OpenAI restricts GPT-6 Cyber to approved security teams OpenAI restricts GPT-6 Cyber to approved security teams

A model release behind two approvals

Daybreak's access guide separates membership in the security program from permission to use this particular model. Red approval covers GPT-5.6 Cyber, while GPT-6 Cyber needs an additional decision. The program is intended for work on systems a customer owns, operates or has explicit permission to test. It excludes customer-facing applications, downstream product traffic and third-party access. That distinction affects how a security team can integrate the model: an internal investigation and a public scanning service are different deployment cases. Blue remains a separate tier for defensive workflows on supported general-purpose models, without access to the specialized Cyber models.

Capabilities and boundaries are tested separately

OpenAI reports a 48.5% score on ExploitGym, compared with 32.1% for GPT-5.6 Cyber. That benchmark tests exploitation of specified vulnerabilities. A separate test places tempting, out-of-scope supporting services beside an assigned target. The company reports that the new model avoided exploiting those services in 99.93% of cases without its deployment prompt, and in every tested case with the prompt. These measurements answer different questions: whether a system can complete a security task, and whether it stays inside the task's boundaries. Improving the first does not establish the second.

The controls extend beyond the prompt

The November 5 system card classifies GPT-6 Cyber as Critical for cybersecurity under OpenAI's Preparedness Framework. It describes identity checks and organizational requirements including single sign-on, multifactor authentication and an API IP allowlist. Customers using Zero Data Retention generally also need Private Safety Processing for automated review. The card describes training designed to preserve the researcher's scope and discourage unrequested actions. It also reports uneven alignment results against GPT-6 Astra: better performance on some behaviors does not carry across every test. Access restrictions and evaluation results therefore sit alongside each other in the deployment account.

The API exposes a separate cost profile

The model page lists a 1,050,000-token context window and up to 128,000 output tokens. Standard short-context pricing is $20 per million input tokens and $100 per million output tokens, with cached input priced separately at $2. Those rates distinguish reading a large case file from generating a long investigation. The page lists text output, text and image input, function calling and structured outputs. It does not offer fine-tuning. Teams can therefore connect the model to a defined tool workflow and request structured findings, with the scope of each operation defined by the surrounding application.