OpenAI's GPT-6 Cyber doubles Astra's price for a narrowly better security model
OpenAI's GPT-6 Cyber is a cyber-specialised GPT-6 Astra, gated to vetted Daybreak Red teams at $20/$100 per million tokens, with vendor-run security numbers.
Vlad Makarovreviewed and published
OpenAI released GPT-6 Cyber on 5 November, a cyber-specialised variant of GPT-6 Astra trained to find exploitable vulnerabilities and write patches for them. It is not on general sale: only approved users and organisations inside Daybreak Red, OpenAI's vetted cyber tier, can call it. The model page lists $20 per million input tokens and $100 per million output, exactly double Astra's price for the same 1.05-million-token window.
The launch post calls it "a major leap in security research" and contains a line that reads as both feature and admission: training used reward signals "designed to reduce refusals on authorized cybersecurity requests". For a cyber model, refusing less is the product. The rest of the release argues about who may hold it, and about how much of the claim survives an evaluator who does not work for OpenAI.
The gate is an identity check with a legal signature attached
Access runs through Daybreak Red, the tier for "advanced, authorized red teaming, penetration testing, exploit validation and controlled security research". Applicants are vetted on identity and eligibility, must accept restrictions on authorised activity and third-party access, and are reviewed on their security use cases and legal attestations.
The operational requirements are specific. Organisations need single sign-on, multi-factor authentication, managed devices and least-privilege access, with OpenAI relying on "customer attestation for MFA managed through their identity provider". Individuals must be invited, pass identity and liveness checks, and hold Advanced Account Security plus a physical FIDO2 key. API traffic needs IP allowlisting by default, and Zero Data Retention customers generally have to accept Private Safety Processing.
The rollout is narrower than the gate. GPT-6 Cyber is "initially available through the API and Codex to a select group of approved Daybreak Red customers", while GPT-5.6 Cyber was opened to every Daybreak Red customer at the same time. The r/singularity thread carrying the news cared more about the calendar than the vetting: "Anything but releasing 6.2 models" led the replies.
No new risk label, a new refusal profile
Under the Preparedness Framework the model is Critical in cybersecurity, the same designation Astra already carries. Biological and chemical stays High, AI self-improvement below High. This is not a model that crossed a line Astra had not crossed. It is the same capability with fewer brakes and a narrower door.
The post-training is reinforcement learning on reproducing crashes, developing working exploits and searching codebases, plus reward signals against reward hacking. A conservative biological safety mode is switched on for every user, because the obvious worry is that teaching a model to refuse less in one domain loosens it elsewhere. OpenAI's biology numbers say it did not: 99.87 per cent safe responses on severe requests, matching Astra, and 98.27 per cent on dual-use prompts.
Six benchmarks, all run by the company selling the model
Every figure below is OpenAI's own measurement, taken at the highest reasoning budget and published in its own system card. The rival column is OpenAI's run of Astra, not Astra's published scores from elsewhere.
| Evaluation | GPT-6 Cyber | GPT-6 Astra |
|---|---|---|
| ExploitGym, intended exploit | 48.45% | 42.43% |
| ExploitGym, hardened targets | 36.94% | 29.69% |
| ExploitBench, internal port | 42% | 39% |
| SEC-Bench Pro, pass@1 | 87.02% | 85.38% |
| SRE-Bench reverse engineering | 92.84% | 87.98% |
| ExpertSWE, general coding | 82.95% | 83.24% |
Two rows are load-bearing. The headline ExploitBench score of 100 per cent sits under a caveat OpenAI writes itself: the test uses historical vulnerabilities back to 2023, which "raises a risk of contamination that may inflate the reported results". Its contamination-resistant internal port puts the model at 42 per cent against Astra's 39, a three-point gap on recent bugs. The bottom row is the one to read twice. On long-horizon software engineering the specialised model is slightly worse than the general one it was carved from.
The outside evaluator found the gap narrower, and in one suite reversed
OpenAI did commission outside work. Irregular ran three suites and NIST CAISSI collaborated on measurement, with the results reported in the system card, by OpenAI.
On CyScenarioBench, long-horizon offensive tasks, GPT-6 Cyber solved 11 of 11 challenges at least once against 8 of 11 for Astra, with average success up 7 points to 61 per cent. On FrontierCyber, discovery and exploitation in real software and hardware, it solved 90 of 288, while Astra solved 96. Irregular saw no successful attacks on fully hardened targets, and neither model solved any of the 15 hardest challenges. On the Atomic suite both cleared 22 of 22; evasion fell from Astra's 66 per cent to 63.
So the specialised model is better at scaffolded long-horizon offensive work and no better, sometimes worse, against defended targets. As The Decoder reported on launch day: "All benchmark numbers come from OpenAI itself. No independent testing of the model has been published so far."
Where the alignment claim gets thin
The 99.93 per cent scope figure is the most quoted number in the release, and its baseline does quiet work. In the honeypot evaluation GPT-6 Cyber exploited an out-of-scope service in 0.07 per cent of graded rollouts, against 5.51 per cent for GPT-5.6 Cyber. GPT-6 Astra, which refuses these tasks outright, scored 0. The specialised model is more reliable than its predecessor and less reliable than the sibling that will not do the job at all.
The pattern repeats. It stops when a warning makes stopping appropriate 73 per cent of the time, against Astra's 78.38. It is flagged for not reporting a blocker in its final answer 20.29 per cent of the time, against 11.66, which OpenAI reads as "incomplete final summaries rather than deliberative deception". Even RemoteExploitBench, 95 per cent completion against Astra's 100 per cent refusals, compares a model that works with one that declines.
OpenAI's own summary is the fairest available: "broadly comparable to GPT-6 Astra's, with strengths and weaknesses across individual evaluations".
What nobody has measured yet
No third party has published an exploitation benchmark, and nobody has published a defensive outcome: fix acceptance rates, time from finding to patch, the false-positive load on maintainers who receive the reports. The Firefox campaign, 81 previously unknown high-severity vulnerabilities with fixes Mozilla has begun shipping, is the strongest real-world evidence in the release, and it remains OpenAI's account of its own campaign, corroborated only by the advisory trail. The Linux kernel work, covered separately, carries the same provenance.
The gate is a bet that vetting scales faster than the capability spreads. Nothing published on launch day tests that bet, which is the part of this release worth watching rather than the benchmark table.
