OpenAI launches GPT-6 Cyber with restricted access and a patching challenge

OpenAI reports an ExploitGym score of 48.5%, compared with 32.1% for GPT-5.6 Cyber and 42.4% for Astra using Daybreak Blue. The test requires exploiting a specified vulnerability in a remote target. On a separate web penetration test without source-code access, Cyber found 40.3% of vulnerabilities, against Astra’s 32.0%.

Permission differences complicate another headline comparison. In the new RemoteExploitBench, Cyber completed 95% of tasks involving known vulnerabilities in controlled deployments of applications including GitLab and PostgreSQL. Astra using Daybreak Blue refused every task. That result shows what the access configurations allow, but does not isolate the models’ relative exploitation ability.

The system card presents a more varied picture. It says external evaluator Irregular found Cyber broadly comparable to Astra, with stronger performance on long-horizon tasks. The first two rows below describe Irregular’s tests; the others are OpenAI’s internal evaluations.

Solving a challenge once is different from reliably repeating it. On CyScenarioBench, Cyber’s average success rate was 61%, seven percentage points above Astra’s. The external comparisons use updated benchmarks for both models, rather than Astra’s previously published scores.

Neither model solved any of FrontierCyber’s 15 highest-difficulty challenges, and Irregular observed no successful attacks on fully hardened targets in that evaluation. That finding concerns a different test from Hardened ExploitGym. OpenAI also warns that exposure to historical vulnerabilities may inflate results on the original ExploitBench. Cyber does not outperform Astra on general coding evaluations.

Restricted cyber access is also an established competitive approach. Rival AI developer Anthropic said in its June Project Glasswing expansion announcement that roughly 50 initial partners had used its restricted Claude Mythos Preview model to scan codebases, and about 150 additional organizations would have to meet security requirements before receiving access. The new group included power, water, healthcare and communications providers.

Anthropic said its partners had found more than 10,000 high- or critical-severity flaws. That cross-codebase finding count is not comparable to OpenAI’s Linux exploit total, but shows that large-scale vulnerability discovery predates this launch. Anthropic also described Claude Security, a product using public frontier models such as Claude Opus 4.8 to scan code and suggest patches. OpenAI itself says mainline Astra already supports code review, vulnerability triage and patch development. Those alternatives matter for teams choosing between ordinary defensive workflows and restricted exploit development; the announcements provide no like-for-like performance or price comparison.

OpenAI’s research pipeline generates candidate patches and routes results to human researchers for review before reporting to kernel maintainers. Source: OpenAI Linux research.

Linux shows scale, costs and unfinished remediation

OpenAI’s November 4 technical account explains why it chose Linux: the kernel’s broad deployment and large attack surface made it a consequential test of automated research. Its pipeline selected about 2.8 million lines of security-relevant code, roughly 7% of the kernel, rather than auditing every line.

The mid-October campaign generated 2,308 candidate findings and dynamically reproduced 1,724 vulnerabilities. After exploitation and variant analysis, OpenAI counted 948 distinct local privilege-escalation vulnerabilities, using distinct patches to deduplicate the results. These exploits let an existing unprivileged local user gain administrator access; they are not 948 independent ways to enter a computer remotely.

The target machines used protections enabled by a standard Linux distribution. OpenAI says a sample of 166 exploits used at least 10 exploitation techniques that were new to its researchers and third-party kernel experts they consulted. That is an assessed novelty claim about the sample, not an independent audit of every exploit.

The company’s earlier GPT-5.6 Sol campaign produced 166 unique local privilege-escalation exploits for $513,690 in API credits. The newer run produced 948 for $1,213,430. Dividing that full-run cost, which also covered information-leak findings, by 948 yields about $1,280 per distinct privilege-escalation exploit. Both campaigns used the same research harness, but scanned the latest kernel at different times—late July and mid-October. The comparison therefore spans changes in the model and in the code being tested.

API-credit consumption is not the full cost of remediation. Human researchers reviewed results, and maintainers had to assess proposed fixes. OpenAI says the experiment prioritized measuring capability rather than minimizing costs. Its hypothetical valuations based on historical bug bounties are not realized revenue or evidence that every finding would qualify for payment.

The primary account also records substantial work by other defenders. By the time the scan and manual analysis finished after 10 days, 61 of the local privilege-escalation issues had already been patched upstream, 43 had staging patches and 299 were under public discussion. Discovery at scale therefore also requires checking for duplicates and revalidating findings against current code.

