GPT-6 Cyber announced: the Astra-derived cybersecurity variant ships on the API

On November 5, 2026, OpenAI announced GPT-6 Cyber, a cybersecurity-specialized model trained to find and validate exploitable vulnerabilities while staying inside the scope researchers set. The system card pins down its lineage: a cyber-specialized variant of GPT-6 Astra — a variant of Astra, not a separately trained architecture. Compared with GPT-5.6 Cyber, the official numbers report ExploitGym at 48.5% versus 32.1% (about a 51% relative gain), out-of-scope exploitation down to 99.93% avoidance without deployment prompts (from 94.49%), and a Preparedness Framework cybersecurity rating raised from High to Critical. This site ran a full-source verification pass on November 6, 2026 across the announcement, changelog, model card, pricing page, Daybreak guide, system card, deprecations page, and both official SDKs; every claim below traces to one of those loads.

1. Overview: what GPT-6 Cyber is

GPT-6 Cyber is the cybersecurity-specialized model OpenAI announced on November 5, 2026, with a same-day changelog entry and a live model catalog page. The model ID is gpt-6-cyber (the default snapshot shares the name; the card lists exactly one snapshot). The RSS definition sentence reads: Introducing GPT-6 Cyber, OpenAI's cybersecurity model for finding exploitable vulnerabilities and developing fixes, trained to stay within authorized scope.

The system card (GPT-6 Cyber System Card, published November 5, 2026) fills in lineage and training: it is a cyber-specialized variant of GPT-6 Astra whose post-training combines reinforcement learning on crash reproduction, working exploit development, and codebase vulnerability search with alignment signals that reinforce staying inside the user's intended scope, avoiding unrequested actions, and reporting results accurately.

Three sentences capture the positioning:

• Capability: it beats GPT-6 Astra on most cyber tasks (even when Astra does not refuse) and beats GPT-5.6 Cyber across the board;
• Alignment: honeypot-style evaluations show it rarely steps outside its assigned authorization;
• Access: it runs through the Daybreak Red program with the steepest approval stack in the family — Red eligibility plus a model-level approval.

2. Publication channels and what was verifiable on the day

The launch shipped with an unusually complete paper trail. This site's verification status on 2026-11-06:

Note the loadability pattern: the announcement page 403s curl and plain fetches, so the full text was read through a rendered-browser channel; the changelog, model card, pricing page, guide, and deprecations page all follow the append-.md official markdown pattern. Every fact in this article points back to one of these channels.

3. Model card at a glance: context, modalities, endpoints

Hard specifications from the official model card (fetched 2026-11-06):

• Default snapshot: gpt-6-cyber (the only snapshot listed);
• Input modalities text + image, output modality text;
• Context window 1,050,000, maximum input 922,000, maximum output 128,000;
• Reasoning token support;
• Standard rate limits: Build 5,000 RPM / 1,000,000 TPM, Launch 10,000 RPM / 4,000,000 TPM, Grow 15,000 RPM / 40,000,000 TPM (custom organizational limits override these).

The endpoint table is the most visible difference from the GPT-5.6 Cyber card: GPT-6 Cyber marks both Chat Completions and Responses as Supported, while the GPT-5.6 Cyber card supports Responses only (both cards re-checked on 2026-11-06). The full endpoint table:

Feature list: streaming, structured_outputs, function_calling, web_search, prompt_caching. Responses tool list: function_calling, web_search, file_search, tool_search, image_generation, code_interpreter, hosted_shell, apply_patch, skills, computer_use, mcp.

4. Pricing: $20/$100 with three cache tiers

The pricing page's Cyber models section (Our latest Daybreak models) and the model card agree (fetched 2026-11-06):

The card notes these are standard short-context prices, and the pricing page shows a dash in every long-context column — GPT-6 Cyber has no long-context tier, matching how GPT-5.6 Cyber and gpt-5.5-cyber are listed. For scale: GPT-5.6 Cyber sits at $12.5/$75 with $1.25 cached input; GPT-6 Cyber is priced a tier up, in the same direction as its Preparedness upgrade.

5. Benchmarks and the Preparedness rating

Core numbers from the announcement and system card (comparison baselines as stated officially):

Context for the table:

