Verdict first
● Winner — GPT-6 Cyber, on every published measure
● Biggest gap — 948 Linux exploits vs 166
● Safety — better in-bounds behaviour, higher risk rating
● Catch — Daybreak Red customers only
OpenAI published both models against the same benchmarks, which is rarer than it should be and makes a like-for-like comparison possible. Every figure below comes from OpenAI's own testing as reported on 5 November 2026.
The numbers, side by side
| Measure |
GPT-5.6 Cyber |
GPT-6 Cyber |
Change |
| ExploitGym success rate |
32.1% |
48.5% |
+16.4 points |
| Linux vulnerabilities reproduced |
not published |
1,724 |
— |
| Working Linux exploits built |
166 (GPT-5.6 Sol) |
948 |
5.7x |
| Firefox flaws found |
not published |
81 high-severity |
— |
| In bounds, no safety prompt |
94.49% |
99.93% |
+5.44 points |
| In bounds, with safety prompt |
not published |
100% |
— |
| Remote attack tasks completed |
not published |
95% |
— |
| Preparedness rating |
High |
Critical |
one level up |
Two of those rows need care. The 166 figure is GPT-5.6 Sol, not GPT-5.6 Cyber, so the 5.7x is across a different pairing than the rest of the table. And several cells read not published because OpenAI did not run the older model on that test, not because it scored zero.
What each number actually measures
ExploitGym: 32.1% to 48.5%
ExploitGym hands the model a known flaw and asks whether it can exploit it. That is a narrower task than finding the flaw in the first place, so a 48.5% score is not a claim that half of all software falls over. It is a claim that given a described weakness, the model produces working code about half the time.
Firefox: 81 previously unknown high-severity flaws
This is the discovery result rather than the exploitation one, and it is the more impressive of the two. Mozilla has started releasing fixes. Firefox is heavily audited by people and by fuzzers, so 81 unknown high-severity findings in a codebase that mature is the number that should make defenders pay attention.
Linux: 1,724 reproduced, 948 exploited, 304 disclosed
Reproducing a known vulnerability and building a working exploit for it are different jobs, and the model did the second for 55% of the first. OpenAI has disclosed 304 critical findings to maintainers with proposed patches, which is the part that makes this defensive work rather than a capability demo.
Staying in bounds: 94.49% to 99.93%
ExploitGym Honeypot tests whether a model wanders into services it was not authorised to touch. Stripped of its deployment safety prompt, GPT-6 Cyber stayed in scope 99.93% of the time against 94.49% for GPT-5.6 Cyber. With the prompt in place it stayed in bounds in every test. That is the measure a security team should care about most, because an out-of-scope action during an authorised engagement is a real incident.
95% versus zero on remote attack tasks
GPT-6 Cyber completed 95% of a remote attack benchmark. GPT-6 Astra refused every task on the same benchmark. That contrast is the clearest illustration of what Daybreak Red is for: the general model declines this work by design, and the specialised one does it under a vetting regime.
The rating went up, not down
OpenAI moved the model from High to Critical for cybersecurity under its Preparedness Framework. It is worth being clear about what that means: the rating describes the model's potential for harm, not its reliability. A Critical rating alongside better in-bounds behaviour is not a contradiction. The model is both safer to run and more dangerous if misdirected, which is why the access tier exists.
Which one you can actually use
Neither, for most readers. Access is restricted to vetted customers in Daybreak Red, OpenAI's tier for exploit development and authorised security testing, through the API and Codex. OpenAI says it will open the model to all Daybreak Red customers soon, which still means passing the vetting. No pricing has been published for either model.
Frequently asked questions
Is GPT-6 Cyber available to the public?
No. Access is limited to vetted Daybreak Red customers through the API and Codex. OpenAI says it will widen access to all Daybreak Red customers, which is still a vetted tier, not general availability.
What does a Critical rating mean?
It is OpenAI's own Preparedness Framework classification for the model's potential to cause harm in the cybersecurity domain, one level above the High rating given to GPT-5.6 Cyber. It describes risk if misused, not unreliability.
Did it actually find real bugs?
Yes. 81 previously unknown high-severity Firefox flaws, with Mozilla shipping fixes, and 304 critical Linux findings disclosed to maintainers with proposed patches. It also found two zero-days in power plant engineering software on a Dragos mock setup.
Is 48.5% on ExploitGym good?
Against 32.1% a generation earlier, yes. In absolute terms it means that when handed a known flaw the model writes a working exploit about half the time. It is not a measure of finding flaws, which is the harder task.
Background on the launch is in our GPT-6 Cyber news story.
Sources