SafetyPublished Top storyAll news from that day
Ongoing case: Cyber-capable AI models New model · 25 stories
OpenAI rates GPT-6 Cyber Critical for cybersecurity and limits access to approved customers
OpenAI says GPT-6 Cyber, a variant of GPT-6 Astra for authorized security work, produced evidence of 81 high-severity Firefox flaws; only approved Daybreak Red customers have access.
Check our sources · 10 facts from 3 sources
Illustration made with AI for ai notis
Key points
- OpenAI classifies GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber, and announced the model on 5 November 2026.
- OpenAI says GPT-6 Cyber scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, and avoided exploiting out-of-scope services in 99.93% of cases without deployment safety prompts.
- Access is through the API and Codex for approved Daybreak Red customers, with IP allowlisting required by default; OpenAI says it will widen access to all Daybreak Red customers soon.
What happened
OpenAI says its new GPT-6 Cyber model is Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber, and is giving it first to a select group of approved Daybreak Red customers. OpenAI announced the model on 5 November 2026 in a product post and a system card.
On ExploitGym, which tests whether a model can exploit a specified vulnerability, OpenAI says GPT-6 Cyber scores 48.5%, against 32.1% for GPT-5.6 Cyber. In a separate test where easy-to-attack side services sit next to the task, OpenAI says it avoided exploiting out-of-scope services in 99.93% of cases without its deployment prompt, up from 94.49% for GPT-5.6 Cyber.
OpenAI says its researchers used the model to find 81 previously unknown Firefox vulnerabilities that Mozilla classed as high severity, and to develop working exploits for 948 Linux kernel vulnerabilities.
Mozilla's own advisory for Firefox 159, announced on 27 October, credits an OpenAI researcher on several high-impact entries. OpenAI says it disclosed 304 critical Linux findings to maintainers with candidate patches.
Access is through the API and Codex for approved Daybreak Red customers, with IP allowlisting required by default. OpenAI says it will widen access to all Daybreak Red customers soon.
What it means for you
Our viewCritical is OpenAI's own rating under its own framework, and the benchmark scores and the Firefox and Linux findings are OpenAI's accounts of its own evaluations. Mozilla's advisory for Firefox 159 adds that an OpenAI researcher is credited on several high-impact entries.
For most readers nothing changes today, because only approved Daybreak Red customers can use the model. If your security team uses Daybreak Red or plans to, review whether your networks can meet the IP allowlisting requirement before OpenAI widens access.
It adds no new facts.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against these 3 sources.
1 GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents
Open the source archived copy-
OpenAI classifies GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.
citeBased on these results, we classify the model as Critical in cybersecurity under our Preparedness Framework, up from High for GPT‑5.6 Cyber.
-
OpenAI announced GPT-6 Cyber on 5 November 2026.
citeNovember 5, 2026
-
GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, and OpenAI says it will progressively expand access to all Daybreak Red customers soon.
citeGPT‑6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. We will progressively expand access to all Daybreak Red customers soon
-
On ExploitGym, OpenAI says GPT-6 Cyber scores 48.5%, up from 32.1% for GPT-5.6 Cyber.
citeOn ExploitGym, which tests whether models can exploit a specified vulnerability, GPT‑6 Cyber scores 48.5%, up from 32.1% for GPT‑5.6 Cyber.
-
In an alignment evaluation, OpenAI says GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of cases without deployment safety prompts, up from 94.49% for GPT-5.6 Cyber.
citeWhen tested without deployment safety prompts, it avoided exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT‑5.6 Cyber.
-
OpenAI says GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities in Firefox that Mozilla classified as high severity.
citeGPT‑6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity
-
OpenAI says GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 Linux kernel vulnerabilities, and that it disclosed 304 critical findings to maintainers with candidate patches.
citeGPT‑6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948—more than five times the 166 exploited by GPT‑5.6 Sol using the same research harness. Following the Linux community's guidance, we disclosed 304 critical findings to maintainers with candidate patches
-
OpenAI requires IP allowlisting for Daybreak Red API access by default.
citeWe require IP allowlisting for Daybreak Red API access by default, restricting requests to approved networks with limited exceptions.
2 GPT-6 Cyber System Card
Open the source archived copy-
GPT-6 Cyber is a cyber-specialized variant of GPT-6 Astra, and OpenAI gives it the same Preparedness designations as GPT-6 Astra: Critical in Cybersecurity, High in Biological and Chemical, and below High in AI Self-Improvement.
cite
3 Mozilla Foundation Security Advisory 2026-118: Security Vulnerabilities fixed in Firefox 159
Open the source archived copy-
Mozilla Foundation Security Advisory 2026-118, announced 27 October 2026 and fixed in Firefox 159, credits Amy Burnett of OpenAI as reporter on several high-impact entries.
cite
Every sentence above is checked against these 3 sources. Each fact has its own address you can cite.
Source 1 · OpenAI · 5 Nov 2026
GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents
OpenAI classifies GPT-6 Cyber as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.
Based on these results, we classify the model as Critical in cybersecurity under our Preparedness Framework, up from High for GPT‑5.6 Cyber.
GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, and OpenAI says it will progressively expand access to all Daybreak Red customers soon.
GPT‑6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. We will progressively expand access to all Daybreak Red customers soon
Show all 8 factsShow fewer facts
On ExploitGym, OpenAI says GPT-6 Cyber scores 48.5%, up from 32.1% for GPT-5.6 Cyber.
On ExploitGym, which tests whether models can exploit a specified vulnerability, GPT‑6 Cyber scores 48.5%, up from 32.1% for GPT‑5.6 Cyber.
In an alignment evaluation, OpenAI says GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of cases without deployment safety prompts, up from 94.49% for GPT-5.6 Cyber.
When tested without deployment safety prompts, it avoided exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT‑5.6 Cyber.
OpenAI says GPT-6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities in Firefox that Mozilla classified as high severity.
GPT‑6 Cyber produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity
OpenAI says GPT-6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948 Linux kernel vulnerabilities, and that it disclosed 304 critical findings to maintainers with candidate patches.
GPT‑6 Cyber reproduced 1,724 vulnerabilities and developed working exploits for 948—more than five times the 166 exploited by GPT‑5.6 Sol using the same research harness. Following the Linux community's guidance, we disclosed 304 critical findings to maintainers with candidate patches
OpenAI requires IP allowlisting for Daybreak Red API access by default.
We require IP allowlisting for Daybreak Red API access by default, restricting requests to approved networks with limited exceptions.
Source 2 · OpenAI · 5 Nov 2026
GPT-6 Cyber System Card
GPT-6 Cyber is a cyber-specialized variant of GPT-6 Astra, and OpenAI gives it the same Preparedness designations as GPT-6 Astra: Critical in Cybersecurity, High in Biological and Chemical, and below High in AI Self-Improvement.
Source 3 · Mozilla · 27 Oct 2026
Mozilla Foundation Security Advisory 2026-118: Security Vulnerabilities fixed in Firefox 159
Mozilla Foundation Security Advisory 2026-118, announced 27 October 2026 and fixed in Firefox 159, credits Amy Burnett of OpenAI as reporter on several high-impact entries.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep