What happened
On 5 November OpenAI released GPT-6 Cyber to a select group of approved Daybreak Red customers through its API and Codex, and says all Red customers follow over the coming weeks (vendor, via CSO Online). API requests must come from approved networks by default (vendor, via MarketScale). Daybreak Blue is the tier OpenAI recommends for most defenders (vendor, via CSO Online). OpenAI rates the model Critical for cybersecurity under its Preparedness Framework (vendor, via CSO Online).
Read every figure below as OpenAI's own. The Decoder says plainly: "No independent testing of the model has been published so far" (independent, The Decoder). OpenAI's announcement would not load for our tools, so the figures here come from press reports of it.
What the numbers prove
| Claim | Figure | What it does not show |
|---|---|---|
| Linux kernel funnel | 5,034 targets, about 7% of the kernel; 2,308 candidates; 1,724 reproduced; 948 working local privilege escalation exploits (vendor, via Cyber Security News) | That 948 are new. CSO Online reports 588 as previously unknown; other reports give no split |
| Cost | $1,213,430 in API credits (vendor, via Cyber Security News). About $1,280 per exploit (our maths, 1,213,430 / 948). That report prints $1,279 | What an attacker would pay. These are OpenAI's credits on its own pipeline |
| Firefox | 81 new high-severity bugs, and 30 known issues rated worse than first reported; fixes in Firefox 159, 27 October, MFSA 2026-118 (vendor, via Cyber Security News) | Whether enterprise fleets had the fix before the announcement |
| Scope control | Out of scope in 0.07% of graded runs against 5.51% for GPT-5.6 Cyber, without deployment safety instructions (vendor, via MarketScale) | Behaviour on your network. It is a honeypot test |
| Remediation | 1,995 issues and 466 patches merged upstream in Patch the Planet at 21 October, or 23% (vendor, via AI Weekly; our maths) | Any measure of enterprise patch speed. OpenAI gave none (independent, CSO Online) |
Finding is measured. Fixing is not. Chris Hughes of Noma Security warned that improved discovery could widen the remediation gap, and that even a small out-of-scope rate at scale "means actions against systems nobody authorized" (independent, CSO Online).
Restricted access is not your protection
On 29 October Epoch AI reported that GLM 5.3, an open-weight model, built exploit chains against six Firefox releases at about $1,000 a version, once a research effort costing over $100,000 had built the harness (independent, Unite.AI). Each chain paired a flaw already public through a patch with an unpublished sandbox flaw, and the result was reading a local file, not arbitrary code execution. Mozilla fixed that sandbox flaw in Firefox 159. The same approach against Chrome produced no equivalent exploit (independent, Unite.AI).
So the gate around GPT-6 Cyber does not close your window. The exposed period runs from the day a fix goes public to the day your fleet has it. OpenAI's job is who gets the model. That period is yours.
Who should apply
| Your team | Position |
|---|---|
| Security team without its own research function | Do not chase Red. OpenAI points most defenders to Blue. Fix the patch gap first |
| Internal red team with authorised scope | Apply. Plan for network allowlisting, isolated environments, and human oversight, which OpenAI recommends (vendor, via The Decoder) |
| Critical infrastructure operator | OpenAI describes a separate Daybreak Red group (vendor, via MarketScale). Ask for its terms in writing |
| Software vendor shipping to enterprises | Your buyers will start asking how fast upstream fixes reach them. Have the number ready |
Six steps
Prerequisites: an asset inventory and patch deployment records with dates.
- Step 1. Measure your patch gap. Take three classes: managed browsers, Linux kernels, and internet-facing applications. For each, record days from public fix to full fleet deployment. Owner: vulnerability management lead.
- Step 2. Rank kernels by who can run code. The 948 are local privilege escalation, so an attacker needs a foothold first. CI runners, shared build hosts, container hosts, and shared desktops come first. Owner: platform engineering.
- Step 3. Set a browser deadline. Use Firefox 159 as a live test: check how much of your fleet had it within seven days of 27 October. Owner: endpoint lead.
- Step 4. Test your reboot capacity. Kernel fixes are only as fast as your reboot window. Find which hosts have none, and fix that before the queue grows. Owner: infrastructure lead.
- Step 5. Ask your vendors one question. How many days from an upstream fix to your shipped update? Put the answer in renewal terms. Owner: procurement with the CISO.
- Step 6. If you apply for access, write the scope first. Named targets, an isolated environment, allowlisted networks, and a person approving sensitive work. A 0.07% rate is an improvement, not a boundary. Owner: CISO.
Trade-offs
- Shorter patch windows. They cost change-control time and raise the risk of a bad update. Set the window by exposure, not one number for every system.
- Apply for access now. You learn early and find bugs in your own code. You also take on a model OpenAI rates Critical, and the governance to match.
- Wait for independent tests. Reasonable for model buying. Not for the patch gap, which needs no model at all.
Missing
- OpenAI's own post. It would not load, so we have not read its wording or method.
- Any independent test of GPT-6 Cyber. None is published, per The Decoder.
- Agreement on how many Linux findings were new. Only CSO Online gives a figure.
- Any OpenAI measure of enterprise patch speed or reduced exposure.
- A test by Prestanda. We have not used this model or run these steps in a client estate.
Frequently asked questions
Can we buy GPT-6 Cyber today?
Not on the open market. OpenAI released it to a select group of approved Daybreak Red customers through its API and Codex, and says all Red customers follow over the coming weeks. OpenAI recommends Daybreak Blue for most defenders.
Are the 948 exploits independently verified?
No. The figures are OpenAI's, as reported by the press, and The Decoder says no independent testing has been published. Reports also differ on how many of the Linux findings were previously unknown.
What should a CISO do first?
Measure the days from public fix to full deployment for browsers, Linux kernels, and internet-facing applications. That number decides your exposure, and improving it needs no access to the model.
Living page. Last updated 6 Nov 2026. We update this note when an independent test appears or OpenAI's post can be read.