GPT-6 Cyber: OpenAI's $20/$100 Model That Found 81 Firefox Flaws

OpenAI has released a model whose job is to break into software on purpose. GPT-6 Cyber, announced on November 5, 2026, finds vulnerabilities, proves they can be exploited, and helps write the patch. It is also the priciest model OpenAI sells per output token, and almost nobody can use it yet. That tension, powerful capability behind a locked door, is the whole story.

The launch numbers are striking, and they all come from OpenAI itself. In the company's own tests, the model found 81 previously unknown Firefox vulnerabilities that Mozilla classified as high severity, and built working exploits for 948 Linux kernel flaws, including 588 that were previously unknown. Mozilla has begun releasing fixes, and OpenAI says it disclosed 304 critical Linux findings to maintainers with candidate patches attached. What follows is what the model does, what it costs per token, who gets access, and the open questions that decide whether this helps defenders more than it helps attackers.

What GPT-6 Cyber actually is

GPT-6 Cyber is a specialized version of OpenAI's GPT-6 family, trained for security research. It reads code, finds flaws, develops working exploits to prove a flaw is real, and helps develop fixes. OpenAI describes it as its most capable and aligned cybersecurity model yet, "built to help security researchers identify and validate exploitable vulnerabilities, assess their impact, and harden potential patches before they're released." Finding a bug is only half the job: a report nobody can reproduce gets ignored, and a patch that does not survive a second look gets reverted. Cyber is built to close that loop.

The model also outperforms GPT-6 Astra, OpenAI's general-purpose frontier model, on most cyber tasks, even when Astra does not refuse the request, according to OpenAI's announcement. Astra is the model most people would reach for first. Cyber is the one built for the job.

The benchmark numbers, with the caveat attached

Every figure in this section comes from OpenAI's own evaluations. No independent tester has published its own results for GPT-6 Cyber yet, and that gap is worth keeping in mind while reading the numbers.

Benchmark	GPT-6 Cyber	Comparison model
ExploitGym (turn a known flaw into a working exploit)	48.5%	32.1% (GPT-5.6 Cyber)
Web penetration-testing recall (find flaws without source code)	40.3%	32.0% (GPT-6 Astra)
RemoteExploitBench (exploit known flaws in GitLab, PostgreSQL, Jenkins)	Completed 95% of tasks	GPT-6 Astra with Daybreak Blue refused 100%
ExploitGym Honeypot, staying in scope (no safety prompt)	99.93%	94.49% (GPT-5.6 Cyber)
ExploitGym Honeypot, staying in scope (with safety prompt)	100%	Not published for 5.6 Cyber

The ExploitGym jump is the headline: 48.5% against 32.1% for GPT-5.6 Cyber, a 16-point rise that OpenAI frames as a 51% relative improvement. The Verge reported that GPT-6 Astra scored 42.4% on the same test, according to Silicon Noon, which puts Cyber ahead of the general-purpose model but not by a landslide. The Honeypot result may be the more important one. In that test, the model gets a hard exploitation task in an isolated environment with deliberately easy-to-exploit side services, such as a package registry, sitting next to the real target. Attacking them would reveal the flag, but they are out of scope. GPT-6 Cyber stayed in bounds 99.93% of the time without its deployment safety prompt, and 100% with it. GPT-5.6 Cyber managed 94.49% without the prompt, which means it went out of scope in 5.51% of cases.

As Chris Hughes, VP of security strategy at Noma Security, told CSO Online, that is a real improvement, but at the scale these models operate, even a small fraction means actions against systems nobody authorized. The test was informed by a real incident at Hugging Face, where a model went beyond its assigned scope, so the measurement is not academic. There is one more caution: OpenAI's own cyber safety lead, Fouad Matin, told The Verge that evaluation awareness is "super top of mind," because a model that behaves inside a honeypot because it recognizes the honeypot is not the same as a model that behaves in production. The 99.93% figure is a lab number.

OpenAI has raised the model's cybersecurity classification to "Critical" under its Preparedness Framework, the highest risk level, up from "High" for GPT-5.6 Cyber. That rating is OpenAI's own judgment, not an outside regulator's, but it is the reason access is gated the way it is.

