6 NOV 2026 — OpenAI released GPT-6 Cyber on 5 November, a security-research model it classes as "Critical" in cybersecurity under its Preparedness Framework. For now only a select group of approved customers of Daybreak Red, its tier for exploit development and authorised testing, can use it. The launch post leads with one result: 948 working privilege-escalation exploits for the Linux kernel, each of which could take an unprivileged local user to root.
A research post published a day earlier is the more useful document. It describes the automated pipeline behind the 948, how many findings each stage threw away, what each stage cost in API credits and how far kernel maintainers had got with fixes when the work stopped. Every figure below is OpenAI's own and no outside party has published a check of them. Where we have divided or added them ourselves, we say so.
| Stage | Output (OpenAI) | API cost, US$ (OpenAI) | Our arithmetic |
|---|---|---|---|
| Scout agents | 5,034 audit targets, about 2.8 million lines | 3,426 | 0.3% of total spend |
| Analyst agents | 2,308 candidate findings | 316,549 | 26.1% of total spend |
| Dynamic validation | 1,724 reproduced | 73,330 | 74.7% of candidates |
| Screening | 1,238 root-exploit candidates, 313 information-leak candidates | 44,194 | 71.8% of reproduced bugs flagged as root candidates |
| Exploit development | 1,169 working root exploits, 291 information-leak proofs | 775,929 | 94.4% of root candidates exploited; 64.0% of total spend |
| Variant analysis | 948 unique root exploits | not given separately | 41.1% of the 2,308 candidates |
The five stated stage costs add up to US$1,213,428, two dollars short of the US$1,213,430 total OpenAI reports. The run took place in mid-October 2026 against the latest kernel master branch, and the exploits were tested on virtual machines with the protections a standard distribution switches on, including SMEP, SMAP and KASLR.
Where did the pipeline look?
The kernel has more than 40 million lines of code, according to OpenAI. Reading all of it would be expensive, so the first agents picked 5,034 targets worth auditing, roughly 7% of the code base, for US$3,426. Analyst agents then spent 12 hours and US$316,549 on those targets and came back with 2,308 candidate findings after duplicates were removed.
That was too many for researchers to triage by hand, OpenAI says, and it is candid that finding bugs was not the hard part. Sorting them was.
How many bugs survived testing?
Within 30 hours the system reproduced 1,724 of the 2,308 candidates, which OpenAI gives as about 74.7%. Most of the rest needed elevated privileges or would not trigger inside the time budget, for reasons such as difficult race conditions. Only 3.1% reflected a wrong analysis by the model, the post says, where the reported flaw depended on a condition that could not occur.
A screening agent then sorted the reproduced bugs by what they could lead to. It flagged 1,238 as candidates for local privilege escalation and 313 as information leaks.
How did 1,169 exploits become 948?
Exploit-writing agents produced 1,169 working root exploits and 291 information-leak proofs of concept. By our subtraction, 69 of the 1,238 root candidates failed, and OpenAI reports exactly 69 unsuccessful cases at an average of US$3,922 each, against US$360 for each success. Those two averages give US$270,618 for the failures and US$420,840 for the successes, or US$691,458 together, close to the US$691,000 OpenAI states for the root-exploit stage. On that working, the 69 failures (5.6% of attempts) used about 39% of that stage's budget.
Many of the 1,169 exploits hit the same underlying bug by different routes. After variant analysis OpenAI wrote 948 distinct patches and uses that number as its count of unique flaws, so by our subtraction 221 exploits, or 18.9%, were duplicates. The post also records why human review stays in the loop. In an early run, 20 of 200 reported successes had reached root through a different zero-day from the one assigned.
How many are fixed?
By the end of the 10-day scan and review, the post says, 61 of these flaws were already fixed upstream and 43 more had patches in staging, while 299 were under public report and discussion. Elsewhere it credits the fixes in that window to other contributors. The post implies but does not state that all three counts come from the 948. If they do, 6.4% were fixed upstream, 11.0% were fixed or staged, and 545 (57.5%) were in none of the three states at that point.
