OpenAI Ships GPT-6 Cyber, Rated Critical for Security Work

OpenAI released GPT-6 Cyber, a model built for cybersecurity work, on November 6. According to Zhidx coverage, the model focuses on security research and beats OpenAI's flagship GPT-6 Astra on most cybersecurity tasks. On the ExploitGym security benchmark it scored 48.5%, up about 16 percentage points from GPT-5.6 Cyber's 32.1%. Under OpenAI's preparedness framework, the model is rated Critical for cybersecurity capability, higher than its predecessor's High.

Field results are the core of the release. OpenAI says GPT-6 Cyber has discovered and validated real vulnerabilities in security-critical codebases including Linux and Firefox, and that security teams at Mozilla, Palo Alto Networks and Cisco, along with OpenAI itself, are already using the model. In a new no-source-code web-penetration evaluation, where the model can only probe an application without reading its code, GPT-6 Cyber reached a 40.3% vulnerability recall rate versus 32.0% for GPT-6 Astra. For remote exploitation, OpenAI built RemoteExploitBench on known vulnerabilities in GitLab, PostgreSQL and Jenkins inside controlled environments.

The release order itself carries information. Reports the day before suggested OpenAI might unveil its next-generation flagship by Friday; what arrived first was a vertical model, and developers on social platforms said outright they were waiting for Astra and Sol. Splitting security into its own line and gating it behind certification shows frontier labs are handling dual-use capability with more care — the same model that helps defenders find bugs early also lowers the floor for attackers.

For enterprise security teams, the practical question is access: GPT-6 Cyber is not available in the chat interface and will expand only to vetted customers over time. The defensive gap between teams with the model and teams without it is now opening.