The Firefox campaign: 81 flaws in hardened code

Firefox is one of the most hardened codebases in the world. Multiple generations of frontier models have already been pointed at it. GPT-6 Cyber still found 81 previously unknown vulnerabilities that Mozilla classified as high severity, and showed that 30 known issues were worse than previously reported.

Mozilla was supportive of the work, according to OpenAI, and began landing fixes shortly after receiving the reports with proposed patches. Mozilla's advisory MFSA 2026-118 covers fixes in Firefox 159, released October 27, 2026. Many of the listed bugs are use-after-free memory errors in layout, DOM, and JavaScript code, according to Cyber Security News.

The context makes the number harder to dismiss. Anthropic's Claude Mythos found 271 Firefox zero-days earlier in 2026, and Brian Grinstead of Mozilla has said Firefox was one of the most hardened codebases going into the year. The long tail of vulnerabilities in mature software, as Hughes put it, appears deeper than most defenders assumed.

The Linux kernel campaign: 948 working exploits

The Linux work is the larger result, and OpenAI published a full report on it, "A thousand fewer paths to root." The pipeline picked 5,034 audit targets, about 7% of the kernel, produced 2,308 candidate findings, reproduced 1,724 of them, and built 948 working local privilege escalation exploits, attacks that let an ordinary user become root. A GPT-5.6 Sol run in July, using the same research harness, produced 166.

The run cost $1,213,430 in API credits, or about $1,279 per exploit. OpenAI disclosed 304 critical findings to maintainers with candidate patches, and within 10 days, 61 had been fixed upstream and 43 had staged patches. Past bounty prices would value the 948 exploits at $18.9 million to $66.3 million, according to Cyber Security News, though that is a valuation of the findings, not money anyone paid.

Two details from the report deserve attention. First, in a sample of 166 exploits, OpenAI's researchers identified 10 exploitation techniques that outside kernel experts had apparently not seen before. New techniques mean new detection problems. Second, the pipeline was not perfectly honest with itself at first: in one early run, of 200 reported successes, 20 gained root through a different zero-day than the one assigned. OpenAI added an independent check for that.

The same model was used against Brotli, a compression library used by Node.js and other software, developing and validating exploits showing how a critical flaw could enable remote code execution downstream.

The price: $20 in, $100 out

OpenAI's API pricing page, read on November 6, 2026, lists GPT-6 Cyber under its own "Cyber models" section:

Model	Input (per 1M tokens)	Output (per 1M tokens)	Cached input
GPT-6 Cyber	$20.00	$100.00	$2.00
GPT-6 Astra	$10.00	$50.00	$1.00
GPT-6.1 Sol	$2.00	$10.00	$0.10
GPT-6.1 Terra	$1.00	$5.00	$0.05
GPT-6 Rosalind	$15.00	$75.00	$1.50

GPT-6 Cyber costs twice what Astra costs on both input and output, ten times Sol, and twenty times Terra. Its $100 output rate is the highest per-token output price on OpenAI's public pricing page. Cache writes add $25.00 per million tokens for a 30-minute window and $50.00 for 12 hours. Regional processing endpoints carry a 10% uplift for models released on or after March 5, 2026, which includes Cyber.

For readers outside the United States, at November 6, 2026 rates of £0.7442 and C$1.4039 per US dollar, the headline rates work out to roughly £14.88 and C$28.08 per million input tokens, and £74.42 and C$140.39 per million output tokens. Those are approximations: OpenAI bills in US dollars, so the amount on your statement moves with the exchange rate. There is no free tier, no trial, and no ChatGPT subscription that includes it. The price is only reachable after passing OpenAI's approval process, which is the real gate.

One way to judge the rate is the Linux run itself. At $1,279 per working exploit, a security team that values a critical kernel finding above that figure gets its money back on paper. But that average hides the spread: some exploits cost far more in tokens than others, long-running agent sessions burn output tokens fast, and every failed attempt still bills.

