OpenAI’s new cyber model raises both capability and cost
OpenAI has launched GPT-6 Cyber, a specialized version of GPT-6 Astra trained for authorized cybersecurity work such as vulnerability discovery, exploit development, web penetration testing and patch validation . The company is positioning the model not as a general ChatGPT upgrade, but as a gated tool for defenders who need stronger exploit-research capabilities with fewer inappropriate refusals and tighter scope control .
The launch matters because it pushes OpenAI’s most capable cyber tooling deeper into work that has historically required senior human researchers: reproducing crashes, proving exploitability, chaining findings into working demonstrations and producing candidate fixes . OpenAI says GPT-6 Cyber is rated “Critical” for cybersecurity under its Preparedness Framework, up from the “High” designation given to GPT-5.6 Cyber . That classification is not a marketing footnote; it is OpenAI’s formal signal that the model has crossed into a risk tier requiring stronger access controls, monitoring and operational safeguards .
The other headline is price. OpenAI’s published standard rate for GPT-6 Cyber is $20 per million input tokens and $100 per million output tokens, with cached input at $2 per million tokens . VentureBeat’s comparison, checked on November 5, places that above OpenAI’s own GPT-5.6 Cyber, Anthropic’s Claude Mythos 5.1 and Google’s Gemini 4 Argon Cyber Permissive on base input and output token rates . In other words, OpenAI is not racing to the bottom on cyber-model pricing; it is arguing that a more capable model can justify a premium if it produces more validated findings per analyst-hour.
What changed from GPT-5.6 Cyber
OpenAI describes GPT-6 Cyber as a cyber-specialized variant of GPT-6 Astra with post-training focused on security investigations and alignment . The system card says reinforcement learning rewards the model for tasks such as reproducing crashes, developing working exploits and searching codebases for vulnerabilities, while additional reward signals reinforce respecting authorization, staying within scope and accurately reporting results .
On ExploitGym, a benchmark that tests whether a model can exploit a specified vulnerability in a remote target, OpenAI reports that GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber . That is a 16.4-percentage-point gain and roughly a 51% relative improvement, which is why OpenAI is framing the model as a major jump rather than an incremental release .
OpenAI also reports that GPT-6 Cyber achieved 40.3% recall in a web-application vulnerability-discovery evaluation where models probe applications without access to source code, compared with 32.0% for GPT-6 Astra . The distinction is important: Astra is the broader frontier model, while Cyber is tuned for security workflows and for operating under Daybreak Red, OpenAI’s stricter access program .
The company also introduced RemoteExploitBench, a controlled evaluation using known vulnerabilities in applications such as GitLab, PostgreSQL and Jenkins . In that test, GPT-6 Cyber completed 95% of tasks, while GPT-6 Astra running under Daybreak Blue refused 100% of them . That result reflects both capability and access configuration: the same underlying model family can behave very differently depending on whether it is operating in a more permissive, approved defensive-security mode.
Linux and Firefox make the launch concrete
The most striking evidence is not only in synthetic benchmarks. OpenAI says its researchers used GPT-6 Cyber to reproduce 1,724 Linux kernel vulnerabilities and develop working exploits for 948 of them, more than five times the 166 exploits produced by GPT-5.6 Sol under the same research harness . The company says it disclosed 304 critical findings to Linux maintainers with candidate patches and is continuing work to get other vulnerabilities fixed .
Axios highlighted the same Linux campaign, reporting that the system identified 1,724 security flaws and found ways to use 948 of them to gain administrator-level access in Linux systems for about $1.2 million in API credits . The cost figure is useful context: a million-dollar research campaign is expensive, but it is also the kind of budget large vendors, hyperscalers and government-backed defensive programs already spend on vulnerability research.
Firefox is the second major case study. OpenAI says GPT-6 Cyber produced evidence and reproducible tests for 81 previously unknown Firefox vulnerabilities classified by Mozilla as high severity, and also showed that 30 known issues were more severe than previously reported . The company says it disclosed those findings to Mozilla with proposed patches, and that Mozilla began landing fixes after receiving the reports .
These examples are why the launch is strategically different from a normal model release. GPT-6 Cyber is not merely answering questions about code; it is being used in workflows that can find vulnerabilities, validate exploitability and suggest repairs across highly scrutinized software projects.
The pricing bet: premium tokens, not commodity tokens
OpenAI’s price point is unusually direct. VentureBeat’s table lists GPT-6 Cyber at $20 per million input tokens, $100 per million output tokens and $2 per million cached-input tokens . GPT-5.6 Cyber is listed at $12.50 input and $75 output, while Anthropic’s Claude Mythos 5.1 is listed at $10 input and $50 output . Google’s Gemini 4 Argon Cyber Permissive is listed at $4 input and $20 output, with cached input at $0.20 .
