The News, Explained
OpenAI announced GPT-6 Cyber on November 5 for authorized security research. The model specializes in finding software vulnerabilities and checking whether they can be used. It starts in the API and Codex for a select group of organizations in Daybreak Red, OpenAI’s restricted security access program. Red approval alone does not grant access to GPT-6 Cyber. Source Source
The help center distinguishes eligibility for GPT-5.6 Cyber across Red organizations from separate approval for GPT-6 Cyber. Individuals can apply for Daybreak Blue, but cannot currently apply directly for Red through the individual process. The system card describes controls such as identity checks, multi-factor authentication and limiting API access to approved internet addresses. Source Source
OpenAI rates GPT-6 Cyber’s cybersecurity capability as Critical under its own preparedness framework. On its test of whether models could make use of a specified vulnerability, GPT-6 Cyber scored 48.5%, versus 32.1% for GPT-5.6 Cyber. That measure describes capability; the company tested adherence to authorized scope separately. Source Source
In an isolated scope test, OpenAI checked whether the model left services unrelated to the assigned task alone. It reports 99.93% adherence without the instructions used in deployment and 100% with them. Those results describe the test environment, so they do not guarantee the same rates across real organizations and systems. Source Source
OYOPICK’s Take
Finding more vulnerabilities can help defenders when the security team has clearly specified which systems it is allowed to test. Permission to use a model and permission to test a particular system are separate. Alongside benchmark scores, we would look for field examples where people can review the findings and spot and stop actions outside the agreed scope. Source Source