What OpenAI announced
OpenAI has introduced GPT-6 Cyber, a cybersecurity model intended to find and validate software vulnerabilities while staying within an authorized assignment. Its announcement and evaluation discussion describes initial availability through the API and Codex for selected approved Daybreak Red participants.
This is restricted access. The announcement should not be read as general availability for every developer or as permission to test systems without authorization.
How to read the reported improvement
OpenAI reports an ExploitGym result of 48.5%, compared with 32.1% for GPT-5.6 Cyber. The difference is 16.4 percentage points; the company also describes it as a 51% relative improvement. Those are two expressions of the comparison, not interchangeable percentage-point claims.
The company reports strong adherence to authorized scope in controlled evaluations, including a 100% result with its deployment prompt. A perfect result on that test does not establish perfect behavior across every future deployment, instruction conflict or unfamiliar environment.
Discovery still needs a remediation workflow
The announcement attributes 81 novel high-severity Firefox findings to this work. Finding a vulnerability, validating it, accepting a fix and distributing that fix are separate stages. The announcement discusses fixes that have landed, rather than establishing that every affected installation is already protected.
Franklin’s analysis is that improved discovery increases the importance of review capacity. An organization considering access should define the permitted targets, evidence requirements and escalation route before starting a run. It should also track whether a reported finding reproduces and whether remediation reaches the deployed software. The model’s benchmark result is evidence about the evaluated research capability; it is not a substitute for that operational record.