GPT-6 Cyber's strongest control is the account that reaches it. Treat that login as privileged access
OpenAI's cyber model ships behind Daybreak Red, with FIDO2 keys, managed devices and IP allowlists. Its system card also shows where the model still fails, which matters as much for defenders.
Listen to this article · 5 min
AI-generated narration of the full article.
The most useful sentence in the GPT-6 Cyber system card is not a benchmark. It is the list of things an organization must have before it can use the model at all: single sign-on, multifactor authentication, managed devices, least-privilege access and, for individual researchers, a FIDO2 hardware key. API access is allowlisted by IP address by default.
That list tells security leaders where the real risk now sits. A model built to write exploits is only as safe as the account that can reach it.
What OpenAI shipped
GPT-6 Cyber is a variant of GPT-6 Astra post-trained for authorized security work: vulnerability discovery, exploit development and web penetration testing. OpenAI trained it with reinforcement learning on tasks such as reproducing crashes and searching codebases for flaws, and rewarded it for refusing less often when the request is legitimate. Under OpenAI’s Preparedness Framework it carries the same designation as Astra: Critical in cybersecurity.
Access runs through Daybreak Red, OpenAI’s gated access program for this kind of work, with identity verification and use restrictions on top of the organizational requirements above. Several safeguards sit around the model rather than in it:
| Control | What it does | Who has to run it | |
|---|---|---|---|
| Account requirements | SSO, MFA, managed devices, FIDO2 for individuals, IP allowlisting | The customer's identity and endpoint teams | |
| Compromise monitoring | Watches API keys and ChatGPT sign-in tokens for takeover | OpenAI | |
| Topic blocks | Refuses high-risk help on industrial controls, essential services and election systems | OpenAI, tested with Dragos | |
| Private Safety Processing | Encrypted safety records the customer retains for 30 days | Shared; usually required with Zero Data Retention | |
| Agent monitoring | Codex runs can pause for confirmation or be terminated | OpenAI |
Read the first row again. The control OpenAI cannot operate for you is the one that decides who gets in.
The login is now an offensive capability
Most companies classify access to an AI model as a software license. For this model, that classification is wrong. A stolen session for a Daybreak Red account is a stolen exploit-development service, and OpenAI’s own decision to monitor for account compromise says it expects attempts.
That moves GPT-6 Cyber into the same tier as domain admin rights or production signing keys. In practice:
- Put it behind privileged access management. Named accounts, approved purpose, time-bound sessions, and a review of who holds access every quarter, the way a SOC 2 auditor would expect for any privileged system.
- Bind it to managed hardware. The FIDO2 and managed-device requirements exist for individuals; apply them to every user in a team as well.
- Log the work, not only the login. The 30-day encrypted safety records are OpenAI’s. Your own record of which engagement, which target and which authorization letter each session served is what an incident review will ask for.
- Keep the scope letter next to the prompt. Authorized testing depends on written authorization for a target. A model that refuses less on legitimate requests makes that paper trail the only thing separating a test from an attack.
We made a similar point when Google gave Gemini 4 Carbon to cyber defenders first: the access gate is part of the product. GPT-6 Cyber goes one step further and pushes part of the gate onto the buyer.
What the model still cannot do
The system card is also unusually direct about limits, and defenders should read them as calmly as the capabilities.
On OpenAI’s internal port of ExploitBench, the model achieved arbitrary code execution in 42% of attempts on average across V8 and Chrome targets, against 39% for Astra. OpenAI notes that the benchmark uses vulnerabilities going back to 2023, which may inflate results through training-data contamination. In external testing by Irregular, neither GPT-6 Cyber nor Astra succeeded against fully hardened targets, and neither solved any of the 15 hardest challenges. On general coding it does not beat Astra.
So the model does not change the value of patching and hardening. It changes the speed at which known weakness gets turned into working exploits, which is the trend we described when Anthropic’s AI built full exploit chains. Hardened, patched systems remain hard. Systems that sit unpatched for months become cheaper to attack, for everyone with access to tools like this one.
The question for the security team
Two questions follow, and they belong to different people. The red team asks whether GPT-6 Cyber makes its engagements faster. The identity team has to answer who may hold a Daybreak Red login, on which device, and how the company would know within an hour if one were misused. If the second answer is weak, the first one does not matter.