• ExploitGym tests whether a model can exploit a specified vulnerability on a remote target. ExploitGym Honeypot takes some of the hardest ExploitGym tasks and adds a deliberately easy-to-exploit auxiliary service (a package registry, an object store) as a honeypot — the model must infer that attacking it is out of scope. The evaluation design was informed by the Hugging Face incident, which OpenAI has covered separately.
• RemoteExploitBench is a new benchmark built for Daybreak Red workflows: known vulnerabilities in applications such as GitLab, PostgreSQL, and Jenkins deployed in a controlled environment. GPT-6 Cyber completed 95% of tasks; its only failure was an exploit it could not get to work remotely.
• Preparedness Framework: the cybersecurity rating is Critical (GPT-5.6 Cyber: High). The system card states the designations match GPT-6 Astra: Biological and Chemical High, AI self-improvement below High.
• Cyber refusal rates (system card): the model completed 100% of general security assistance and vulnerability patching tasks, 96% of exploit development tasks, and 97% of red-teaming tasks — specialized training visibly lowered refusals on authorized work.
• Auto-Review compliance (system card): the prohibited action was completed in 0% of graded rollouts (GPT-6 Astra 0%, GPT-5.6 Sol 0.3%, GPT-5.6 Cyber 5.51%).
• Biological safety (system card): 99.87% safe responses on severe-risk requests, 98.27% on dual-use, and 97.22% benign questions answered without unnecessary refusal — the cyber-refusal reduction did not spill into biology.

6. Access and onboarding

GPT-6 Cyber carries the steepest approval stack in the Daybreak family. In the guide's model-to-program table, its requirement is Red + additional model approval — the organization first holds Daybreak Red, then gets this model approved separately, both confirmed by your account team. The request side looks like this:

curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-6-cyber",
    "access_programs": {"cyber": "daybreak_red"},
    "safety_identifier": "user_a17f",
    "input": "Suggest a regression test for a path traversal fix."
  }'

(This is the verbatim example from the guide's Set up GPT-6-Cyber section; replace safety_identifier with a stable, pseudonymous identifier for the requesting user, as the guide instructs.)

The onboarding checklist, condensed from the guide:

1. Account team confirmation: the organization holds Daybreak Red access and a GPT-6 Cyber model approval;
2. Project access: an organization owner enables Daybreak Red on the sending project — with project-level controls, use a non-default project and a key from that project;
3. IP allowlisting: configure an allowlist for your application's public egress IPs; end users of an approved product embedding the model do not need their own;
4. ZDR projects: configure Private Safety Processing (PSP), confirm storage shows Validated and the retention policy reads Zero Data Retention with Private Safety Processing — PSP applies to all API traffic in that project.

To verify what a request selected: the response records the chosen program in access_programs.cyber. Three error codes, from the guide's Handle errors table:

One default deserves attention (guide): starting with gpt-6.1-terra, omitting access_programs.cyber results in standard treatment rather than defaulting to the highest available tier; for Red models such as gpt-5.6-cyber, omission makes the API select daybreak_red and the request fails if the access is missing.

7. Field results and the safeguards stack

Field numbers as stated in the announcement:

• Linux kernel: 1,724 vulnerabilities reproduced and working exploits developed for 948 — against 166 for GPT-5.6 Sol with the same research harness (officially framed as more than five times); per Linux community guidance, 304 critical findings were disclosed to maintainers with candidate patches, with the rest in the fix pipeline. OpenAI published a companion post, A thousand fewer paths to root (November 4).
• Firefox: in one vulnerability research campaign the model produced evidence and reproducible tests for 81 novel vulnerabilities classified by Mozilla as high severity, and showed that 30 additional known issues were more severe than previously reported; Mozilla began landing fixes shortly after disclosure (the announcement links Mozilla advisory MFSA 2026-118).
• Brotli: alongside other OpenAI models, GPT-6 Cyber helped develop and validate exploits for a critical Brotli (compression library used by Node.js and others) vulnerability showing remote code execution in downstream applications.
• In-house use: OpenAI used it to harden its own infrastructure, including the recently shared training-environment hardening work; the announcement also names Cisco, Calif, and CodeRabbit as security teams using it for vulnerability research and code review.

The safeguards stack (announcement and system card): cyber-specific misalignment monitoring that distinguishes legitimate exploit development from overreach; targeted monitoring for emerging threats (during the coordinated disclosure of critical PHP vulnerabilities, monitoring was tuned to attempts against live PHP servers while defenders patching systems stayed supported); PSP for ZDR customers (encrypted records kept in customer storage for 30 days for automated review, with no exposure of prompts or responses to OpenAI personnel); IP allowlisting by default for Daybreak Red API access plus credential-compromise monitoring; checks that block high-risk activity involving critical systems; and the standing recommendations for sandboxing, action review, and human oversight.

Two new moves on the critical-infrastructure side: the $1 billion Daybreak for Frontline Defenders grant program, subsidizing access for resource-constrained teams such as government organizations and essential service providers, and a new group inside Daybreak Red called Daybreak Red for Critical Infrastructure, which gives approved critical-infrastructure defenders permissions for authorized testing of critical systems while retaining misalignment safeguards. OpenAI also disclosed a partnership with OT security vendor Dragos, which ran progressive evaluations (network discovery and asset enumeration through targeted reconnaissance, sensitive data exfiltration, and unauthorized device actions) in a controlled lab using cyber-permissive Daybreak Red models; OpenAI refined safeguards based on that feedback.

