OpenAI launches GPT-6 Cyber with stronger exploit research and higher API price than Anthropic and Google

OpenAI released GPT-6 Cyber today, a specialized security model that the company says can uncover and exploit more software vulnerabilities while more reliably respecting the limits researchers impose.

For enterprise security teams, the launch offers another tool for testing defenses and developing fixes, but access requires approval and its published token prices exceed those of competing cyber models from rivals Anthropic and Google.

OpenAI’s developer documentation lists GPT-6 Cyber at $20 per million input tokens and $100 per million output tokens, with cached input at $2 per million tokens. Those base rates put it above both its predecessor and rival offerings.

The model initially reaches selected customers through Daybreak Red, OpenAI’s gated access program for advanced, authorized security work. It accepts individuals and organizations through the program, provided they upload information OpenAI uses for review, such as the specific defensive workflows for which you plan to use the model (and other OpenAI cyber models/products).

OpenAI plans to extend access across that tier, while also expanding access to GPT-6 Astra through its broader, less restrictive Daybreak Blue cybersecurity program. OpenAI hasn't specified which or organizations and individuals are currently participating, but says it has enrolled upwards of 2,000 entities as of last month.

What changes from GPT-5.6 Cyber

OpenAI describes GPT-6 Cyber as a variant of GPT-6 Astra with additional training for security investigations. Its system card explains that reinforcement learning rewards success on activities such as reproducing crashes and constructing exploits, alongside behavior that respects authorization and accurately describes results.

The company rates its cybersecurity capability Critical under its Preparedness Framework, up from High for GPT-5.6 Cyber. GPT-6 Astra already carries the same Critical designation.

On ExploitGym, which tests whether a model can exploit a specified weakness, OpenAI reported a 48.5% score, compared with 32.1% for GPT-5.6 Cyber. That represents a 16.4-percentage-point gain, or approximately 51% relative improvement.

On a separate test of web applications, conducted without access to application source code, GPT-6 Cyber found 40.3% of vulnerabilities, compared with 32% for Astra.

OpenAI also introduced RemoteExploitBench, an evaluation involving known vulnerabilities in applications including GitLab, PostgreSQL and Jenkins. GPT-6 Cyber completed 95% of the tasks, while Astra under Daybreak Blue refused every task. That contrast measures both what the models can accomplish and what their access configurations permit.

The 95% figure comes from a different evaluation than the completion-rate benchmark cited in VentureBeat’s August coverage of GPT-5.6 Cyber. The identical headline percentages do not establish equal performance between generations.

Linux and Firefox supply evidence beyond benchmarks

OpenAI said researchers using GPT-6 Cyber reproduced 1,724 Linux kernel vulnerabilities and developed working exploits for 948. Using the same research setup, GPT-5.6 Sol produced exploits for 166.

The company said it disclosed 304 critical findings to Linux maintainers with proposed patches and continues working on additional fixes. The exploit total should not be read as a count of previously unknown or already patched flaws.

For Firefox, OpenAI reported 81 previously unknown vulnerabilities that Mozilla classified as high severity, plus evidence that another 30 known issues deserved higher severity assessments. Researchers supplied reproducible tests and suggested repairs; Mozilla began incorporating fixes after receiving the reports, according to OpenAI.

Customer endorsements describe related work. CodeRabbit CEO Harjot Gill said in the announcement: “GPT‑6 Cyber is the strongest model we’ve tested for security review.” CodeRabbit reported finding 66% more medium- and high-severity issues on its internal benchmark than its production model found.

These customer reports support the operational case for the model, but the announcement does not establish a common, independently administered performance comparison across rival vendors.

Pricing: more expensive than its predecessor and competing cyber models

The following comparison uses published standard API rates in U.S. dollars per million tokens, checked November 5. OpenAI figures use the documented base or short-context rates; Google figures use global endpoints. Cached-input prices refer to reads or hits, not the complete cost of creating and maintaining a cache.

Sources: OpenAI’s GPT-6 Cyber and GPT-5.6 Cyber model pages; Anthropic pricing; Google Cloud pricing. Access: Anthropic Mythos, Argon Cyber Permissive, and Flash Cyber.

GPT-6 Cyber costs 60% more for input and approximately 33% more for output than GPT-5.6 Cyber. Its base input and output rates are twice Mythos 5.1’s and five times Argon Cyber Permissive’s.

Caching and request size complicate that comparison. OpenAI lists GPT-6 Cyber cache writes at $25 per million tokens for 30 minutes or $50 for 12 hours. GPT-5.6 Cyber requests exceeding 272,000 input tokens incur twice the base input rate and 1.5 times the output rate across the request. Anthropic lists Mythos 5.1 cache writes at $12.50 for five minutes or $20 for an hour; its documentation also notes that tokenization differs across model generations. Google’s temporary promotion for ordinary Argon excludes Cyber Permissive.

These are token-price comparisons, not measurements of cost per completed investigation. Models can consume different amounts of context, reasoning and repeated tool output to reach a validated finding. Sandbox infrastructure and analyst review also affect deployment economics.

Rivals offer different routes into restricted security work

Anthropic’s Mythos 5.1 targets cybersecurity and biology research, with access limited to vetted organizations. The company also runs Claude Security on Mythos 5.1 and accepts applications for advanced cyber capabilities through its Cyber Verification Program.

Google’s Argon Cyber Permissive supports vulnerability discovery, reverse engineering, exploit verification and patch generation. Customers apply through Fairwind or their Google team; approval for the cheaper Flash Cyber model does not automatically grant Argon access.

These offerings compete for overlapping work, but the published prices alone do not show which model produces the most useful findings for a particular codebase or security team.

OpenAI puts authorization at the center of deployment

OpenAI explicitly connects its new scope-following evaluation to the earlier Hugging Face incident. Its ExploitGym Honeypot test places tempting, vulnerable supporting services beside an assigned target. Success requires the model to recognize that attacking those services falls outside the assignment.

Without deployment safety prompts, GPT-6 Cyber avoided those unauthorized attacks in 99.93% of tests, compared with 94.49% for GPT-5.6 Cyber. With the prompts, it stayed within scope in every tested case. Those results describe the evaluation, rather than a guarantee about production behavior.

OpenAI pairs that training with monitoring and account controls. Daybreak Red API access generally requires approved network addresses. API customers with Zero Data Retention generally must use Private Safety Processing, which checks encrypted interaction records stored by the customer for 30 days, according to the announcement.

The company also introduced Daybreak Red for Critical Infrastructure, an additional access group for approved teams testing essential systems, and highlighted its existing $1 billion program subsidizing access for resource-constrained defenders.

For security leaders, the procurement decision extends beyond whether an agent can demonstrate an exploit. It includes whether the agent stays within its assignment, produces evidence engineers can reproduce, and delivers enough validated findings to justify both its price and the review work around it.