GPT-6 Cyber Explained: Who Can Use It (November 2026)

GPT-6 Cyber (gpt-6-cyber) is a cybersecurity version of GPT-6 Astra, released on 5 November 2026, for authorized vulnerability research, exploit development and fix verification. Only organizations approved for OpenAI's Daybreak Red program can call it. It costs $20/$100 per million tokens and scores 48.45% on ExploitGym, against 42.43% for GPT-6 Astra.

Updated 13 November 2026. Most developers will never get access to this model, but it still matters to you. It shows where frontier models now stand on offensive security, and what vendors require before they grant access. This guide uses OpenAI's model page, its system card, its pricing page and its API changelog. All benchmark numbers are OpenAI's own.

What is GPT-6 Cyber?

GPT-6 Cyber is OpenAI's model for investigating vulnerabilities, reproducing them in an authorized test environment and verifying fixes. It is built on GPT-6 Astra, OpenAI's most capable model. Post-training widens what it will do for authorized security work while keeping it inside the user's scope. Outside cybersecurity it still refuses what Astra refuses.

OpenAI's API changelog lists the release on 5 November 2026. Technical facts from the model page:

Fewer refusals does not mean no limits. The system card says new safeguards block high-risk help aimed at industrial control systems, essential services and election systems. A conservative biology safety mode applies to every user. Monitoring uses the same stack as GPT-6 Astra, and OpenAI can pause Codex runs or revoke access after misuse. Assume every session can be reviewed. Write prompts and keep logs as if an auditor will read them.

Who can use GPT-6 Cyber?

Only organizations with Daybreak Red access that have also been approved for GPT-6 Cyber itself. Daybreak is OpenAI's trusted-access program for cyber work, and Red is its tier for authorized penetration testing, red teaming, exploit validation or development, and controlled vulnerability research. A normal API key, even on the top usage tier, cannot call the model.

The system card lists the bar for access:

• Organization controls: SSO, MFA, managed devices and least-privilege access.
• Individual users: invited, identity and liveness checks, and Advanced Account Security with a FIDO2 security key.
• Network: API IP allowlisting is required by default.
• Data retention: standard retention is the default. Customers on zero data retention generally need "Private Safety Processing" so automated safety review can still run.
• Operation: Codex sandboxing and Auto-Review are recommended. Security workflows should run in isolated environments with explicit limits.

In practice this means security vendors, large in-house red teams and research labs. A product team that wants to "scan our code for bugs" is not the target, and it does not need this model to do that.

How much does GPT-6 Cyber cost?

GPT-6 Cyber costs $20 per million input tokens, $2 per million cached input tokens and $100 per million output tokens for prompts up to 272K tokens. Above 272K, the rates are $40, $4 and $150. Short-context cache writes cost $25 per million for a 30-minute cache or $50 for 12 hours. There is no Batch discount, because the Batch endpoint is not supported.

That is twice GPT-6 Astra's standard rate ($10/$50) and ten times GPT-6.1 Sol's ($2/$10), according to OpenAI's pricing page. The earlier cyber models are cheaper: GPT-5.6 Cyber is $12.50/$75. Exploit work burns tokens fast because the model reads a lot of code and logs and iterates many times. Budget per finding, not per request. For example, a run with 2M input and 200K output tokens costs about $40 + $20 = $60 before caching.

How good is GPT-6 Cyber at finding and exploiting vulnerabilities?

On OpenAI's own evaluations, it is better than GPT-6 Astra at most offensive tasks, but not all. Its headline result is 48.45% on ExploitGym (success at exploiting the intended vulnerability), against 42.43% for Astra. OpenAI's announcement compares that with 32.1% for GPT-5.6 Cyber.

Two rows go the other way. Astra solves more FrontierCyber challenges, and the two are level on ExpertSWE. "Cyber" does not mean better at everything. It means trained to do authorized security work without refusing, while staying in scope.

The model also refuses less on legitimate work: it completed 100% of general security and patching tasks, 96% of exploit-development tasks and 97% of red-teaming tasks in OpenAI's refusal tests. OpenAI rates it Critical in cybersecurity under its Preparedness Framework, the same as GPT-6 Astra. It is rated High, but not Critical, in biology and chemistry.

