Dek: OpenAI built a model that says yes more often to security researchers, then locked it behind an identity check. The benchmark deltas are real. They're also small.
What GPT-6 Cyber is, and what it refuses to be
OpenAI published the GPT-6 Cyber system card on November 5. The model is a cyber-specialized variant of GPT-6 Astra, tuned for authorized security work: finding vulnerabilities, developing exploits, and testing web applications.
That list is the whole product. OpenAI's pitch isn't that the model knows more about security than its parent. It's that the model stops arguing with people who are allowed to do the work.
The company says specialized post-training improves cybersecurity capability and reduces cyber refusals, while keeping refusals outside cybersecurity intact and keeping the work inside whatever scope the user is authorized for. Read that sentence as a claim about calibration, not about removing guardrails.
Cyber refusals: the behavior change is the headline
The refusal evaluation is the most interesting number in the card, and it isn't a benchmark score in the usual sense. GPT-6 Cyber completed every general security assistance and vulnerability patching task in the test set. That's 100%.
It also completed 96% of exploit development tasks and 97% of red-teaming tasks. OpenAI attributes those numbers to the specialized training, and says refusals outside cybersecurity stay where they were.
So the trade is explicit. More yes on authorized work, same no everywhere else. Whether that line holds in practice is an empirical question, and it's the one every security team will test in their first week.
Different answers, same model.
ExploitGym, ExploitBench, and deltas of a few points
Now the benchmarks, which are less exciting than the refusal numbers and more useful for planning.
ExploitGym measures whether the model can exploit a specified vulnerability on a remote target. GPT-6 Cyber reaches an intended-exploit success rate of 48.45%, against 42.43% for GPT-6 Astra. Six points, on a task where a single success can matter.
The hardened version of the same suite adds address-space randomization, stack canaries, the V8 sandbox and stricter kernel configurations. There the model scores 36.94%, up from 29.69%. That's the largest gap in the card, and the one I'd weight most, because hardened targets are closer to what real systems look like.
Everything else moves by a few points. SEC-Bench Pro, which tests vulnerability discovery in large JavaScript engines including V8 and SpiderMonkey, goes to 87.02% from 85.38%. SRE-Bench, which covers binary reverse engineering across six objectives, goes to 92.84% from 87.98%.
ExploitBench, an internal port using vulnerabilities disclosed between June and August 2026, reports a mean arbitrary code-execution success rate of 42% across V8 and Chrome targets, against 39% for the parent model.
Three points. That's the honest size of this release on that suite, and anyone describing it as a leap is selling something.
Daybreak Red is where the risk actually lands
Access is the part of this launch that will affect most people reading about it, because almost nobody will get it.
GPT-6 Cyber runs through a program called Daybreak Red. That means identity verification, use restrictions, and organizational security requirements: single sign-on, multi-factor authentication, and API IP allowlisting.
If your team uses Zero Data Retention, the card says you'll generally need Private Safety Processing for automated safety review. That's a real architectural constraint, not a checkbox. It means traffic can't simply bypass review on its way to the model.
Put those two facts together and the shape is clear. This isn't a public model with a waitlist. It's a vetted deployment for organizations that can prove who their operators are, where their traffic comes from, and that they can turn a machine off.
The Preparedness call on GPT-6 Astra's cyber variant
Under OpenAI's Preparedness Framework, GPT-6 Cyber carries the same designations as GPT-6 Astra: Critical in Cybersecurity, High in the Biological and Chemical domain, and below High in AI Self-Improvement.
Critical in Cybersecurity is the highest tier the framework has for that domain, and it's the reason for the gate. A model that can find and weaponize flaws at this level is a different category of tool from a chatbot that writes code.
The card also notes that OpenAI worked with NIST's Center for Advancing Innovation and Standards for Super Intelligence on measuring cyber capability, and that Irregular ran separate external evaluations. Two outside parties measuring the same thing is better than one, even when the numbers stay in the same neighborhood.
What security teams should take from GPT-6 Cyber
The capability that finds a bug in a JavaScript engine is the same capability that writes the exploit for it. Nothing in the card separates those two things at the model level. What separates them is the account holder, the scope statement, and the identity check at the door.
So the practical questions for a security team are boring. Can you pass the verification? Do your logging and IP posture meet the requirements? And does a six-point gain on exploit success change how you triage findings from an AI-assisted review?
For everyone else, the takeaway is simpler. GPT-6 Cyber is a specialist release with a narrow door, and its most newsworthy feature is a refusal rate that went down on purpose. A model that can map a vulnerability, write a working exploit for it, and explain the chain in plain language compresses a week of specialist work into an afternoon session, which is exactly why the identity check exists. If you want to follow what happens next, watch the first independent write-ups from teams inside Daybreak Red. They'll be the ones who find out whether the calibration holds when the requests get weird.