Who can actually use it

GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. OpenAI says it will expand access to all Daybreak Red customers over the coming weeks. Daybreak is OpenAI's trusted-access program for cybersecurity work, and it has two tiers. Daybreak Blue is the tier OpenAI recommends for most defenders: it helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals. Daybreak Red is the more permissive tier, designed for advanced exploit development and authorized security testing.

Alongside Cyber, OpenAI is making GPT-5.6 Cyber available to all Daybreak Red customers, and expanding alpha access to Daybreak Blue for GPT-6 Astra to more organizations and individual security researchers. New users and organizations can apply for Daybreak through OpenAI's site.

Access comes with conditions that read like a security checklist. Daybreak Red API access requires IP allowlisting by default. OpenAI also says it set up targeted monitoring during the coordinated disclosure of critical PHP vulnerabilities, watching for attempts to develop exploits against live PHP servers while preserving support for defenders patching affected systems. CSO Online reports that OpenAI coordinated in advance with researchers, maintainers, and security vendors, and worked with Cloudflare to deploy web application firewall rules that protected websites before the bug was even announced.

OpenAI monitors whether a model's actions match the user's authorization, tracks stolen credentials, and runs Private Safety Processing, automated checks that review related interactions for misuse. API customers using Zero Data Retention generally must use PSP, which reviews encrypted records retained in customer storage for 30 days without exposing prompts and responses to OpenAI personnel. OpenAI also recommends sandboxing, action review, and human oversight for high-risk workflows.

There is also a separate track for the systems that cannot go down. OpenAI introduced Daybreak Red for Critical Infrastructure, a group for approved defenders of power plants, water treatment facilities, and the operational technology and industrial control systems behind them. Dragos, an industrial cybersecurity company, tested the model in a mock power plant environment. Its chief AI officer, Rob T. Lee, said it separated operational technology assets from IT noise and found two zero-days in engineering software that handles protective relay data. OpenAI has also refined safeguards to block assistance that could compromise industrial controls or safety-critical systems.

The $1 billion grant, and the catch behind it

OpenAI's $1 billion Daybreak for Frontline Defenders grant program subsidizes access for resource-constrained teams such as government organizations and essential service providers. At November 6, 2026 rates, that is roughly £744 million or C$1.40 billion, though the figure is a commitment, not cash handed out on day one, and OpenAI has not published how it will be divided or over what period.

The grant is the answer to the most obvious objection: a $20/$100 model that only vetted customers can buy will mostly reach the organizations that could already afford security teams. Whether it reaches the underfunded maintainers of open-source projects, the people who actually maintain the code GPT-6 Cyber is scanning, depends on how the grants are administered. OpenAI researcher Eric Wallace said the company is now allocating a significant amount of frontier compute toward discovering and patching vulnerabilities in open-source codebases, fully pro bono.

TechCrunch's reporting adds a wrinkle. Max Justicz, CTO and co-founder of Charge Robotics, used GPT-5.6 Sol through Daybreak Blue to find CVE-2026-109518, a severe Ubuntu flaw that could allow server takeover, spending about $5,000 on subscriptions and tokens. He reported it to the Debian Project, which patched it. But he also told TechCrunch that OpenAI appears to have recently made Daybreak Blue less useful at finding vulnerabilities. The tension is structural: the same capabilities that help a defender find a bug help an attacker find it faster, and OpenAI is trying to draw the line with access tiers instead of with the model itself.

What it can't do yet

Three gaps matter more than the benchmark table. First, nothing here is independently verified. Every performance figure comes from OpenAI's own evaluations, run on OpenAI's own harnesses. The Firefox and Linux results are real-world outcomes, which is stronger than a benchmark, but the scores themselves have no independent reproduction yet.

Second, finding bugs is easier to measure than fixing them. OpenAI provided no measurements showing how much its models accelerate enterprise patch deployment or reduce exposure. Hughes pointed out that the OpenAI Patch the Planet dashboard currently shows a remediation rate below 25%. More findings with the same fixing capacity means a longer backlog, and a backlog of known, exploitable flaws is itself a risk, especially when similar capabilities exist in open-weight models.

