Cybersecurity

OpenAI Keeps Its GPT-6 Cyber Hacking Model to a Hand-Picked Few

Jakob Steinschaden06. November 2026, 21:11

Photo: Andrew Neel / Unsplash

OpenAI has built an A.I. that hacks better than anything it has released before, and that is exactly why it is keeping it on a short leash: The company has introduced GPT-6 Cyber, a model trained specifically to find and exploit security flaws. For now, only selected security firms and penetration testers can use it.

81 New Flaws in Firefox

According to OpenAI, GPT-6 Cyber is a version of its flagship model GPT-6 Astra trained for authorized vulnerability research. OpenAI says it „is a major step up from GPT‑5.6 Cyber and outperforms GPT‑6 Astra on most cyber tasks.“ It is already OpenAI’s fourth cyber-specific model this year.

The numbers OpenAI cites are striking:

Firefox: 81 previously unknown vulnerabilities, which Mozilla rated high severity and has largely fixed, according to SiliconANGLE
Linux: 948 vulnerabilities in the Linux kernel, for which the model also developed working exploits
Brotli: a critical remote code execution flaw in Google’s widely used compression format

OpenAI says all of the flaws were reported to their owners and patched. As with Astra in September, OpenAI rates GPT-6 Cyber „Critical,“ the highest risk tier in its Preparedness Framework. Its predecessor was rated one level lower.

Only for the Inner Circle

For now, the model is available only to customers in Daybreak Red, the tier of OpenAI’s trusted access program for offensive security work such as penetration testing and red teaming. Access runs through the A.P.I. and Codex, and by default only from approved networks. Defenders of critical infrastructure get a group of their own. OpenAI also announced a $1 billion initiative for security professionals who protect systems like power grids and water supplies.

OpenAI is „allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities,“ Eric Wallace, an OpenAI researcher, told TechCrunch. The company is especially keen to stress that the model stays within its mandate. The backdrop is the incident in July, when an OpenAI model broke into Hugging Face’s systems during a test. In an internal test that surrounds the target with deliberately easy-to-compromise services, GPT-6 Cyber went out of scope in only 0.07 percent of runs, according to SiliconANGLE. Its predecessor did so in 5.51 percent.

An Arms Race With Anthropic and Google

OpenAI is not alone in this approach. Google initially gave its flagship model Gemini 4 Argon only to selected cybersecurity partners. Anthropic keeps its hacking model, Claude Mythos, under lock and key and recently rebuilt its program for verified security firms around three access tiers. At the same time, Anthropic warns that the Chinese open-weight model GLM-5.3 builds similar exploits without the safeguards, and anyone can download it.

Defenders Say They Are Held Back

That is where the criticism comes in. Security researchers complain that defenders have to work with restricted models while attackers can turn to open models with no guardrails. Max Justicz, the chief technology officer of Charge Robotics, found a severe flaw in Debian-maintained software through OpenAI’s defensive tier, Daybreak Blue, and says he spent about $5,000 doing so. He calls that access „nerfed.“ „I can only imagine what one could do with more time and access to less neutered models,“ he wrote, according to TechCrunch.

A new data rule in Daybreak Blue has also drawn anger: According to CyberScoop, OpenAI uses data from personal accounts there even when users have opted out. Fouad Matin, OpenAI’s safety lead, says the data is used only to prevent abuse, not for training. And GPT-6 Cyber is not all-powerful either: According to Irregular, a security lab that tested the model in advance, it is broadly comparable to Astra, and neither model got past fully hardened targets.