it is not a measurement of Astra's success rate when it attempts the tasks.[1]

The academic ExploitGym paper describes a benchmark that starts with a vulnerability-triggering input and asks an agent to turn it into a working exploit. Its original 898 instances span userspace programs, V8 and Linux, with different security protections. The May 2026 paper predates GPT-6-Cyber and does not independently verify its November score.[5]

Irregular's updated evaluations produced mixed results: GPT-6-Cyber solved 11/11 CyScenarioBench challenges at least once, versus Astra's 8/11; FrontierCyber results were 90/288 versus 96/288. Neither model solved the 15 hardest FrontierCyber tasks or attacked fully hardened targets successfully.[2]

## Staying within authorized scope

In OpenAI's ExploitGym Honeypot test, attacking a supporting service was outside the assigned scope. GPT-6-Cyber did so in 0.07% of graded rollouts without deployment safety instructions and 0% with them. These observed rates do not guarantee that deployed agents always remain within scope.[2]

API cybersecurity checks operate separately from an application's tool permissions and Codex's sandbox. OpenAI's guidance calls for reviewing sensitive tool actions against the approved scope, enforcing filesystem and network boundaries, retaining audit logs and stopping when action review is unavailable. Suspicious activity can produce a `cyber_policy` error and temporary access restrictions. A stable per-user `safety_identifier` can help limit disruption to the affected user rather than the entire organization.[6]

## Security research applications

A Linux research campaign used an automated pipeline for discovery, reproduction, exploitability assessment and candidate patch generation, followed by human review. The campaign reported 2,308 candidate findings, 1,724 reproduced vulnerabilities and 948 distinct local privilege escalation vulnerabilities with working exploits. Its API-credit cost was $1,213,430. These are pipeline-level results, not a stand-alone model benchmark or an accounting of total engineering costs.[7]

OpenAI's launch announcement identifies GPT-6-Cyber as the model behind that campaign. Candidate patches and vulnerability reports required maintainer review; finding or reproducing an issue is separate from having its fix accepted and deployed.[1][7]

Mozilla's Firefox 159 advisory separately documents fixes for numerous high-severity issues and credits OpenAI researchers or OpenAI Codex Security for individual reports. The advisory is evidence of released fixes, rather than an independent measurement of GPT-6-Cyber's overall performance.[8]

## Data handling and limitations

For Zero Data Retention projects using GPT-6-Cyber, the Daybreak setup requires Private Safety Processing (PSP) and validated storage. PSP applies to all API traffic in that project.[3]

Under PSP, encrypted safety records are written to customer cloud storage for 30 days and reviewed in a protected runtime. Only bounded safety signals and approved operational metadata can leave that review in plaintext. Detailed results are encrypted before storage. This arrangement includes retained encrypted records even though the project uses the Zero Data Retention designation.[9]

ExploitGym varies security protections to measure their effects on performance; its results concern the tested environments.[5] OpenAI cautions against comparing older system-card scores when evaluation methods have changed.[2]

## References

1. OpenAI. [GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents](https://openai.com/index/introducing-gpt-6-cyber/). November 5, 2026.
2. OpenAI. [GPT-6 Cyber System Card](https://deploymentsafety.openai.com/gpt-6-cyber). November 5, 2026. Sections on training, scope, external cyber evaluations and evaluation comparability.
3. OpenAI. [Use Daybreak in the Responses API](https://developers.openai.com/api/docs/guides/daybreak). Access, project configuration, request selection and GPT-6-Cyber setup, accessed November 7, 2026.
4. OpenAI. [GPT-6-Cyber model](https://developers.openai.com/api/docs/models/gpt-6-cyber). Model specifications, endpoint support, tools and standard short-context pricing; [Markdown version](https://developers.openai.com/api/docs/models/gpt-6-cyber.md), accessed November 7, 2026.
5. Wang, Zhun, et al. [ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?](https://arxiv.org/abs/2605.11086). arXiv:2605.11086, May 11, 2026.
6. OpenAI. [Cybersecurity checks](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity). API safeguards, authorization boundaries and access restrictions, accessed November 7, 2026.
7. OpenAI. [A thousand fewer paths to root](https://openai.com/index/a-thousand-fewer-paths-to-root/). November 4, 2026.
8. Mozilla. [Security vulnerabilities fixed in Firefox 159](https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/). Mozilla Foundation Security Advisory 2026-118, accessed November 7, 2026.
9. OpenAI. [ZDR with Private Safety Processing](https://developers.openai.com/api/docs/guides/private-safety-processing). Retention and protected review design, accessed November 7, 2026.