OpenAI just put a Critical cyber rating on a model and published the Linux and Firefox receipts that justify the label. The product question underneath the leaderboard is whether Daybreak Red access control plus alignment training is a workable defender programme or a capability race with a guest list.
GPT-6 Cyber finds, exploits, and helps patch inside authorised scope
On 5 November 2026, OpenAI introduced GPT-6 Cyber as a cybersecurity model trained to find and validate exploitable vulnerabilities while staying inside researcher-set scope. On ExploitGym it scores 48.5%, up from 32.1% for GPT-5.6 Cyber. On a new offensive web penetration eval it reaches 40.3% vulnerability recall versus 32.0% for GPT-6 Astra. On RemoteExploitBench, GPT-6 Cyber completed 95% of tasks while Astra with Daybreak Blue refused 100%.
Scope-keeping is the second headline. On ExploitGym Honeypot, informed by the Hugging Face incident, GPT-6 Cyber avoided out-of-scope services in 99.93% of tests without the deployment prompt and 100% with it, against 94.49% for GPT-5.6 Cyber without the prompt. OpenAI classifies the model Critical for cybersecurity under the Preparedness Framework.
The companion 4 November post, "A thousand fewer paths to root," documents the pipeline. Scout and Analyst agents selected about 2.8 million lines of security-relevant Linux code, produced 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities, and generated 948 working LPE exploits for a stock desktop distribution. API cost for the mid-October run: $1,213,430, or about $1,279 per LPE. Following Linux community guidance, OpenAI began with 304 critical disclosures plus candidate patches.
The same model family produced evidence and reproducible tests for 81 novel high-severity Firefox vulnerabilities; Mozilla began landing fixes after the reports. OpenAI also cites at least 10 novel Linux exploitation techniques found by agents in the pipeline.
Critical rating, Daybreak Red, and defender economics land together
This is OpenAI speaking as the lab that ran the campaign and owns the access programme, which separates it from third-party harness write-ups that only rented a cyber model. The artefacts are dated: ExploitGym deltas, honeypot scope rates, Linux LPE counts with a dollar cost, Firefox disclosures with Mozilla landing patches, and a Preparedness Critical label.
Daybreak is the distribution answer. Mainline GPT-6 Astra already covers code review and triage. Daybreak Blue is for verified defenders validating vulnerabilities with fewer refusals. Daybreak Red enables deeper exploit development with GPT-6 Cyber. A new Daybreak Red for Critical Infrastructure subgroup adds permissions for authorised testing of critical systems, paired with refined OT/ICS safeguards and Dragos lab colour. A $1 billion Daybreak for Frontline Defenders grant programme subsidises resource-constrained teams.
The Frontier judgement sits here. "Aligned cyber agent + restricted Daybreak" is workable only if scope-keeping holds under deployment pressure, if Critical Infrastructure safeguards block unauthorised OT paths without neutering defenders, and if the disclosure cadence actually shrinks attacker windows faster than the same stack expands them. The Linux post itself warns that a low-privileged account on an unpatched OS should be treated as functionally equivalent to root for a well-resourced actor.
Daybreak Red API and Codex for approved customers; system card carries the evals
GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers, with progressive expansion promised. GPT-5.6 Cyber is being opened to all Daybreak Red customers. Daybreak Blue alpha access for GPT-6 Astra is widening. Daybreak Red API access defaults to IP allowlisting. Private Safety Processing applies for many Zero Data Retention customers. Full eval settings sit in the system card linked from the launch post.
Maturity reading: production-shaped for enrolled Daybreak Red organisations with sandboxes and human oversight; demo-to-usable for everyone else until an approval lands. Weights are not public. The Linux and Firefox campaigns are OpenAI-operated research, reviewed by human security researchers before maintainer reports.
Enrol Daybreak if you already patch at pipeline speed
Security research leads with Linux, browser, or large open-source surface area should apply for Daybreak Red if they can absorb Critical-tier monitoring, IP allowlisting, and human review of agent-written exploits and patches. Critical-infrastructure defenders should ask specifically for the Critical Infrastructure subgroup and read the Dragos-informed safeguard rates before assuming the model will run the same way on OT ranges as on Linux CTF shapes.
Teams that only need PR-time code review can stay on Astra / Daybreak Blue and ignore Cyber until a concrete exploit-validation workflow exists. Maintainers receiving OpenAI Patch the Planet reports should treat candidate patches as starting points for expert review, matching OpenAI's own framing that automated patch generation still needs human-guided iteration.
Buyers comparing this to Anthropic's Frontier Red Team disclosure should keep the desks separate: Anthropic published lab-authored chains under CVD; OpenAI is publishing a defender-access product plus a scaled Linux/Firefox pipeline. Different actor, different disclosure shape, same underlying pressure on patch latency.
Scope theatre, unpatched local accounts, and copying Critical into chat products
Honeypot scores measure staying off planted out-of-scope services in a constructed eval. They do not prove every customer prompt will keep an agent inside a messy corporate rules-of-engagement document. Treating 99.93% as "safe to unsupervised root" recreates the Hugging Face lesson in slower motion.
A second failure mode is celebrating 948 LPEs while leaving low-privileged fleet accounts on stale kernels. OpenAI's own reflection says those accounts are already root-equivalent against a capable actor. A third is assuming Mozilla or Linux landing velocity generalises to every proprietary codebase without a disclosure channel and patch owners. A fourth is reading customer quotes as a substitute for the system card.
Misuse monitors, credential-theft protections, and OT/ICS blocks are part of the release. They also create false-refusal risk for legitimate authorised testing; OpenAI asks for /feedback when safeguards miss or over-block. That tension does not disappear because the marketing sentence says "for defenders."
Price Daybreak seats against the Linux dollar-per-LPE receipt
The durable artefacts from 4-5 November are the Critical rating, the ExploitGym and honeypot deltas, the $1.2M / 948 LPE Linux run, the 81 Firefox findings with Mozilla fixes, and the Daybreak Red access path. The open Monday question is whether your organisation can operationalise agent-found bugs faster than an adversary with the same class of model.