GPT-6 Cyber separates exploit capability from access and scope compliance

OpenAI introduced GPT-6 Cyber on November 5 as a variant of GPT-6 Astra specialized for authorized cybersecurity work. Its ExploitGym completion score rose from 32.1% in GPT-5.6 Cyber to 48.5% in the reported vendor evaluation. The release also cites controlled remote exploit tests where GPT-6 Cyber succeeded on 95% of assigned tasks while a differently configured Astra/Daybreak Blue baseline refused the tested tasks. That is not a pure weights-to-weights capability comparison: the access and refusal policies differ.

The system card classifies cybersecurity capabilities as Critical, a capability hazard designation rather than proof of misuse or unconstrained autonomy. The Daybreak Red distribution is limited to approved researchers and security teams, with identity controls, monitoring, restrictions on sensitive infrastructure and network access policies. The vendor reports improvements in respect for authorized scope; these evaluations cannot prove that every runtime tool, downstream executor or operator will stay within bounds. The separate Linux and Firefox studies establish research outputs under their own conditions; neither translates directly into wild exploitation by a standalone public agent.

The system card reports a useful counterresult to the launch benchmark: on the updated independent FrontierCyber evaluation, GPT-6 Cyber completed 90 of 288 tasks versus 96 of 288 for GPT-6 Astra, and neither solved the 15 hardest tasks. The specialized model therefore is not uniformly superior under every evaluation. In a separate vendor-controlled scope test, OpenAI reports 99.93% avoidance of out-of-scope targets without its deployment prompt and 100% with the prompt. These scores belong to a specific scope fixture and are not a substitute for independently enforced permissions on shell, network and credential tools.

There are also two access boundaries. A researcher must be approved for the appropriate Daybreak route, and every particular target and action still needs authorization. The preceding Daybreak Red GovCloud announcement concerns GPT-5.6 Cyber on Bedrock, not automatic GPT-6 Cyber availability in that region. The Linux exploit case, Mozilla fixes and industrial lab findings involve different versions, benchmarks and external consequences.