OpenAI released GPT-6 Cyber on November 5, 2026, a security research model it says pairs stronger capabilities with better alignment. The company said the model powered the Linux kernel research it announced a day earlier, where an agentic run validated and patched 948 privilege-escalation bugs at roughly USD 1.2 million in API cost. Mozilla, Palo Alto Networks and Cisco are already putting it to work alongside OpenAI's own security teams, and the company is presenting it as a production pipeline rather than a demo.
OpenAI rates GPT-6 Cyber as Critical inside its own safety framework. It scores 48.5 percent on ExploitGym, the internal benchmark for exploit development, and leaves its assigned scope less than 1 percent of the time, down from about 5 percent for GPT-5.6 Cyber. That gap between raw capability and staying inside the sandbox is the real pitch. The model finds genuine vulnerabilities without wandering into systems it was never pointed at, which is the failure mode that has kept agentic security tooling out of most engineering roadmaps.
Access starts with select Daybreak Red customers, with wider availability promised over time, and the model is now reachable in AWS GovCloud US-East. For founders the practical read is that agentic vulnerability discovery is becoming a purchasable service rather than a research stunt. Budget for API cost, because volume hunting is metered and a single deep run can burn real money. Review generated patches before merge instead of trusting them outright. The upside is that small security teams can now triage whole classes of bugs that previously required a dedicated research retainer.