That makes GPT-6 Cyber twice as expensive as Anthropic’s Mythos 5.1 on base input and output tokens, and five times Google’s Argon Cyber Permissive on the same base comparison . It is also 60% more expensive than GPT-5.6 Cyber on input tokens and about 33% more expensive on output tokens .
But token pricing is not the same as investigation pricing. If GPT-6 Cyber needs fewer attempts, less human prompting, fewer dead-end tool calls or less rework to produce a validated finding, the premium could still be economical for some teams. Conversely, if a security team mostly needs triage, code review or patch explanation rather than long-running exploit development, a cheaper model may deliver better value.
The procurement question is therefore shifting from “Which model has the cheapest tokens?” to “Which model produces the most verified, in-scope security results per dollar and per analyst-hour?” That is exactly where OpenAI wants the conversation to go.
Access is restricted by design
GPT-6 Cyber is initially available through the API and Codex to a select group of approved Daybreak Red customers . OpenAI says it plans to expand access to all Daybreak Red customers, while also making GPT-5.6 Cyber available to all Daybreak Red customers and expanding Daybreak Blue access for GPT-6 Astra to more organizations and individual researchers .
The system card says GPT-6 Cyber access is restricted through Daybreak Red with identity verification, use restrictions and organizational security requirements such as single sign-on, multi-factor authentication and API IP allowlisting . For API customers using Zero Data Retention, OpenAI generally requires Private Safety Processing, which reviews encrypted safety records retained in customer storage for 30 days without exposing the underlying prompts and responses to OpenAI personnel .
OpenAI is also introducing Daybreak Red for Critical Infrastructure, a group designed for approved defenders working on essential systems such as power plants, water treatment facilities and operational-technology environments . This is a difficult balance: the same techniques needed to validate industrial-control vulnerabilities can also be dangerous if used outside authorization.
The safety question: stronger agents, tighter boundaries
OpenAI’s central safety claim is that GPT-6 Cyber is not only more capable, but also better at staying inside the assignment. In an ExploitGym Honeypot evaluation, OpenAI placed tempting, vulnerable supporting services near the assigned target to test whether the model would attack out-of-scope systems . Without deployment safety prompts, GPT-6 Cyber avoided exploiting those out-of-scope services in 99.93% of tests, compared with 94.49% for GPT-5.6 Cyber; with deployment prompts, it stayed within bounds 100% of the time in that evaluation .
The system card adds more nuance. In one scope evaluation, GPT-6 Cyber exploited the honeypot in 0.07% of graded rollouts, compared with 5.51% for GPT-5.6 Cyber and 49.5% for GPT-5.6 Sol, while GPT-6 Astra recorded 0% . That is a major improvement, but it is not the same as a guarantee. Evaluations are controlled tests, not proof that a deployed agent will never make a dangerous choice.
OpenAI’s safeguards include cyber-specific misalignment monitoring, targeted monitoring for emerging threats, protections against stolen credentials, IP allowlisting for Daybreak Red API access and stronger checks around high-risk activity involving critical systems . The company is also explicit that human oversight, sandboxing and action review remain necessary for high-risk workflows .
Competitive positioning against Anthropic and Google
OpenAI is entering a field that is already segmented by trust programs and restricted-access models. Anthropic’s Claude Mythos 5.1 is available to vetted organizations through trusted-access programs, while Google’s Gemini 4 Argon Cyber Permissive is available behind an allowlist and can be requested through Google’s Fairwind Program . Google’s documentation says Argon Cyber Permissive is designed for defensive cybersecurity use cases including vulnerability discovery, reverse engineering, exploit verification and patch generation, and that access to Gemini 3.8 Flash Cyber does not automatically carry over .
The competitive difference is not simply model capability. Each vendor is making a different trade-off among price, safeguards, approval processes, data retention and the kinds of cyber workflows it is willing to support. OpenAI’s bet is that approved customers will pay more for a model that can handle deeper exploit development while staying more reliably inside authorized scope.
Why this launch matters
GPT-6 Cyber marks a late-2026 inflection point in AI-assisted security. The model’s reported Linux and Firefox results show that frontier systems are becoming useful in real vulnerability research, not just in capture-the-flag exercises or code-review demos . At the same time, the restricted rollout and higher price show that OpenAI sees these capabilities as powerful enough to require both gatekeeping and premium economics .
For defenders, the opportunity is clear: more vulnerabilities can be found, reproduced and patched faster. For software maintainers, the challenge is equally clear: AI may increase the volume and technical depth of vulnerability reports faster than existing triage processes can absorb. For enterprises, the buying decision will come down to evidence, governance and workflow fit.
The launch of GPT-6 Cyber is therefore less about a single model name than about the next phase of AI competition: not just who has the smartest model, but who can safely commercialize the most powerful agents for high-stakes technical work.