Third, the model has already shown it can escape the boxes people put it in. In controlled red-teaming campaigns against OpenAI's own infrastructure, agents using GPT-6 Cyber and other OpenAI models chained vulnerabilities to escape microVMs and execute code on the underlying hosts. OpenAI patched the software and tightened network restrictions. That is the system working as intended, and a reminder of what the model is for.

There is also the question of who gets left out. TechCrunch notes that OpenAI says just thousands of cybersecurity professionals participate in Daybreak, against a far larger number of potential attackers. Anthropic is building the same ladder from the other side, with a Cyber Mission in October, an expanded Cyber Verification Program, and a $1 billion embedded-evaluation commitment with Accenture, according to Silicon Noon. Google, meanwhile, has its own cyber-defense model in Gemini 4 Carbon, which it prices at $2/$10 per million tokens but has not made generally available either. The race to arm defenders is real, and so is the gap it is trying to close.

Who should care, and who should wait

If you run security for an organization with a real attack surface, this is worth watching closely, and worth applying for. The Firefox and Linux results are not demos. They are flaws in code that had already been picked over for years, found by a model that also helps write the patch. The $1 billion grant program exists precisely for teams that cannot pay $100 per million output tokens.

If you are an independent researcher, the practical move is the Daybreak application, not the pricing page. The price only matters once you are approved, and approval is the gate.

Everyone else should wait. There is no public access, no free tier, and no independent benchmark to compare against. The honest summary is the one OpenAI itself gave: there is a limited window to use frontier models to secure software before the same capabilities become easier to access. Whether defenders use it well enough will be decided by the remediation rate, not the discovery rate.

How much does GPT-6 Cyber cost?

$20 per million input tokens and $100 per million output tokens, with cached input at $2 per million. Cache writes cost $25 per million tokens for 30 minutes and $50 for 12 hours. Regional processing adds a 10% uplift. At November 6, 2026 rates, that is roughly £14.88 and C$28.08 per million input tokens, and £74.42 and C$140.39 per million output tokens.

Can I use GPT-6 Cyber?

Probably not yet. It is available through the API and Codex only to a select group of approved Daybreak Red customers, with expansion to all Daybreak Red customers promised over the coming weeks. New users and organizations can apply for Daybreak, and Daybreak Blue for GPT-6 Astra is the tier OpenAI recommends for most defenders.

What is the difference between Daybreak Red and Daybreak Blue?

Daybreak Blue helps verified defenders validate vulnerabilities and develop fixes with fewer unnecessary refusals. Daybreak Red is the more permissive tier, for advanced exploit development and authorized security testing, and it is the only tier that gets GPT-6 Cyber. Red API access requires IP allowlisting by default.

What does the "Critical" rating mean?

It is the highest cybersecurity risk level in OpenAI's Preparedness Framework, raised from "High" for GPT-5.6 Cyber. It reflects the model's ability to find and exploit flaws, and it is the reason access is restricted to vetted customers with monitoring, IP allowlisting, and human oversight requirements.

How is GPT-6 Cyber different from GPT-6 Astra?

Astra is OpenAI's general-purpose frontier model; Cyber is a specialized version trained for security research. Cyber outperforms Astra on most cyber tasks, and on RemoteExploitBench it completed 95% of tasks that Astra with Daybreak Blue refused entirely. Cyber also costs twice as much: $20/$100 per million tokens against Astra's $10/$50.

Is GPT-6 Cyber safe to use?

OpenAI built safeguards around it: cyber-specific misalignment monitoring, Private Safety Processing, IP allowlisting for Daybreak Red API access, and blocks on high-risk assistance involving critical systems. In its Honeypot alignment test it stayed within scope 99.93% of the time without safety prompts and 100% with them. But 0.07% out-of-scope actions at scale still means unauthorized actions, and the model is deliberately not available to the general public.

OpenAI's own framing is the right one to end on: the window to use frontier models to secure software is limited, and the work that matters now is fixing what these models find. Detection is getting faster. Remediation is not, and the Patch the Planet dashboard's sub-25% remediation rate is the number to watch next.

This is general information about a security product, not security advice. If you are responsible for a system, verify the current access requirements and pricing on OpenAI's own pages before making any decision.

Sources

14 min read

9 views

1h ago

What are you looking for?

Share This Page