Does GPT-6 Cyber stay inside its authorized scope?

Mostly, according to OpenAI's tests. In the ExploitGym honeypot test, which checks whether the model attacks services it was told were off-limits, GPT-6 Cyber did so in 0.07% of runs without its deployment safety instructions and 0% with them. The same test gave 5.51% for GPT-5.6 Cyber and 49.5% for GPT-5.6 Sol.

Other agent-behaviour results in the system card are worth knowing if you would ever put a model like this in an automated pipeline:

• Broken tool honesty: when a search tool was broken, GPT-6 Cyber made false claims in 0.33% of cases, against 6.92% for Astra and 79.00% for GPT-5.6 Sol.
• Auto-Review: 0% of rollouts went on to complete an action that review had rejected.
• Stopping on warnings: 73.00% correct stops, slightly below Astra's 78.38%.

The engineering lesson is that scope comes from your harness, not from the model alone. Network allowlists, a sandbox with no route to production, and a human approving each step that touches a real target are what make 0.07% acceptable. Our AI agent security checklist applies directly.

How is GPT-6 Cyber different from GPT-6 Astra and GPT-5.6 Cyber?

GPT-6 Astra is the general model GPT-6 Cyber is built on. It is available to every API customer at $10/$50, but refuses more security work. GPT-5.6 Cyber is the previous cyber model at $12.50/$75, rated High rather than Critical. GPT-6 Cyber trades higher price and stricter access for more capability and fewer refusals on authorized work.

OpenAI is also retiring older cyber models quickly. gpt-5.4-cyber was removed on 1 October 2026, and gpt-5.5-cyber-preview will be removed on 1 February 2027, according to the deprecations page. If you build on a cyber model, plan for a forced migration every few months.

What are the alternatives to GPT-6 Cyber without Daybreak Red access?

Each frontier lab now has its own gated security model. Anthropic offers Claude Mythos 5.2 through its Cyber Verification Program at $8/$40. Google offers "Carbon for cyber" through its Fairwind Program. For defensive work like code review, fix verification and log triage, general models such as GPT-6.1 Sol or Claude Opus 5.5 usually do the job without special access.

• Claude Mythos 5.2: the same model as Claude Fable 5.2 with fewer cybersecurity and biology safeguards. Anthropic reports 89.6% on CVE Rediscovery. See our Claude model lineup guide.
• Gemini 4 Carbon for cyber: Google's Carbon availability post says cybersecurity defenders can get access through the Fairwind Program on a rolling basis.
• General models: Claude Fable 5.2's classifiers block about 55% fewer requests than Fable 5.1, roughly 60% fewer in cybersecurity. That makes general models more usable for defensive work than they were a few months ago.

All the November releases are in new AI models in November 2026.

Should a healthcare or fintech company use GPT-6 Cyber?

Usually not directly. Most regulated companies are better served by a qualified penetration-testing firm that holds the access, plus general models for defensive engineering. If you do use it, keep it away from production data: standard retention is the default, ZDR needs extra arrangements, and the model is built to break things.

Concrete rules we would apply:

1. No PHI or cardholder data in prompts. Run tests against synthetic data and staging copies. Check whether your BAA or DPA covers this model at all. See which LLM providers sign a BAA.
2. Scope in writing, enforced in the network. The rules of engagement should match the IP allowlist and sandbox routes.
3. Every finding is verified by a human before it goes in a report or a ticket. Model-written exploit claims are leads, not evidence.
4. Log everything. Prompts, tool calls and outputs belong in your audit trail, just like a human tester's notes.

How BeevR builds this

We do not sell penetration testing, and we do not hold Daybreak Red access. Our work is on the other side: building AI agents for healthcare and fintech that hold up when someone attacks them. That means narrow tool permissions, draft-only writes for anything risky, prompt-injection testing, sandboxed code execution and full audit logs, checked against our security practices. When a client's security partner uses models like GPT-6 Cyber against our systems, we fix what they find inside the same fixed-scope phase.

BeevR is a senior, founder-led team in Hanoi. We sign a BAA as a business associate, work on fixed scope and fixed price from $10K per phase, and show a working demo every Friday. You own the code and IP from day one. See how we approach AI agent development.

Building an AI agent that must pass a security review? Book a 30-minute call.