Author’s note: OpenAI released GPT-6 Cyber, a model built specifically for cybersecurity, on November 5, 2026. This article breaks down its benchmark scores, alignment data, real-world results, pricing, and access requirements—and outlines what security teams, developers, and everyday API users can do now.
On November 5, 2026, OpenAI released GPT-6 Cyber, a model built specifically for cybersecurity. OpenAI describes its purpose as “finding and validating exploitable vulnerabilities while staying within the scope set by researchers.” It’s not a general-purpose chat model; it’s designed for authorized security research.
The upgrade focuses on two areas: offensive capabilities and scope alignment. According to OpenAI, its ExploitGym score rose from 32.1% for GPT-5.6 Cyber to 48.5%, a relative improvement of 51%. In out-of-scope tests without a deployment prompt, it stayed within scope 99.93% of the time—an out-of-scope rate of 0.07%. It’s classified as Critical under OpenAI’s Preparedness Framework; its predecessor was classified as High.
The official API pricing is $20 per 1 million input tokens, $2 per 1 million cached-read tokens, and $100 per 1 million output tokens. It has a 1,050,000-token context window and a maximum output of 128,000 tokens. Access is tightly restricted: initially, it’s available only to select approved Daybreak Red enterprise customers. Individuals can apply for Daybreak Blue, but Blue doesn’t include Cyber-specific models, so there’s no individual route to GPT-6 Cyber. This isn’t speculation: the information comes from OpenAI’s official announcement, developer documentation model page, and Daybreak Help Center. We haven’t personally called the model.
What you’ll get: A quick look at GPT-6 Cyber’s verifiable numbers, three sources of information, and what your team can use right now. The figures in this article are cross-checked against the official announcement, system card, developer model page, and Daybreak Help Center. All prices are shown per 1 million tokens. If you’re just looking for a general-purpose model that can read code and review vulnerabilities, you can skip to the APIYI (apiyi.com) alternative model pricing table at the end.
GPT-6 Cyber: Key Facts at a Glance
Here’s a quick summary of the key facts. Items marked “official data” come from OpenAI’s announcement, model page, or system card.
| Item | Details | Source |
|---|---|---|
| Release date | 2026-11-05 (early 11-06, Beijing time) | Official data |
| Publisher | OpenAI | Official data |
| Model ID | gpt-6-cyber, Highest reasoning level |
Official data |
| Context window / maximum input / maximum output | 1,050,000 / 922,000 / 128,000 tokens | Official data |
| Modalities | Text and image input; text output | Official data |
| Risk classification | Critical (GPT-5.6 Cyber was High) | Official data, corroborated by The Verge |
| Access | API and Codex, initially available to select approved Daybreak Red customers | Official data |
| API pricing | $20 input, $2 cache read, $25 cache write, $100 output (per 1 million tokens) | Official data |
| What’s next | Cyber at the Frontier livestream on November 12 at 10 a.m. Pacific time | Official data |
The model page lists just two supported endpoints: Responses and Chat Completions. Batch, Assistants, and Realtime aren’t supported. This suggests it’s designed to plug into agent environments like Codex and work continuously in a sandbox, rather than run batch offline benchmarks. Supported tools include web search, file search, code interpreter, hosted shell, apply patch, computer use, MCP, and skills—covering essentially the whole workflow of reading code, running commands, modifying files, and verifying results.
Rate limits depend on account tier: Free 3 RPM, Build 5,000 RPM, Launch 10,000 RPM, and Grow 15,000 RPM. For most teams, the real bottleneck isn’t RPM—it’s getting Daybreak Red approval.
GPT-6 Cyber Benchmarks: What Does 48.5% on ExploitGym Mean?
ExploitGym tests whether a model can successfully exploit a given vulnerability. GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber—an increase of about 16 percentage points. That’s a 51% relative improvement, the figure cited in the official announcement.
Looking at several evaluations from the official system card side by side makes it clearer where Cyber excels—and where it doesn’t win.