8. SDK and Codex status

The SDK type layer caught up the same day:

• openai-python v3.47.0 (GitHub 2026-11-05 18:04 UTC, PR #4249) and openai-node v7.52.0 (18:05 UTC, PR #3116): gpt-6-cyber joins the Responses model union, placed between gpt-5.6-cyber and gpt-rosalind-research;
• It does not appear in the ChatModel enum (verified against the v3.47.0 tag's chat_model.py). gpt-6-rosalind follows the same pattern (added to the Responses union on November 5 by v3.46.0 #4243 / node v7.51.0 #3109) — approval-gated models arrive through the Responses union rather than the general ChatModel enum;
• The same batch also expanded data residency (python v3.46.0 #4246 / node v7.51.0 #3112: the DataResidency union adds au/in/jp regional endpoints).

The Codex side needs two separate sentences: the announcement says GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers; but earlier on 2026-11-06, the Codex changelog (now hosted at learn.chatgpt.com/docs/changelog, fetched the same day) listed only a November 2 iOS entry for the month, and the bundled models.json at rust-v0.168.0-alpha.6 contains no standalone gpt-6-cyber entry (the Daybreak aliases remain visibility=hide with unchanged windows: Blue 272K/872K, Red 372K/372K). The delivery shape on the Codex side will be recorded once the catalog or changelog updates; this article does not speculate. Update (rechecked 2026-11-06): Codex CLI 0.167.0 shipped at 01:40 UTC that day and the changelog now carries that entry for November too; it does not name GPT-6 Cyber, though its change list includes #58190, "Allow providers to opt into Cyber access programs." The bundled models.json at rust-v0.167.0 is byte-identical to alpha.6 and still has no gpt-6-cyber entry, so the Codex-side conclusion stands.

9. What this does to the existing Daybreak / Cyber landscape

Placing the release on the Daybreak / Cyber timeline:

Connected housekeeping (deprecations page, checked 2026-11-06):

• gpt-5.5-cyber-preview: deprecated as of November 5, 2026, removed from the API on February 1, 2027; the replacement wording, as in the gpt-5.4-cyber era, remains the most capable cyber model available to you, with no specific model ID;
• gpt-5.4-cyber: already removed on October 1, 2026 (announced September 11, 2026);
• Daybreak Blue / Daybreak Red aliases: still marked Deprecated on their model cards as of the 2026-11-02 fetch (not re-fetched in this batch; that status is cited as of that verification).

Access is expanding in step (announcement wording): GPT-5.6 Cyber becomes available to all Daybreak Red customers; the Daybreak Blue alpha for GPT-6 Astra expands to more organizations and individual security researchers; new users can apply for Daybreak at openai.com/daybreak/.

10. Common misconceptions and troubleshooting

• Announced means usable — no. The model card states plainly that your organization needs Daybreak Red access and approval to use GPT-6 Cyber, confirmed by your account team; availability is select approved customers initially with progressive expansion, so treat your own approvals as the source of truth.
• Daybreak Red eligibility implies gpt-6-cyber access — it does not. The guide's table lists Red + additional model approval for this model; the model-level approval is a separate step.
• Assuming requests work without access_programs — for Red models, omitting the parameter makes the API select daybreak_red and the request fails without access; from gpt-6.1-terra onward, omission means standard treatment. An explicit value that does not match the model returns invalid_access_program.
• Assuming Chat Completions is unsupported — that was the GPT-5.6 Cyber card's table; the GPT-6 Cyber card supports both (both re-checked 2026-11-06). Always copy endpoint support from the card of the model you are shipping, not from a sibling generation.
• Not finding it in the SDK — gpt-6-cyber lives in the Responses model union, not the ChatModel enum; search for Responses-union additions, not enum additions.
• Citing status without a date — every status claim in this article was verified on 2026-11-06; the deprecations page, Daybreak eligibility, and the expansion pace can all move afterward.

11. Next steps

• Daybreak and Cyber model cards are live in the official catalog: Blue/Red aliases deprecated, GPT-5.6 Cyber at 400K — the previous-generation Cyber cards in full; the source for the 5.6 side of this article's comparison tables.
• OpenAI Models Release Notes (2026, Living Document) — the timeline archive, including the November 5 GPT-6 Cyber and November 4 GPT-Image-2.6 entries.
• GPT-6-Astra Goes Live: Codex Model Picker and Amazon Bedrock Catalogs — the base model behind this variant; migration guidance and the effort ladder live there.
• OpenAI's misalignment report: an internal research model used a funded test crypto wallet without authorization — the mechanism behind the misalignment monitoring referenced in this article's safeguards stack.
• OpenAI Deprecation Lifecycle Guide: Notice Periods, Shutdown Calendar, Migration Checklist — the framework for handling short-list deprecations like gpt-5.5-cyber-preview.
• The complete guide to GPT models (2026-07): GPT-5.6 Sol, Terra, Luna — the general-purpose lineup (this model sits outside it; approvals come first).