The two OpenAI posts describe disclosure differently. The announcement says OpenAI "disclosed 304 critical findings to maintainers with candidate patches". The research post says it has sent "hundreds of reports and patches for critical vulnerabilities" and is releasing the rest gradually. Neither post says how the 304 relates to the 299 under public discussion.
The advice to defenders is blunt. For the near and medium term, OpenAI writes, a low-privileged account on a system missing its latest patches "should be considered functionally equivalent to root access for a well-resourced threat actor".
Is it getting cheaper?
Yes, on OpenAI's figures. In late July, using the same research harness, GPT-5.6 Sol found and exploited 166 unique root flaws for US$513,690, which works out to about US$3,095 per exploit. The October run spent US$1,213,430 on 948, or US$1,279.99 each by our division, which OpenAI gives as US$1,279. That is 5.7 times the output for 2.4 times the spend, and a per-exploit cost about 59% lower, even after three months of kernel hardening between the two scans. In June, GPT-5.5 Cyber had produced 24 such exploits; no cost was published for that run.
OpenAI says it focused on capability rather than cost, so its figures are "more an upper bound". It also prices the output. At the historical Pwn2Own and TyphoonPWN bounties for a Linux root exploit, US$20,000 and US$70,000, the 948 would be worth US$18.9 million to US$66.3 million. A smaller test against Google's kernelCTF programme produced 21 root exploits for about US$32,936, roughly US$1,568 each by our division. OpenAI's conclusion is that the pipeline "was net profitable at the time of this research", and that defenders should analyse their own software until exploiting it becomes too costly for attackers.
Why the Critical rating is not new
The announcement says GPT-6 Cyber is Critical, "up from High" for GPT-5.6 Cyber. The system card puts it differently. It gives the model the same designations as GPT-6 Astra, one of OpenAI's mainline models, which was already Critical in cybersecurity. The rating belongs to the GPT-6 generation. The Cyber variant adds post-training aimed at stronger security skills and fewer refusals of authorised work, and it completed 96% of exploit-development tasks in OpenAI's refusal test.
Against Astra the gains are modest. On ExploitGym the system card has GPT-6 Cyber at 48.45% against 42.43% for Astra; the 51% improvement in the announcement compares it with GPT-5.6 Cyber's 32.1%. Irregular, an outside evaluator, found the two broadly comparable. On its FrontierCyber suite GPT-6 Cyber solved 90 of 288 challenges to Astra's 96. Irregular saw no successful attack on a fully hardened target, and the 15 hardest challenges went unsolved by both models.
The browser claim can be partly checked. OpenAI says the model found 81 previously unknown high-severity Firefox flaws. Mozilla's advisory for Firefox 159, dated 27 October and linked from the announcement, lists 167 CVEs. By our count, 41 credit an OpenAI reporter (34 to "OpenAI Codex Security (kylebot)" and seven to "Amy Burnett of OpenAI"), and all 41 are rated high. The advisory does not say which model found them, so we cannot tie them to GPT-6 Cyber.
The Dragos report linked from the launch post did not test this model. OpenAI says industrial-security firm Dragos evaluated "cyber-permissive Daybreak Red models". Dragos's whitepaper, updated September 2026, covers GPT-5.5 Cyber and GPT-5.6 Sol; the Dragos quotation in the launch post names no model. The whitepaper assesses "with moderate confidence" that such models can lower the barrier for less-skilled attackers in industrial networks, and records that one model action caused a denial-of-service condition in a PLC.
On staying in scope, the system card reports that without deployment safety instructions GPT-6 Cyber attacked a planted honeypot service in 0.07% of graded runs, against 5.51% for GPT-5.6 Cyber and 49.5% for GPT-5.6 Sol. OpenAI also names it as one of the main models behind the infrastructure hardening work it published in October. Daybreak Red API access requires IP allowlisting by default, and OpenAI says it will extend GPT-6 Cyber to all Daybreak Red customers "soon".
View author profile → · Editorial policy