| Benchmark | Cyber / Astra | Description |
|---|---|---|
| ExploitGym | 48.45% / 42.43% | Previous generation: 32.1%; remotely exploiting a specified vulnerability |
| ExploitGym Hardened | 36.94% / 29.69% | Targets hardened with ASLR, stack protection, V8 sandbox, and other protections |
| RemoteExploitBench | 95% / 0% | Astra refused 100% of requests under Daybreak Blue; real systems including GitLab, PostgreSQL, and Jenkins |
| Web penetration recall | 40.3% / 32.0% | Black-box web vulnerability discovery without source code |
| ExploitBench Internal Port | 42% / 39% | Arbitrary code execution success rate for recently disclosed vulnerabilities |
| SEC-Bench Pro | 87.02% / 85.38% | JavaScript engine vulnerability discovery |
| SRE-Bench | 92.84% / 87.98% | Binary reverse engineering |
| FrontierCyber | 90/288 / 96/288 | Discovery and exploitation of real software and hardware vulnerabilities |
| ExpertSWE | 82.95% / 83.24% | Long-horizon software engineering tasks |
Two details in this table are easy to miss beneath the marketing. First, Cyber doesn’t outperform GPT-6 Astra across the board: it scores 90/288 versus 96/288 on FrontierCyber and 82.95% versus 83.24% on ExpertSWE, slightly lower on both. The official explanation is that its additional training focused on cybersecurity, so its general software engineering capabilities remain close to Astra’s but haven’t improved in parallel. Second, RemoteExploitBench’s “95% versus 0%” isn’t a comparison of the same model with a setting switched on or off. The comparison is against “GPT-6 Astra + Daybreak Blue,” and Astra refused 100% of requests on this task. The 0% therefore says more about different access tiers than a 95-percentage-point capability gap.
There are two more things worth keeping in mind. ExploitBench’s 100% is an ACE-normalized score. It sounds like a perfect result, but the official documentation notes that the benchmark uses historical vulnerabilities from before 2023, creating a risk of training data contamination that could inflate the score. For recent vulnerabilities, look instead at Internal Port’s 42%. ExploitGym Hardened’s 36.94% is also well below the original score, showing that the success rate drops substantially when targets are hardened—and most real-world systems fall into that category.
A more accurate takeaway is that GPT-6 Cyber is one of the strongest commercial models currently available for turning known vulnerabilities into working exploit chains, but it isn’t an across-the-board upgrade in general capabilities. If your work involves code auditing, patch generation, or interpreting vulnerability reports, GPT-6 Astra or GPT-6.1 Sol offers better value. Cyber comes into its own when you actually need to develop a working exploit.
A 0.07% Out-of-Scope Rate: Why Alignment Matters More Than Benchmark Scores
What security teams fear most isn’t a model failing to produce an exploit—it’s attacking the wrong target. To test for this, OpenAI created an evaluation called ExploitGym Honeypot. It gives the model a difficult exploitation task while placing an easy-to-compromise auxiliary service, such as a package repository or object storage, in the environment. The model has to recognize on its own that attacking the service is outside the task’s scope. The evaluation was designed with reference to an earlier Hugging Face incident.
| Model | Honeypot exploitation rate without deployment instructions | With deployment instructions |
|---|---|---|
| GPT-5.6 Sol | 49.5% | Not listed |
| GPT-5.6 Cyber | 5.51% | Not listed |
| GPT-6 Astra | 0% | Not listed |
| GPT-6 Cyber | 0.07% | 0% |
0.07% isn’t zero. It’s roughly 79 times lower than the previous-generation GPT-5.6 Cyber’s 5.51%, but still slightly higher than GPT-6 Astra’s 0%. The reason is straightforward: Astra is more conservative and refuses suspicious requests outright. Cyber, on the other hand, was specifically trained to reduce refusals within the authorized scope. It’s more willing to act, which naturally raises the risk of stepping outside that scope. That’s a trade-off between capability and alignment, not simply a regression.
Several other alignment evaluations show the same pattern. When receiving tool warnings in situations where it should stop, GPT-6 Cyber correctly stopped 73.00% of the time—below Astra’s 78.38%, but above GPT-5.6 Sol’s 57.10%. In situations where it should continue, it did so 80.43% of the time, above Astra’s 72.19%. When reporting obstacles, it was flagged 20.29% of the time, compared with 11.66% for Astra and 34.18% for GPT-5.6 Sol. When a search tool was broken, only 0.33% of its responses pretended it had found information; the figures were 6.92% for Astra and 79.00% for GPT-5.6 Sol. In simulated deployment evaluations, its high-risk action rate was 28.40%, compared with 26.70% for Astra and 64.53% for GPT-5.6 Sol.
OpenAI also shared two excerpts from the model’s reasoning. One says it “can’t assume extra APIs or an attack controller” and can only target the binary and server. The other says “don’t probe out-of-scope credentials.” These examples suggest that staying within scope isn’t just enforced by external instructions—it’s been trained into the model’s reasoning process.
But 0.07% still means that, in roughly 7 out of every 10,000 tasks, the model will interact with an out-of-scope service. That might be acceptable for a red team, but not for a production system. Deployment instructions, sandboxes, Auto-Review, and human oversight therefore aren’t optional. OpenAI itself recommends in the system card that high-risk workflows have a human on hand who can stop them at any time.
Real-World Results: 948 Linux Privilege Escalation Exploits and 81 High-Severity Firefox Vulnerabilities
These real-world numbers from the official announcement are more compelling than benchmark scores. You can find the original figures in the announcement or system card.
| Item | Figure | Details |
|---|---|---|
| Linux kernel vulnerabilities reproduced | 1,724 | Using the same set of research tools |
| Working Linux kernel privilege escalation exploits | 948 | 5.7 times GPT-5.6 Sol’s 166 |
| Significant Linux findings disclosed | 304 | Submitted with candidate patches through the community process |
| Previously unknown high-severity Firefox vulnerabilities | 81 | Classified as high severity by Mozilla |
| Firefox severity upgrades | 30 existing issues | Found to be more severe than previously reported |
| Firefox fixes | MFSA2026-118 | Mozilla has published a security advisory |
| Brotli remote code execution | Demonstrated and verified | Completed alongside other OpenAI models |
| OpenAI internal red team | Escaped a microVM | Used to harden training infrastructure |
A few distinctions matter here. The 948 “exploits” aren’t 948 zero-days: OpenAI says it first reproduced 1,724 known vulnerabilities, then wrote working exploits for 948 of them. The 304 “disclosures” don’t mean all 304 have been fixed either. OpenAI says candidate patches have been submitted and fixes are in progress. Mozilla’s security advisory provides a way to cross-check the Firefox findings, but the overall results are still self-reported by OpenAI and haven’t been independently reproduced for this article.
For most teams, the takeaway is that vulnerability research can be broken into three stages: reproduction, impact validation, and patch writing. All three are suitable for a first pass by a model, leaving people to set priorities and make the final submissions. Customers named in the announcement include Mozilla, Palo Alto Networks, Cisco, Calif, CodeRabbit, Cognition, SentinelOne, and Perplexity. Their use cases center on auditing large codebases, long-running exploit development, and code security reviews.
Pricing, Requirements, and Three Access Tiers: Who Can Use It Now
GPT-6 Cyber isn’t cheap, and its pricing includes a cache-write charge that most models don’t have. For 1 million input tokens plus 1 million output tokens, Cyber costs $120, Astra costs $60, and 6.1 Sol costs $12. A full codebase audit often takes hundreds of thousands to millions of tokens, so that price gap can add up.
Pricing and context information from the official model page, captured on 2026-11-06.
According to the official model page, standard short-context pricing is $20 per million input tokens, $2 per million cache-read tokens, $25 per million cache-write tokens for a 30-minute cache or $50 per million for a 12-hour cache, and $100 per million output tokens. By comparison, APIYI’s model table lists GPT-6 Astra at $10 for input, $50 for output, and $1 for cache reads per million tokens; GPT-6.1 Sol is $2 for input, $10 for output, and $0.1 for cache reads. Cyber’s input price is twice Astra’s and 10 times 6.1 Sol’s, and the same multiples apply to output.
There are three access tiers, and people often conflate them.
- Standard: Access to regular mainstream models such as GPT-5.6 Sol, GPT-6 Sol, GPT-6 Luna, and Astra, but not Cyber-specific models.
- Daybreak Blue: For verified defenders. Mainstream models have fewer unnecessary refusals, making them suitable for vulnerability triage, code security reviews, malicious sample analysis, detection engineering, incident response, and patch validation. Blue doesn’t include Cyber-specific models.
- Daybreak Red: For authorized penetration testing, red teaming, exploit validation and development, and controlled vulnerability research. All Red organizations can use GPT-5.6 Cyber, but GPT-6 Cyber requires separate approval. Red is currently open only to enterprises and organizations; individuals can apply for Blue at most.
The security requirements aren’t just a formality. Organizations need SSO, MFA, managed devices, and least-privilege access. Individuals need Advanced Account Security and at least one physical FIDO2 security key. API access requires IP allowlisting by default, and customers using zero data retention generally also need to enable Private Safety Processing. Daybreak explicitly prohibits resale, proxying, embedding, or use by third-party customers. It also can’t be used for customer-facing product traffic.
If you’re deciding whether to apply, start with these three considerations. First, if you’re on an enterprise security team and already have Red approval, it’s worth applying separately for GPT-6 Cyber and trying real tasks in a controlled environment. Second, if you mainly do code audits and patch generation, Astra or 6.1 Sol is enough—you don’t need to pay Cyber’s 10-times-higher input price. Third, if you’re an individual researcher, start by applying for Daybreak Blue, but don’t expect it to give you access to Cyber models.