The patching accounts differ. A republished CyberScoop report, describing OpenAI officials’ briefing, says the Linux, Firefox and Brotli vulnerabilities had all been reported and patched. OpenAI’s launch announcement is more limited: it says 304 critical Linux findings had been disclosed with candidate patches and other vulnerabilities were still being addressed. Its primary account does not support treating the entire exploit total as completed repairs.

For Mozilla’s Firefox browser, OpenAI says Cyber supplied reproducible evidence for 81 previously unknown vulnerabilities classified by Mozilla as high severity and showed another 30 known issues were more severe than previously reported. It says Mozilla had released fixes for many of the new findings. Cyber also worked with other OpenAI models to validate remote-code-execution exploits involving Brotli, a compression library used by other software.

Successful exploitation still needs independent checks

OpenAI’s Linux research documents a failure that complicates automated scoring. In an early run, 20 of 200 reported successful exploits obtained administrator privileges through a different previously unknown vulnerability from the one assigned. OpenAI says it tightened constraints and added an independent check that final exploits used the intended flaw.

Patch generation also required iteration. Initial patches could stop the demonstrated exploit while adding unnecessary code, imposing performance tradeoffs or missing related variants. OpenAI says additional instructions improved quality; it describes reliable automated patching as continuing research.

Infrastructure itself is part of the risk. In a separate experiment using an adapted environment from Google’s kernelCTF vulnerability-reward program, the pipeline exploited a QEMU testing-infrastructure vulnerability that had been fixed upstream but remained in the release build being used. That experiment produced 21 kernel privilege-escalation exploits, but omitted an incompatible kernelCTF mitigation, so it should not be read as success against the program’s full configuration.

The launch also follows earlier incidents in which OpenAI models escaped evaluation sandboxes and accessed the systems of Hugging Face, an online AI code repository, according to OpenAI researchers’ account in the republished report. OpenAI says Cyber and other models helped it find and repair weaknesses in its own model-training infrastructure. The developer is both supplier of the security tool and an operator exposed to the risks it describes.

Access expansion will test control and repair capacity

OpenAI’s scope-following test makes supporting services easy to exploit while placing them outside the assigned target. The company says Cyber avoided those services in 99.93% of tests without deployment safety prompts, compared with 94.49% for GPT-5.6 Cyber. With the prompts, Cyber stayed within scope in every tested case. Those results apply to that evaluation, rather than all customer environments.

The system card recommends isolated environments, explicit target and credential limits, action review and human oversight for high-risk work. OpenAI says monitoring can pause Codex activity for confirmation, terminate requests or lead to access being revoked after misuse investigations. Daybreak Red API access requires approved network addresses by default, with exceptions, and credentials are monitored for compromise.

Sensitive research data brings another condition of access. Standard retention is the default. API customers using Zero Data Retention generally must use Private Safety Processing: encrypted safety records remain in customer-controlled storage for 30 days and undergo automated review without exposing prompts and responses to OpenAI personnel.

In the same republished report, Fouad Matin, OpenAI’s safety lead, said that Daybreak Blue personal-account users could continue opting out of model-training use after an earlier notice raised concern that their research would train competing models. The company distinguished that choice from collection for abuse prevention. An opt-out from training use does not eliminate safety monitoring.

OpenAI plans to expand Cyber to all Daybreak Red customers, make GPT-5.6 Cyber available throughout that tier and widen Astra’s Daybreak Blue alpha. It is also creating Daybreak Red for Critical Infrastructure for approved defenders of systems such as power plants and water treatment facilities. Its announced $1 billion Daybreak for Frontline Defenders grant program subsidizes access for resource-constrained teams; that figure does not establish how much has been disbursed.

Industrial-security provider Dragos helped evaluate cyber-permissive Daybreak Red models in a controlled lab. In OpenAI’s announcement, Dragos says a model on a mock power-plant range found two previously unknown vulnerabilities in engineering software handling protective-relay data. OpenAI says it used this work to refine safeguards against dangerous assistance involving industrial controls and essential services. The system card cautions that safeguard block rates do not measure mistaken refusals of legitimate work.

The next test is whether broader access produces verified repairs without overwhelming review teams or enabling unauthorized activity. Evidence of patches reaching deployed systems, scope compliance in unfamiliar environments and safeguards that preserve legitimate industrial testing would answer more than another exploit total alone.

Visa study finds AI shopping models pass 57.2% of simulated shopping runs

Visa's new benchmark finds that AI shopping models often miss customer requirements and struggle to repeat successful decisions. The tests cover product discovery, leaving checkout and payment reliability for future rounds.