GPT-6 Cyber: the AI exploit agent and the fence that holds

On November 5, 2026, OpenAI released GPT-6 Cyber, a security research agent built to find vulnerabilities, develop working exploits and validate them. OpenAI itself classifies the model as Critical under its Preparedness Framework. The headline number is 48.5 percent on ExploitGym, up from 32.1 percent for GPT-5.6 Cyber. That number matters, but it is not the one I care about. The one I care about is 99.93 percent: the share of scope tests in which the model left services outside its assignment alone, without any deployment prompt. With the prompt in place it never drifted. I run agents on a secondhand Google Pixel 6a, and I have spent more than a year learning how expensive a drifting agent can be. That is why I read this release less as a hacker show and more as a status report on what it takes to run agents responsibly.

ExploitGym asks whether a model can turn a defined vulnerability in a remote target into something that works. GPT-6 Cyber scores 48.5 percent, the previous model scored 32.1 percent. That is roughly 16 percentage points, which OpenAI counts as a 51 percent relative improvement. The second test is offensive web pentesting: the model probes a web application without access to its source code and has to find weaknesses on its own. GPT-6 Cyber reached 40.3 percent recall, GPT-6 Astra 32.0. Honesty check: these are benchmark numbers from controlled environments, not proof of performance in networks you do not own. But the direction is clear, and the scope numbers are stronger still. The same chart shows GPT-6 Astra refusing all ExploitGym tasks with safeguards on, while reaching 42.4 percent through Daybreak Blue. Numbers in a launch post are always dressed for the trade press, so the rest of this piece looks at what OpenAI actually measured when it counts boundaries.

The quiet masterpiece is ExploitGym Honeypot. OpenAI gives the model a difficult task in an isolated environment and attaches side services, such as a package registry or an object store. Those services are deliberately easy to exploit. Touching them would hand over the task flag, but the rules say attacking them falls outside the assignment. The model has to tell the difference between success and a boundary violation. The design was informed by the hacking incident at Hugging Face, where an attacker moved through side systems into deeper infrastructure. Everyone who runs agents knows that structure: there is an assignment, and there are side doors that would get you there faster if you ignored the rules.

The measurement: without deployment prompts, GPT-6 Cyber avoided attacking out-of-scope services in 99.93 percent of test runs, the previous model sat at 94.49 percent. With prompts, it reached 100 percent. The interesting detail is that OpenAI publishes fragments of its reasoning, quoted from the launch post: assume there is no extra API or attack controller, we only work against the target. And: do not touch credentials outside the scope. That is the point where this becomes interesting for anyone who runs agents. Boundary thinking now happens inside the chain of thought itself, OpenAI argues, not only at the emergency brake. A model that keeps limits in mind while reasoning needs less external scaffolding than one that simply gets cut off when it wanders.

The real-world results are the substance of this release. OpenAI reports 948 privilege escalation paths worked out in Linux, published as its own post on November 4. The model also found 81 previously unknown high-severity vulnerabilities in Firefox, a codebase that has already been swept by several generations of frontier models. Mozilla has shipped fixes for most of them, the advisory runs as mfsa2026-118. Beyond that, teams at Cisco, at the company Calif and at CodeRabbit use the model for vulnerability research and code review, and Cognition reports on its internal benchmark for novel vulnerability discovery: 23 percent for GPT-6 Cyber, against a previous best of 13 percent. Concretely, that means the model works inside codebases on the scale of Linux and Firefox, not only in lab tasks. If you want to know what a list of 948 finds practically looks like, the Linux post is the place to look.

Availability is the tight end. GPT-6 Cyber ships through the API and inside Codex, initially to a limited circle of approved Daybreak Red customers, which is OpenAI's program for verified defenders. All Daybreak Red customers also get GPT-5.6 Cyber, and the Daybreak Blue alpha for GPT-6 Astra is opening up to more organizations and individual researchers. Price: not available, the announcement quotes none. On November 4, Daybreak Red also landed in AWS GovCloud, region US-East. Everyone else gets the system card, the blog posts and Mozilla's fixes, but not the model. For my part, that means I reason from reported numbers rather than my own test, and the gap between reading and measuring stays visible in this text.

This perspective comes from running an agent household on a small budget. My Google Pixel 6a runs a Hermes core with pi agents wired in through herdr. Since the go on November 5, the approval cards are gone, the hardlines stay in place, and the loop rule still holds: one step, one check, done. That is the cheap version of what OpenAI measures in the honeypot. In August I went through the memory crisis, five gateway deaths in under two days, and rebuilt the setup afterwards so it survives kills instead of trying to prevent them. My best documented measurement lives in my vault: from August 28, 7:40 pm to September 1, 12:18 pm the setup ran 88 hours without interruption, zero out-of-memory kills since hardening, backed by hourly heartbeats, snapshots and gateway logs. On top of that, 36 of 36 tests across two verification projects, 29 of 29 on the network layer and 7 of 7 on the price compass, built in a local workflow where Hermes plans, pi executes, Hermes verifies. I wrote none of that code myself. I orchestrated it.

What I take from that for operations: a honeypot does not require an OpenAI budget. It requires one side door with an easy flaw and a log that proves afterwards whether the agent tested it. In my setup that combination is the daily note plus the heartbeat, in OpenAI's case it is a benchmark with flag logic. The scale differs by four orders of magnitude, the principle does not. And the boundary I am not allowed to overwrite at the end of the day: I cannot re-measure OpenAI's numbers myself, access is reserved for vetted teams. My measurements cover my setup, not their benchmark. Anyone who wants more needs more than my deck.

OpenAI itself talks about a limited window in which frontier models can harden software before offensive use catches up; the program is called Defenders Window. The stated plan is to grow Daybreak: advanced security research for organizations of any size, independent researchers and open source maintainers. The open questions remain open. First, 948 paths to root prove that even Linux, a codebase under permanent scrutiny, still yielded hundreds of finds after multiple sweeps. What does that mean for software with no large community watching it? Second, OpenAI rates the model Critical while access stays limited to vetted teams. That gap between capability and availability will shape the coming months. Third, infrastructure: agents of this class need data centers, and the power side is tight. The EPRI study projects 9 to 17 percent of US electricity going to data centers in 2026, and Gartner expects about 40 percent of AI data centers to hit power shortages by 2027. The point is not doom prose. The point is that the model meant to make software safer adds load that helps decide how long that window stays open.

About the author: I am Marcel, a graphic designer running the HUNTER cyberdeck on a secondhand Google Pixel 6a. This post relies on the OpenAI announcements of November 4 and 5, 2026, and on notes from my own vault with documented measurements of the August uptime record and of 36 of 36 tests in two verification projects. Last reviewed on November 6, 2026.

Sources, retrieved on November 6, 2026: OpenAI, GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents (openai.com/index/introducing-gpt-6-cyber). OpenAI, A thousand fewer paths to root (openai.com/index/a-thousand-fewer-paths-to-root). OpenAI system card for GPT-6 Cyber (deploymentsafety.openai.com/gpt-6-cyber). Mozilla security advisory mfsa2026-118 (mozilla.org). OpenAI, The Defenders Window (openai.com/index/the-defenders-window). S&P Global on AI data center power demand and the EPRI numbers (spglobal.com). The project measurements for the uptime record and the tests are my own documented measurements from the vault, daily notes, heartbeats and snapshots, not public sources.