OpenAI released GPT-6 Cyber, a model built to find and exploit security flaws, to a small group of vetted customers on Thursday, 5 November 2026, and rated it "Critical" in cybersecurity under its safety framework, according to Reuters. The company said the model is meant to help security researchers find vulnerabilities, test how they could be exploited and fix them before attackers do, as attempts to misuse AI by malicious cyber actors increase. It is available to select customers of Daybreak Red, OpenAI's access tier for advanced, authorised security work such as penetration testing, and access will widen to all approved Daybreak Red customers over the coming weeks. The rating is up from "High" for the earlier GPT-5.6 Cyber model.
The argument that this is a useful tool for defenders rests on the results OpenAI reports. Its researchers used the model to find 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity, and Mozilla has begun releasing fixes. It also helped develop working exploits for 948 Linux kernel vulnerabilities, including 588 that were previously unknown, and the company has disclosed 304 critical Linux findings to maintainers together with proposed patches. Access is limited to vetted organisations, and OpenAI is also making GPT-5.6 Cyber available to all Daybreak Red customers from Thursday. Supporters say that attackers will build such tools whatever the rules, so giving defenders a head start on the same technology is the safer path.
The argument for caution is that the same ability that finds a flaw can be used to attack, and that the evidence so far comes from the company itself. OpenAI's own rating of "Critical" is the highest level in its framework, and the company says it is seeing more attempts to misuse AI, including by groups seeking to copy its models. The headline figures are OpenAI's own and have not been independently verified. OpenAI's own security record also draws questions. Reuters reported on 4 November that five people familiar with the matter said employees raised concerns about its security practices for years, and in October federal agents arrested a Saudi national, who was then an OpenAI engineer, for allegedly planting a recording device in an executive conference room. OpenAI said it invests heavily in security.
The launch matters because the software that runs banks, hospitals, governments and phones is full of unknown flaws, and tools that find them quickly change the balance between attackers and defenders. Linux and Firefox are used worldwide, so a flaw found in either affects users in every country. Governments are already preparing, and India's CERT-In this week called for AI agents to be tested for unauthorised tool use and privilege abuse, a sign that regulators expect these systems to be used at scale.
GPT-6 Cyber shows how quickly AI is moving into the centre of cybersecurity, for defence and for risk. Whether it leaves the internet safer will depend on who gets access, how well that access is policed, and whether the results are confirmed outside the company that built it.
