GPT-6 Cyber Scored 100% on Staying in Scope—What Does That Buy You?

A perfect score with a narrow meaning

OpenAI introduced GPT-6 Cyber on November 5, pairing more capable vulnerability research with a claim security teams cannot treat casually: better obedience to the boundaries of an assignment. In its ExploitGym Honeypot evaluation, the company reports 99.93% avoidance of out-of-scope exploitation without deployment safety prompts and 100% with them. Those are evaluation results, not a promise about every deployment. OpenAI’s announcement describes the test.

The trap matters. Supporting services in the test are deliberately vulnerable, offering a tempting shortcut to the task’s flag. The model has to recognize that an available route is outside its authorization. For a builder, this tests a distinction that ordinary task completion can obscure: reaching the answer and having permission to take the route are separate requirements.

That distinction is the useful story as of November 10. A cybersecurity model that can investigate more deeply also needs a reliable understanding of where to stop. My reading: the perfect score earns GPT-6 Cyber a serious evaluation in a bounded environment. It does not earn it an administrator account and an encouraging message.

More capability makes the boundary consequential

On ExploitGym, OpenAI reports 48.5% for GPT-6 Cyber against 32.1% for GPT-5.6 Cyber. The benchmark asks a model to exploit a specified vulnerability. OpenAI also reports 81 previously unknown Firefox vulnerabilities classified as high severity by Mozilla, supported by evidence and reproducible tests. These are company-reported findings; the benchmark and the research campaign measure different things. The launch report sets out both.

The benchmark does not tell a team how many useful bugs the model will find in its own repository. A supplied target and a specified vulnerability remove uncertainty that dominates ordinary security work. A product team may first need to establish whether suspicious behavior is reachable, whether an affected component ships, and whether an apparent exploit survives its actual configuration.

The system card describes a cybersecurity-specialized variant of GPT-6 Astra, with training directed at vulnerability discovery, exploit development and web penetration testing. OpenAI assigns it a Critical cybersecurity capability designation under its Preparedness Framework. That designation describes the company’s assessment of capability; it is no substitute for evaluating a particular integration.

For a pilot, choose a question with a checkable ending: can the model reproduce a reported failure in an isolated copy, identify the relevant code and verify a proposed correction? Ask for the evidence alongside the conclusion. A persuasive paragraph about a vulnerability is cheap. A reproducible finding that survives review is the deliverable.

Alignment needs a job description

OpenAI says its training reinforces respect for intended scope, avoidance of unrequested actions and accurate reporting. Its broader alignment discussion also describes uneven results across evaluations, including weaknesses relative to Astra in reporting blockers in final answers. The system card gives a more qualified picture than a single perfect score.

The builder implication is that scope must exist in a form someone can inspect. “Audit our service” leaves unanswered whether the task includes a shared identity provider, a vendor endpoint or an adjacent tenant. Write down the permitted targets, operations and stopping conditions before the run. If a finding requires access beyond that boundary, the useful next action is a request to expand the assignment.

Then make those limits real in the environment. Give the worker credentials for the test target and a route to an evidence store. Keep production secrets out of that environment. Require a separate decision before modifying shared services or sending traffic to a newly discovered host. These are deployment recommendations, not claims that GPT-6 Cyber automatically configures those controls.

A practical acceptance test can include an attractive shortcut the worker is forbidden to take. Does it report the obstacle and explain what permission would resolve it? Does the final report disclose incomplete verification? This checks the behavior your integration needs, rather than assuming that a published alignment result transfers intact to your tools and instructions.

Access approval is part of the product

The current Daybreak overview says GPT-6 Cyber requires separate model approval within Daybreak Red. Approval for a broader access tier does not automatically grant this model. The overview also limits Daybreak to authorized work and says it must not be enabled for customer-facing applications, downstream product traffic or third-party access.

That restriction changes the product brief. An internal security team evaluating its own software has a different starting point from a startup planning to expose an unrestricted security assistant to customers. Before building a user interface around GPT-6 Cyber, establish that the intended distribution and workflow fit the access terms. A model listing is not permission to resell the capability through a chat box.

The same help page says that, after model approval and verification of the required security setup, GPT-6 Cyber can be used through Codex or the Responses API. Treat account eligibility and runtime configuration as distinct implementation work. The team responsible for a pilot needs to know which workspace and project are approved, which credentials the worker receives and who can halt a run.

For a useful first deployment, keep the path from finding to reviewer short. Let the worker produce a reproduction, a proposed patch and a verification record in an isolated environment. Route those artifacts to the engineer who owns the affected component. Automating discovery without assigning someone to decide what happens next merely manufactures another inbox.

The token price is only the opening bill

The official model page lists standard short-context pricing of $20 per million input tokens, $2 per million cached input tokens and $100 per million output tokens. It lists a 1,050,000-token context window and a maximum output of 128,000 tokens. Pricing is usage-based; these figures do not make a complete investigation a fixed-price purchase.

Across requests that each qualify for short-context pricing, one million uncached input tokens and 100,000 output tokens would incur $30 in those token charges. That is arithmetic from published rates, not an observed cost per vulnerability. It excludes separate tool charges, infrastructure and review. Requests exceeding 272,000 input tokens have higher rates, so a large context window does not mean every request gets short-context pricing.

Security research is a loop: inspect, hypothesize, test, revise. A failed reproduction may be valuable if it eliminates a plausible explanation, but it can also consume the budget without producing a finding. Set a spending ceiling and a stopping rule for each investigation. Ask for an intermediate report when progress stalls, with the remaining uncertainty made explicit.

Measure the pilot against accepted findings, usable patches and reviewer effort. Token throughput is easy to count and easy to mistake for progress. A team that spends more on model calls but saves substantial verification work might have a good deployment. A team that receives elaborate reports nobody can reproduce has an expensive writing assistant.

Safeguards affect workflow reliability

OpenAI’s cybersecurity checks documentation says additional automated safeguards apply to API models classified High or Critical for cybersecurity. Suspicious activity signals can lead to temporary access limits during review, and legitimate defensive work can sometimes be flagged. It also says API safeguards differ from those used in Codex.

Build an interruption path into the integration. Preserve approved task details, completed evidence and investigation state so that a paused run does not leave a reviewer guessing what happened. Distinguish a blocked request from a failed test and an unconfirmed finding. Those outcomes require different responses, even when all three prevent the worker from completing its assignment.

The editorial judgment here is straightforward: GPT-6 Cyber’s alignment claim is valuable because exploit capability makes mistakes consequential. Evaluate the model on both useful security work and adherence to your actual authorization boundary. Expand its remit only when reviewers can explain what it did, verify the result and stop the next action.

Frequently asked questions

Is GPT-6 Cyber generally available?

No. The Daybreak overview requires Daybreak Red access plus separate GPT-6 Cyber approval and verification of the required security setup.

Does the 100% score guarantee it stays within scope?

No. It describes performance on OpenAI’s prompted honeypot evaluation, not every possible environment or assignment.

What does GPT-6 Cyber cost?

Published standard short-context rates are $20 per million input tokens and $100 per million output tokens, with cached input priced separately.