A security model’s test score tells a different story than its permissions in a real environment.
OpenAI introduced GPT-6 Cyber on November 5, positioning it for vulnerability research and authorized security testing. Access runs through its Daybreak program. The release combines a more capable model with tighter restrictions on access to its most permissive security tier.
Daybreak access remains a separate decision
OpenAI describes Daybreak Blue as a route for verified defensive work and Daybreak Red as the tier for deeper exploit development and testing. GPT-6 Cyber sits within the latter. Approval for one workflow should not be read as permission to test unrelated systems.
The system card describes IP allowlisting by default for Daybreak Red API access, with limited exceptions. It also covers monitoring for compromised credentials. These controls constrain deployment; they do not replace an organization’s own target authorization, review, and incident procedures.
Read the evaluation conditions alongside the score
OpenAI reports 48.5% on ExploitGym, compared with 32.1% for GPT-5.6 Cyber. That is a 16.4-percentage-point difference, or about 51% relative improvement. The company classifies GPT-6 Cyber as Critical for cybersecurity under its own Preparedness Framework.
OpenAI also reports that the model avoided out-of-scope services in 99.93% of a separate evaluation without its deployment prompt. With that prompt, the reported result reached 100%. Those figures describe the tested conditions. They cannot establish that every future agent run will respect its boundaries.
Software fixes provide a narrower independent record
Mozilla’s Firefox 159 security advisory lists resolved vulnerabilities credited to OpenAI Codex Security. That is independent confirmation of specific reported fixes. OpenAI’s larger Linux and Firefox totals, and its model benchmark results, remain claims made by OpenAI.
For a security team, I would separate four pieces of evidence: access approval, the permitted target set, reproducible findings, and verified patches. A high benchmark score cannot stand in for any of those operational records. A patch should be checked against the affected version and the original defect.
Our earlier Daybreak guide explains the previous access model. The new release merits another review of scope controls before a team changes models. Which evidence would your organization require before letting an agent validate a vulnerability?
Abdessalam Alaoui
I'm Abdessalam Alaoui, founder of Musthave.AI. I write practical guides to AI models, tools, generative media.
