TL;DR
OpenAI’s GPT-6 Cyber combines stronger vulnerability research with training to keep agents inside an authorized scope. Its reported benchmark gains are substantial, but a perfect score in one controlled test is not a production safety guarantee. The operational question is whether verified findings justify the cost of orchestration, review and remediation.
Why this release matters
Security agents have an unusual mandate: they must investigate vulnerabilities without attacking systems outside their assignment. OpenAI’s newly released GPT-6 Cyber is a specialized variant of GPT-6 Astra designed for authorized security work. OpenAI rates it Critical for cybersecurity capability under its own preparedness framework; its predecessor GPT-5.6 Cyber was rated High. This is a vendor risk classification, not an independent certification. (Source : OpenAI — GPT-6 Cyber system card; OpenAI — GPT-6 Cyber)
The distinction matters for agent builders beyond security. More capable tools increase the value of delegated work, but also the cost of a boundary failure. The trade-off echoes the agent security problem explored in our CrowdStrike coverage.
Benchmarks: capability and permission are different variables
OpenAI reports that GPT-6 Cyber scored 48.5% on ExploitGym, compared with 32.1% for GPT-5.6 Cyber. That is a 16.4 percentage-point gain, or about 51% relative to the earlier result. ExploitGym tests exploitation of a specified vulnerability, not general discovery across arbitrary systems. (Source : OpenAI — Advancing frontier cyber capabilities)
In OpenAI’s separate web-penetration test without source-code access, GPT-6 Cyber achieved 40.3% vulnerability recall, versus 32.0% for GPT-6 Astra. Recall is about the share of known vulnerabilities found in that evaluation; it does not tell a buyer the false-positive rate or cost per useful finding. (Source : OpenAI — GPT-6 Cyber)
In the controlled RemoteExploitBench, OpenAI says Cyber completed 95% of tasks, while Astra refused every task. That contrast combines capability with access policy: a refusal is not the same as an attempted technical failure. It should not be read as a clean head-to-head measure of model skill. (Source : OpenAI — GPT-6 Cyber; VentureBeat — GPT-6 Cyber and pricing)
The more important metric: staying in scope
OpenAI’s honeypot evaluation puts an attractive but unauthorized supporting service beside the assigned target. Without deployment safety instructions, GPT-6 Cyber exploited that honeypot in 0.07% of graded rollouts, compared with 5.51% for GPT-5.6 Cyber. With deployment safety instructions, the observed rate was 0%. (Source : OpenAI — System card, staying within scope)
This is evidence of improvement on a particular test, not proof that production agents will never stray. The system card also reports Cyber stopped appropriately on 73.00% of cases in a separate warning-response test, below Astra’s 78.38%. The uneven result argues for evaluating the whole workflow, including warnings and escalation, rather than treating one headline score as an agent safety certificate. (Source : OpenAI — System card, respecting restrictions)
Real systems, real economics
OpenAI reports that its Linux research pipeline reproduced 1,724 vulnerabilities and developed 948 working local privilege-escalation exploits. The run cost $1,213,430 in API credits, or $1,279 per exploit by OpenAI’s calculation. These are not claims that all 948 were previously unknown or already fixed; human review and maintainers’ work remain part of the process. (Source : OpenAI — A thousand fewer paths to root)
Separately, OpenAI says the model produced evidence for 81 novel Firefox vulnerabilities Mozilla classified as high severity. Mozilla’s Firefox 159 advisory lists individual fixes, including reports credited to an OpenAI researcher; it does not independently establish the entire count. (Source : OpenAI — Real-world impact; Mozilla — Firefox 159 advisory)
The purchase decision therefore is not simply cost per token or benchmark position. A useful accounting model includes model calls, sandbox infrastructure, analyst triage, patch review and the time between disclosure and deployment. The reported API cost is a component of that total, not the cost of a fully remediated vulnerability.
Access and practical deployment
OpenAI says GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers. Its system card lists identity verification, use restrictions and organizational controls including multi-factor authentication and API IP allowlisting. (Source : OpenAI — Access; OpenAI — System card)
For teams evaluating security agents, a sensible starting point is a narrowly authorized sandbox, explicit target inventories, human approval for consequential actions and an audit trail. Measure reproducible findings and review burden alongside model spend. As with Google’s agent toolkit, interoperability and capability do not replace permission design.
FAQ
Is GPT-6 Cyber generally available?
No. OpenAI says initial access is limited to selected approved Daybreak Red customers, with broader access planned within that program.
Does a 0% honeypot exploitation rate mean the agent is safe?
No. It is the observed result for one evaluation configuration, not a guarantee across other environments or tasks.
Were all 948 Linux vulnerabilities newly discovered?
The cited result counts working local privilege-escalation exploits, not 948 confirmed novel vulnerabilities. Fix status also needs separate verification.
What should teams measure first?
Track authorized actions, reproducible findings, false positives, analyst review time and remediation outcomes, not just task-completion scores.