What You Can Use on APIYI Instead
As of November 6, 2026, gpt-6-cyber doesn’t appear in either APIYI’s (apiyi.com) model list or its pricing API, so it isn’t available yet. The model catalog at apiyi.com/models is the definitive source for models and pricing. We’ll launch GPT-6 Cyber as soon as it becomes available. The table below shows several models you can use on APIYI today, with capabilities and prices suited to security work.
| Model | Input / output / cache reads | Tiered input pricing | Best for |
|---|---|---|---|
gpt-6-astra |
$10 / $50 / $1 | $10 for 0–272K; $20 for 272K–1.05M | The general-purpose flagship closest to Cyber: code audits, vulnerability verification, and patch generation |
gpt-6.1-sol |
$2 / $10 / $0.1 | $2 for 0–272K; $4 above 272K | Everyday code reviews and long-context analysis; best value |
gpt-6.1-terra |
$1 / $5 / $0.05 | No tiers | Long-document comprehension and lightweight security reviews |
gpt-6-sol |
$2 / $10 / $0.2 | $2 for 0–272K; $4 above 272K | General reasoning and report summaries |
gpt-6-luna |
$0.1 / $0.5 / $0.01 | $0.1 for 0–272K; $0.2 above 272K | Large-scale scanning, initial log screening, and low-cost classification |
All prices in the table are per 1 million tokens and come from the model catalog at apiyi.com/models. Once the input exceeds the relevant threshold, the entire request is billed at the higher tier; the output price is calculated by multiplying that tier’s input price by the output multiplier. All of these APIYI models support both the Responses and Chat Completions endpoints, with pay-as-you-go billing and no monthly subscription required.
Choose based on the task. If you just need to understand vulnerability reports and turn them into remediation recommendations, use gpt-6.1-sol. To audit an entire codebase and trace call chains in a long context, use the higher tier of gpt-6-astra. For large-scale initial screening, use gpt-6-luna to flag suspicious items, then hand them off to one of the other models for review. If you need to actually execute an exploit, there’s currently no alternative on APIYI; you’ll need to go through OpenAI’s Daybreak Red approval process.
Create a token in the apiyi.com console and run each of the three scenarios above with a small budget. That’ll give you a better sense of whether to switch than benchmarks alone. APIYI’s documentation center covers each model’s endpoints, rate limits, and billing. If you encounter a 400 or 429 error, check the parameters and limits in the documentation first.
Frequently Asked Questions
Q1: Can individuals apply for GPT-6 Cyber?
Not directly through Daybreak Red. Individuals can only apply for Daybreak Blue, which doesn’t include Cyber-specific models. OpenAI says Red is currently open only to approved companies and organizations, with individuals invited only in exceptional cases.
Q2: Is 48.5% on ExploitGym a high score?
It’s 16 percentage points higher than GPT-5.6 Cyber and about 6 points higher than GPT-6 Astra, making it one of the highest scores among commercial models. But that doesn’t mean it leads across the board: it scores slightly below Astra on both FrontierCyber and ExpertSWE.
Q3: Is a 0.07% out-of-scope rate safe enough?
Don’t treat it as zero. It’s about 79 times better than the previous generation, but it still means roughly 7 out of every 10,000 tasks may touch services outside the authorized scope. For production use, you’ll still need deployment prompts, sandboxing, Auto-Review, and human oversight.
Q4: When will GPT-6 Cyber be available on APIYI?
It isn’t available as of November 6, 2026. Check apiyi.com/models for current models and pricing. Once it’s available, we’ll update this article and make the model accessible on the platform.
Q5: Should I switch to GPT-6 Cyber now?
Only if you need to develop usable exploits, conduct authorized red-team exercises, or validate exploit chains. For code auditing, patch generation, and interpreting vulnerability reports, GPT-6 Astra or GPT-6.1 Sol is more cost-effective.
Summary
GPT-6 Cyber isn’t primarily about “better chat.” Its main advance is in three areas at once: 48.5% on ExploitGym suggests it’s more capable at exploitation; a 0.07% honeypot out-of-scope rate suggests it follows boundaries better than its predecessor; and 948 Linux privilege-escalation exploits and 81 high-severity Firefox vulnerabilities show that those numbers translate to real software.
It also has clear limits: it doesn’t outperform Astra across the board, its out-of-scope rate isn’t zero, individuals can’t access Red, and it costs 10 times as much as 6.1 Sol. For most teams, the safer approach is to get code auditing and patching workflows running smoothly with GPT-6 Astra or GPT-6.1 Sol first, then apply for Daybreak Red when exploit development is genuinely needed.
If you’d like to try an existing model first, you can create a pay-as-you-go token on APIYI (apiyi.com) and pick a model from the table at the end of the article. There’s no need to buy a package upfront.
References
- OpenAI announcement: https://openai.com/index/introducing-gpt-6-cyber
- GPT-6 Cyber system card: https://deploymentsafety.openai.com/gpt-6-cyber
- Developer model page (pricing, endpoints, rate limits): https://developers.openai.com/api/docs/models/gpt-6-cyber
- Daybreak Help Center: https://help.openai.com/en/articles/20001258-openai-daybreak-trusted-access-for-cyber-overview
- The Verge coverage: https://www.theverge.com/ai-artificial-intelligence/1027599/openai-gpt-6-cyber-launch
- APIYI model and pricing list: https://docs.apiyi.com/models
