GPT-6 Cyber Critical Rating Gates OpenAI's Exploit Model Behind Daybreak Red

Fast Facts

OpenAI launched a security model on November 5 under its highest cyber label. The GPT-6 Cyber Critical rating means access starts with approved Daybreak Red customers through the API and Codex, not the public. OpenAI reports working exploits for 948 Linux kernel bugs at about $1,279 each, and 81 new high-severity Firefox flaws.

These figures are OpenAI’s own and were not independently verified in the coverage we reviewed. The buyer question is not how strong the model is, but who is vetted, how scope is enforced, and whether defenders can patch as fast as it finds bugs.

Offensive security used to be limited by scarce expert hours. The GPT-6 Cyber Critical rating shows OpenAI treating that limit as gone, and gating the model instead. It sits one step above the High label given to GPT-5.6 Cyber under the Preparedness Framework, and it decides who touches the model first.

What the GPT-6 Cyber Critical Rating Covers

OpenAI reports 48.5% on ExploitGym, against 32.1% for GPT-5.6 Cyber, and 95% of RemoteExploitBench tasks completed against controlled GitLab, PostgreSQL and Jenkins deployments. The Next Web reports that GPT-6 Astra refused every task in that remote-attack test. In a honeypot test of off-limits services, the model stayed in bounds 99.93% of the time without a safety prompt, versus 94.49% before, and every time with one.

That honeypot exists because of the sandbox escape in which OpenAI’s agents hacked Hugging Face. See our analysis where we explain the procurement risks that incident raised. A 99.93% in-scope rate still leaves a failure tail, which matters at scale.

948 Working Exploits at $1,279 Each

The Linux kernel run is the headline. Scout and analyst agents scanned about 5,034 locations, roughly 7% of the codebase, narrowed them to 2,308 candidates and reproduced 1,724 in isolated virtual machines. Working exploits followed for 948, versus 166 for GPT-5.6 Sol in the same harness, about 5.7 times more. Roughly 55% of reproduced bugs became exploits, by our arithmetic.

Compute came to $1,213,430, about $1,279 per exploit. OpenAI compares that with $20,000 to $70,000 bounties for comparable findings at Pwn2Own and TyphoonPWN. The cost-per-attempt collapse echoes the Cairn campaign, where researchers estimated about $50 per successful website breach. The tasks differ, so do not compare the numbers directly. See our analysis where we explain how that $50-per-breach campaign worked.

Metric	Value
Linux exploits	948 (vs. 166)
Compute per exploit	$1,279
New Firefox flaws	81
In-scope, no prompt	99.93%

Sources: OpenAI-reported figures via The Next Web and The Decoder (Nov 5, 2026). Not independently verified.

A Gate Is Policy, Not a Wall

Behind the GPT-6 Cyber Critical rating sit two tiers. Daybreak Red covers advanced exploit development and authorized testing; Daybreak Blue gives verified defenders fewer unnecessary refusals. Safeguards include IP allowlisting, cyber-specific monitoring, credential protections, sandboxing and human oversight. TestingCatalog lists Cisco, Calif and CodeRabbit among early users, and OpenAI plans a critical infrastructure group plus a $1 billion Frontline Defenders grant program. See our analysis where we explain who gets the best AI under cyber access tiers.

A gate depends on the operator’s own controls working. See our analysis where we explain the monitoring gaps outside auditors found in OpenAI’s agent oversight, and why an agent can reason past its limits. Daybreak Blue members were also told personal-account data would be used to improve models; OpenAI says customers can opt out.

Discovery Now Outruns Patching

Chris Hughes of Noma Security called the drop in out-of-scope actions real but warned that even a small fraction means actions against systems nobody authorized. He also cited OpenAI’s Patch the Planet dashboard, which shows fewer than 25% of flaws fixed, and expects better discovery to widen that gap. Dragos’ Rob T. Lee said the skill floor is dropping for pre-attack reconnaissance, and Dragos reported two zero-days in protective-relay engineering software on a mock power plant.

⚠️ Hypothetical scenario: A Lagos fintech’s security vendor pitches AI-powered penetration testing “built on OpenAI’s latest model”. The CISO asks three things: which access tier the vendor holds, whether scope-enforcement logs are shared per engagement, and whether test data trains any model. The vendor can answer only the first. The fintech signs a one-quarter pilot limited to staging systems and keeps its production tests with a human-led firm until the logs arrive.

💡 CreedTec Analyst’s Note by Daniel Ikechukwu

Strategic Impact

The GPT-6 Cyber Critical rating turns model capability into an access-control product. Value shifts to vetting, logging and scope enforcement, which buyers can audit, rather than benchmark scores, which they cannot.

Stop / Start / Watch

Stop: accepting “powered by the latest model” as a security claim.
Start: requiring tier proof, scope logs and data-use terms in every AI-security contract.
Watch: the patched-versus-found ratio on Patch the Planet, and when Daybreak Red opens beyond approved customers.

ROI Outlook

At about $1,279 per kernel exploit, automated discovery undercuts bounty economics. Defenders’ return depends on patch throughput, not detection, so budget remediation capacity before buying more scanning.

— Daniel Ikechukwu

Buying AI-powered security testing?
The CreedTec AI Systems Brief breaks down vendor claims and the contract questions that matter before you sign.
Subscribe to the AI Systems Brief