OpenAI releases GPT-6 Cyber for vulnerability research at a premium

OpenAI introduced GPT-6 Cyber, a specialized model for cybersecurity research. The company says it is better at finding vulnerabilities and creating exploits while respecting the limits set by researchers. Access is currently limited to approved participants in the Daybreak Red program. The price is $20 per million input tokens and $100 per million output tokens, higher than the rates for its predecessor and competing models from Anthropic and Google.

OpenAI releases GPT-6 Cyber for vulnerability discovery and security testing

For enterprise teams, the model could help test defenses and prepare fixes. But access is limited, and token prices do not show what a completed investigation will cost. Individual specialists and organizations can apply to Daybreak Red. OpenAI asks applicants to provide information for review, including specific scenarios for defensive use of the model and its other cybersecurity products.

OpenAI plans to expand access through Daybreak Red and make GPT-6 Astra more widely available through the more open Daybreak Blue program. The company did not say which organizations and specialists are already participating, but said that more than 2,000 participants had joined the programs by last month.

What changed from GPT-5.6 Cyber

OpenAI describes GPT-6 Cyber as a version of GPT-6 Astra with additional training for security investigations. According to the model card, reinforcement learning rewards it for reproducing failures and creating exploits, as well as for staying within permitted boundaries and describing results accurately.

In OpenAI’s preparedness framework, the model’s cybersecurity level is rated critical. GPT-5.6 Cyber was rated high; GPT-6 Astra had already received a critical rating.

On ExploitGym, which tests whether a model can exploit a specified vulnerability, GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber. That is a difference of 16.4 percentage points, or about 51% relative to its predecessor’s score.

In a separate web application test, GPT-6 Cyber found 40.3% of vulnerabilities. The test was conducted without access to the applications’ source code; GPT-6 Astra found 32%.

OpenAI also launched RemoteExploitBench, a test of known vulnerabilities in applications including GitLab, PostgreSQL and Jenkins. GPT-6 Cyber completed 95% of the tasks, while GPT-6 Astra in Daybreak Blue declined all of them. The result reflects both the models’ capabilities and the restrictions imposed by their access settings.

The 95% figure comes from a different test than the task-completion score cited by VentureBeat in its August article about GPT-5.6 Cyber. Matching percentages in headlines do not prove that the models performed equally.

Linux and Firefox testing

OpenAI says researchers used GPT-6 Cyber to reproduce 1,724 Linux kernel vulnerabilities and create working exploits for 948 of them. Under the same conditions, GPT-5.6 Sol helped prepare exploits for 166 vulnerabilities.

OpenAI said it reported 304 critical findings to Linux maintainers and proposed fixes. Work on other fixes is ongoing. The number of exploits does not mean that all these vulnerabilities were previously unknown or had already been fixed.

For Firefox, OpenAI reported 81 previously unknown vulnerabilities that Mozilla classified as high severity, along with 30 known issues that researchers believed should have received higher severity ratings. They provided reproducible tests and proposed fixes. According to OpenAI, Mozilla began implementing the fixes after receiving the reports.

One customer also described using the model. CodeRabbit CEO Harjot Gill called GPT-6 Cyber the strongest model his company had tested for security analysis in an announcement. According to CodeRabbit, on its internal benchmark the model found 66% more medium- and high-severity issues than the model the company uses in production.

These accounts describe the work of individual teams, but they do not provide a consistent, independent comparison of models from different providers.

What working with the model costs

The comparison below is based on published standard rates in dollars per million tokens as of November 5. For OpenAI, it uses base rates or short-context pricing; for Google, prices at global endpoints. Cache reads do not include the cost of creating and maintaining the cache.

GPT-6 Cyber costs 60% more than GPT-5.6 Cyber for input tokens and about 33% more for output tokens. GPT-6 Cyber’s base input and output rates are twice those of Mythos 5.1 and five times those of Argon Cyber Permissive.

The final price also depends on caching and request size. Writing to the GPT-6 Cyber cache costs $25 per million tokens for 30-minute storage and $50 for 12-hour storage. If a GPT-5.6 Cyber request exceeds 272,000 input tokens, higher rates apply to the entire request: twice the base rate for input tokens and 1.5 times the base rate for output tokens.

Anthropic charges $12.50 per million tokens to write to the Mythos 5.1 cache with five-minute storage, or $20 with one-hour storage. The company’s documentation also notes that token counts vary across model generations. Google’s temporary discount on standard Argon does not apply to Argon Cyber Permissive.

This is a comparison of token rates, not the cost of a completed investigation. Different models may need different amounts of context, reasoning and repeated tool responses before finding a confirmed issue. Costs also depend on infrastructure for isolated execution and on specialists reviewing the results.

How Anthropic and Google limit access

Anthropic’s Mythos 5.1 is designed for research in cybersecurity and biology. Access is limited to vetted organizations. Anthropic also offers Claude Security, powered by Mythos 5.1, and accepts applications for expanded cybersecurity capabilities through its Cyber Verification Program.

Google’s Argon Cyber Permissive supports vulnerability discovery, reverse engineering, exploit testing and fix development. Customers apply through Fairwind or their Google team. Approval for the cheaper Flash Cyber does not automatically grant access to Argon Cyber Permissive.

All three offerings target overlapping tasks. But published prices alone are not enough to determine which model will deliver more useful results for a particular codebase or security team.

OpenAI emphasizes staying within permitted boundaries

OpenAI links its new test of boundary adherence to a previous incident involving Hugging Face. In the ExploitGym Honeypot test, vulnerable auxiliary services are placed near the target and may attract the model’s attention. To pass, the model must recognize that attacking those services is outside the scope of the task.

Without deployment guardrail prompts, GPT-6 Cyber avoided unauthorized attacks in 99.93% of tests, compared with 94.49% for GPT-5.6 Cyber. With those prompts, the new model stayed within the specified boundaries in every case tested. These figures apply to this specific test and do not guarantee the same behavior in real-world use.

OpenAI supplements training with technical restrictions and monitoring. Access to the API through Daybreak Red typically requires network addresses to be approved. API customers using zero data retention generally need to enable Private Safety Processing. According to the company, this system checks encrypted interaction records that are stored by the customer for 30 days.

OpenAI has also introduced Daybreak Red for Critical Infrastructure, a separate access group for approved teams testing critical systems. The company also pointed to its existing $1 billion program, which subsidizes access for resource-constrained defenders.

For security leaders, choosing a model depends on more than its ability to produce an exploit. What matters is whether it stays within the task’s boundaries, whether an engineer can reproduce its findings, and whether the number of verified discoveries justifies the model’s cost and the work required to review its results.

Dataist’s take: The test results and Linux and Firefox examples make GPT-6 Cyber worth considering for research, but they do not allow a direct comparison with competitors’ models on overall utility or cost. OpenAI stresses access restrictions and checks that the model stays within permitted boundaries; however, behavior in tests does not guarantee the same results in real-world use.