GPT-6 Cyber: falsify ExploitGym and honeypot scores, not “defender window closed”

OpenAI published GPT-6 Cyber on 2026-11-05, saying the model finds and validates exploitable vulnerabilities while staying inside researcher-set scope, with clear gains over GPT-5.6 Cyber. The checkable figures in the post include ExploitGym at 48.5% versus 32.1%, scope-honeypot compliance at 99.93% without the deployment prompt and 100% with it, plus named campaign counts on Linux and Firefox under authorized research.

The news core is those public benchmarks and named findings, not a slogan that “aligned cyber agents have closed the defender window.” OpenAI marks the model Critical for cybersecurity under its Preparedness Framework (up from High for GPT-5.6 Cyber), and splits Daybreak Red for deeper authorized testing from Daybreak Blue for validation and patching with fewer needless refusals.

This piece analyzes the announcement only. It does not restate exploit steps or PoCs. Readers should use the system card protocols for ExploitGym and the honeypot, plus public Mozilla fix records, to test whether the scores and named findings hold.

Hard facts (OpenAI post, accessed 2026-11-06; dated 2026-11-05):

• Role: a cybersecurity model trained to find and validate exploitable vulnerabilities while remaining inside authorized scope.
• ExploitGym (exploit a specified vulnerability on a remote target): GPT-6 Cyber 48.5% vs GPT-5.6 Cyber 32.1%; OpenAI calls that about a 51% relative gain.
• New offensive web pentest eval (probe apps without source): 40.3% recall vs 32.0% for GPT-6 Astra.
• RemoteExploitBench (known bugs in controlled GitLab, PostgreSQL, Jenkins, and similar): GPT-6 Astra with Daybreak Blue refused 100% of tasks; GPT-6 Cyber completed 95%, failing only when an exploit would not work remotely.
• Scope alignment (ExploitGym Honeypot, informed by the Hugging Face incident): without deployment safety prompts, avoided out-of-scope services in 99.93% of cases (94.49% for GPT-5.6 Cyber); with prompts, 100%.
• Real systems (company narrative): a Firefox campaign produced evidence and reproducible tests for 81 novel high-severity issues as classified by Mozilla, showed 30 known issues were more severe than reported, and offered candidate patches; on Linux, reproduced 1,724 vulnerabilities and developed working exploits for 948 (166 for GPT-5.6 Sol on the same harness), disclosing 304 critical findings to maintainers with candidate patches.
• Customer quotes (Cisco, Calif, CodeRabbit, CrowdStrike, Palo Alto Networks, SentinelOne, Perplexity, Cognition, and others) report internal benchmarks or usage; Cognition cites 23% vs a prior best of 13% on an internal novel discovery/exploitation bench; CodeRabbit cites 66% more high/medium issues than its production model. Those are customer claims, not independent reruns.
• Access: initially via API and Codex to a select group of approved Daybreak Red customers, with plans to expand to all Daybreak Red and to offer GPT-5.6 Cyber to all Daybreak Red. The post also describes a critical-infrastructure Daybreak Red group and Frontline Defenders subsidies.
• Safeguards: cyber misalignment monitoring, targeted monitoring for emerging threats, Private Safety Processing, default IP allowlisting for Daybreak Red, sandboxing and human oversight guidance, and tighter blocks on high-risk OT/ICS-style assistance; Dragos ran controlled critical-infrastructure evaluations.

The system card is cited for full results and settings. This article does not expand exploit detail.

Evidence strength: primary product and security-research announcement with a system-card pointer. ExploitGym, honeypot compliance, RemoteExploitBench, and web recall are company evals. The Linux 948 and Firefox 81 counts are campaign narratives; Firefox has a public pointer that Mozilla began landing fixes; Linux has a maintainer-disclosure narrative. Customer quotes and internal percentages are secondary endorsements, weaker than rerunnable benches.

Falsification path: rerun ExploitGym and the scope honeypot per the system card; check Mozilla advisories or bug trackers for the “81 high-severity novel” scale and timeline; check Linux disclosure records for the 304 critical reports. Preparedness “Critical” is an in-house label. Stretching it to “the defender window is closed” needs independent incident data the post does not supply.

Steelman: if third parties land near 48.5% on the same ExploitGym protocol, honeypot compliance near the reported rates, and Mozilla fix records match the “81 high-severity” scale, then “capability and scope-keeping both up versus GPT-5.6 Cyber” holds. Customer-internal 23% / 66% figures still need public protocols before they travel.

Strongest steelman: shipping “hits harder” and “stays in scope” on one release, with a honeypot eval aimed at the known failure mode of agents attacking out-of-scope helper services, and splitting Daybreak Blue vs Red so validation/patching and deep authorized testing are not forced through one gate.

Steelman risks: most headline scores remain company-reported; RemoteExploitBench’s 95% needs the system card to judge sample size and task narrowness. Better lab alignment does not prove no out-of-scope behavior after prompt stripping or toolchain changes. The Linux 948 and Firefox 81 counts are authorized-research output tallies, not proof that field offense/defense has flipped. Dragos work and OT/ICS block-rate charts are company safety narrative; public readers do not get the raw lab pack.

The post says the window to harden software with frontier models is limited. That is strategy language, not a benchmark row falsifiable inside this article. So the falsifiable object stays on scores, compliance rates, and named findings; window rhetoric stays opinion.

For security teams, the next six months are Daybreak Red expansion pace, whether system-card numbers get independent reruns, and whether Mozilla/Linux fixes keep matching disclosed scale. For open-source maintainers, pressure is disclosure and patch quality, not model marketing. For policy and critical-infrastructure operators, whether OT/ICS-related blocks and Frontline Defenders subsidies change who can run authorized tests matters more than slogans.

For model labs, this release ties capability gains to scope-keeping on one scorecard: publishing only exploit success without out-of-scope rates will look incomplete. For ordinary developers, mainline models (GPT-6 Astra in the post) remain the default for review and triage; Cyber access stays on a controlled list.

GPT-6 Cyber should be judged on ExploitGym 48.5% vs 32.1%, scope-honeypot compliance, and whether named Firefox/Linux findings line up with public fixes and disclosures, not on “aligned cyber agents closed the defender window.” If the scores and disclosures hold, it is a substantial security-research model release. If they do not, it remains a company benchmark post.

Also: this article provides no exploit steps or PoCs. Readers who need technical detail should use authorized channels and the system card, not reconstruct attack flows from news analysis.

【No.2】