The Information Machine
Updated todayNewin the edition since 9 Nov 20262 sources

OpenAI's GPT-6 Cyber offensive security model

The gist

Latest: OpenAI Releases GPT-6 Cyber, an Offensive Security Research Model

The model substantially outperforms its predecessor on exploit construction benchmarks and has already produced real-world results, with Mozilla patching Firefox vulnerabilities the model discovered. OpenAI's decision to restrict access and train the model to respect authorized scope reflects the tradeoffs involved in deploying highly capable offensive security tooling.

When stories like this move, I write about them in an email each morning.

One free email each morning, around 8 AM US Eastern.

The full picture

OpenAI released GPT-6 Cyber, a model purpose-built for offensive security research. Access is restricted to approved Daybreak Red customers via API and Codex, with broader access planned over time. The model confirmed 1,724 Linux kernel bugs and built working exploits for 948 of them; its predecessor GPT-5.6 Sol managed 166 on the same test. It also found 81 previously unknown Firefox vulnerabilities, and Mozilla has released fixes for many of them. OpenAI classifies the model at its highest cyber-risk level, "Critical". The model is trained to stay within authorized scope, ignoring out-of-bounds honeypot targets 99.93% of the time without a deployment prompt and 100% of the time with one.

How it developed
First in the edition · 9 November 2026
8 November 2026in the 9 Nov edition

OpenAI released GPT-6 Cyber, a model built for offensive security research, restricting access to approved Daybreak Red customers via API and Codex with broader access planned over time.

On Linux kernel testing, the model confirmed 1,724 bugs and built working exploits for 948 of them, compared to 166 for its predecessor GPT-5.6 Sol on the same test. It also found 81 previously unknown Firefox vulnerabilities, Mozilla has released fixes for many of them, and OpenAI classifies the model at its highest internal cyber-risk level, "Critical".

Sources

Get the daily email

When stories like this move, I write about them in an email each morning.

One free email each morning, around 8 AM US Eastern.

See the latest edition · Privacy