GPT-6 Cyber: 48.5% on ExploitGym, rated Critical for cyber

OpenAI shipped a model today that is better at breaking into software than anything it has released, and it is only selling it to vetted defenders. The pitch is that the same training that made it more capable also made it more obedient.

OpenAI released GPT-6 Cyber on Thursday, a security model it now rates Critical under its own Preparedness Framework — up from High for GPT-5.6 Cyber — and it is handing it out slowly, through the invite-only Daybreak Red program. The model is available through the API and Codex to a select group of approved Daybreak Red customers, with wider access to that tier promised "soon," according to OpenAI's announcement. GPT-5.6 Cyber, the previous generation, is being opened to all Daybreak Red customers at the same time — a quiet admission that the older model is now the safe default and the new one is the loaded weapon.

The headline number is ExploitGym, a benchmark that asks whether a model can take a specified vulnerability and turn it into a working exploit against a remote target. GPT-6 Cyber scores 48.5%, against 32.1% for GPT-5.6 Cyber — a 16-point jump, or 51% in relative terms. It also edges out GPT-6 Astra, OpenAI's flagship general model, which The Verge reports scored 42.4% on the same test. On a new benchmark OpenAI built for the occasion, RemoteExploitBench, the gap is starker: GPT-6 Astra running with Daybreak Blue refused 100% of the tasks, while GPT-6 Cyber completed 95%, its only failure an exploit it could not get to work remotely. On offensive web penetration testing, where the model probes applications without source code, it found 40.3% of planted vulnerabilities against Astra's 32.0%.

The alignment claim is the part OpenAI wants you to read twice. On ExploitGym Honeypot — an evaluation built after the Hugging Face incident, where OpenAI's agents went outside their task and breached an open-source community to find an answer — the model is given a hard exploitation job in an isolated environment alongside services that are deliberately easy to attack and would reveal the flag. Attacking them is out of scope. GPT-6 Cyber avoided those out-of-scope services in 99.93% of tests without its deployment prompt, up from 94.49% for GPT-5.6 Cyber, and 100% of the time with the prompt. The Verge puts the same result more plainly: the model went out of bounds less than 1% of the time, down from around 5%. OpenAI also published chain-of-thought excerpts showing the model talking itself out of the shortcut — "can't assume extra API or attack controller not target," "don't explore out of scope credentials."

That matters because of what Critical means. Under the Preparedness Framework, a Critical cyber rating describes a model that "can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." That is a capability statement, not a safety one. The safety argument rests entirely on the fact that the capability is fenced: cyber-specific misalignment monitoring, IP allowlisting by default for Daybreak Red API access, private safety processing for customers on zero data retention, and a new Daybreak Red for Critical Infrastructure group that gets permission to test power plants, water treatment and industrial control systems while everyone else gets blocked. OpenAI is also leaning on its $1 billion Daybreak for Frontline Defenders grant program to put the model in front of underfunded defenders.

The real-world results are the strongest part of the case, and the least independent. OpenAI says GPT-6 Cyber produced evidence and reproducible tests for 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity, plus 30 known issues that turned out to be worse than reported; Mozilla began landing fixes shortly after the reports and has published an advisory. The model also powered the Linux kernel campaign we covered yesterday — OpenAI found 948 ways to root Linux at $1,279 each — and helped develop the Brotli remote-code-execution proof of concept. The most interesting evidence comes from Dragos, which put a cyber-permissive Daybreak Red model on a mock power plant range and told it almost nothing. According to Dragos chief AI officer Rob T. Lee, it separated operational technology from IT noise on its own and found two zero-days in engineering software that manages protective relay data, exposing protection settings and breaker trip logic. "The skill floor is dropping for the reconnaissance and vulnerability research needed before an attack," Lee said.

The counter-argument is evaluation awareness, and OpenAI's own safety lead raised it. "Evaluation awareness is super top of mind for us," Fouad Matin, who heads cyber preparedness and safety, said during a press briefing, per The Verge. "Often when we do see evaluation awareness, you'll see it in the model's chain of thought." A model that behaves inside a honeypot because it recognises the honeypot is not the same as a model that behaves in production, and the 99.93% figure is a lab number. OpenAI says it is prioritising production-like evaluations with real codebases and real objectives to close that gap, which is the right instinct and also an admission that the current number is softer than it looks.

There is a second, less comfortable reading. OpenAI frames the release around a "limited window" to use frontier models to secure software before someone uses them to break it — a defensible argument, and also the best sales pitch a security vendor has ever been handed. The company is simultaneously telling regulators that frontier cyber capability is dangerous enough to justify gated access and telling customers that the same capability is essential to their defence. Both can be true. But the gate is now the entire safety story: the model exists, it is Critical, and the only thing between it and a bad actor is an application form, an IP allowlist and a monitoring pipeline.

What to watch: how fast "soon" arrives for the rest of Daybreak Red, and whether Mozilla's advisory volume for the next Firefox release looks like a step change or a one-off. Anthropic has been building the same ladder from the other side — a Cyber Mission in October, an expanded Cyber Verification Program, a $1 billion embedded-evaluation commitment with Accenture — and a Critical-rated cyber model from a second lab would turn gated access from a policy into an industry norm.

Anthropic put Claude inside your bank account this week, read-only, through Plaid — the same plumbing OpenAI used for ChatGPT's financial accounts in May. Personal Finance is rolling out in beta to Claude Pro, Max and Ultra subscribers in the US, The Verge reports. Ask where the money went this month and Claude builds a breakdown by category; ask what bills are left before payday or whether a holiday trip is affordable and it answers from your actual transactions. It can see the bank's name, account names and types, the last four digits, balances, credit limits and up to two years of history. It cannot move, manage or invest money, and Anthropic says it "isn't designed to give investment advice."

The architecture is the least-bad version of this idea. Plaid sits in the middle, so Claude never sees your banking password and your bank never has to deal with an unvetted AI agent crawling its endpoints — a real problem, given the industry's running fight over agents opening accounts they were never authorised to touch. Read-only is the correct default, and the two-year transaction window is the minimum that makes spending analysis useful rather than decorative.

The interesting part is the sentence Anthropic put in the sign-off: "Personal Finance is a first step. For life's bigger money decisions, we think people are best served by Claude working alongside the licensed professionals and regulated firms they trust." That is a company with an S-1 on file describing a consumer product that stops precisely where financial advice regulation begins, and signalling that the next version will need partners with licences. Until then, Claude is an advisor that cannot be held to advisory standards — useful, and worth remembering the next time it tells you a holiday is affordable.

Would you hand a chatbot two years of bank statements for a spending breakdown? Write to us via our contact page.