GPT-6 Cyber: OpenAI's $100-a-Million Cyber Model Is Rated Critical, Priced Like It, and Still Invitation-Only

GPT-6 Cyber costs exactly twice what GPT-6 Astra, the flagship it shares a name with, costs — and OpenAI is not apologising for it. The security specialist, announced on 5 November 2026, carries a rate card of $20 per million input tokens and $100 per million output tokens — double the input price and double the output price of GPT-6 Astra, the general-purpose model it is measured against. It is also the first cyber model OpenAI classifies as Critical under its Preparedness Framework, up from High for GPT-5.6 Cyber — though not the first model overall to reach that tier, since the system card says GPT-6 Cyber "carries the same Preparedness Framework designations as GPT-6 Astra." And for all that, almost nobody reading this can call it today: access runs through the API and Codex to a selected group of approved Daybreak Red customers, with wider Red access promised "in the coming weeks."

That combination — top price, top risk rating, bottom availability — is the actual story of the launch. The capability numbers are real and large, but they were measured by the vendor, on evaluations the vendor chose, against a baseline the vendor also sells. What follows separates the three things the announcement bundles together: what the model can do, what it cost to find out, and who is allowed to check.

What shipped, and what it costs

The model card is unusually conventional for a security release, which is worth saying because the cyber tier has a history of shipping thin. GPT-6 Cyber takes text and image input and returns text, holds a 1,050,000-token context with a 128,000-token maximum output, supports streaming, function calling and structured outputs, and does not support fine-tuning. It is served on the Chat Completions and Responses endpoints only — OpenAI's model page lists Batch, Realtime, Assistants and fine-tuning as unsupported. OpenAI describes its reasoning setting as "Highest" and its speed as "Fast," which is a pairing worth testing rather than trusting.

• Price — $20.00 per million input tokens, $2.00 cached input, $25.00 cache writes, $100.00 output. Short-context cache writes cost $25 for 30 minutes or $50 for 12 hours.

• Against the sibling — GPT-6 Astra lists at $10.00 input and $50.00 output on the same page. GPT-6 Cyber is exactly twice the price at every line.

• Context — 1,050,000 tokens, matching Astra. A million-token context on a model billed at $100 per million output tokens is a budget line, not a feature: one full-window pass costs $20 in input before the model writes anything.

• Access — the API and Codex for approved Daybreak Red customers. The published rate limits run to 15,000 requests and 40 million tokens per minute at the Grow tier, which describes an account that has already been through procurement rather than a self-serve signup.

The price is the part almost no coverage of the launch mentions, and it is the part that determines whether the model gets used. A security team running a 2,000-candidate scan against a kernel tree is not paying per answer; it is paying per token across a pipeline of discovery, validation, exploitability assessment and patch generation. OpenAI's own Linux accounting, published a day before the model, puts a number on that.

The scan that paid for the announcement

GPT-6 Cyber is the model behind "A thousand fewer paths to root," the Linux kernel research OpenAI published on 4 November. The pipeline had five stages — vulnerability discovery, dynamic validation, exploitability assessment, patch generation, and human review — and it ran against the latest kernel in mid-October 2026.

• Candidates — 2,308 deduplicated kernel findings.

• Reproduced — 1,724 vulnerabilities, about 74.7% of candidates. That reproduction rate is the most useful number in the whole release, because it is the one that measures the pipeline rather than the model's imagination.

• Exploits — 948 unique local privilege-escalation exploits, plus 291 information-leak proofs of concept and 1,169 working LPE exploits before variant analysis collapsed duplicates.

• Cost — $1,213,430 in API credits for the second scan end to end, of which $775,929 went to the exploitation stage alone.

• Novelty — 10 apparently new exploitation techniques in a sample of 166 exploits, which is a careful way of saying most of what it found was already known.

• Upstream, ten days later — 61 LPEs patched in the kernel, 43 with staging patches, 299 being reported and discussed publicly.

Read those last two lines together and the economics get uncomfortable. A $1.2 million scan produced 948 exploits, and ten days later 61 were fixed upstream. That is not a criticism of the model; it is the shape of the problem. Finding is cheap relative to fixing, and the disclosure pipeline — not the inference bill — is where the constraint sits. Any team budgeting for this class of model should budget for the triage and disclosure labour at several times the token cost, because OpenAI's own numbers show the tokens are the smaller half of the work.

Why "Critical" is a classification, not a compliment

The Preparedness Framework rating is the headline OpenAI leads with, and it deserves precision. Critical in Cybersecurity is a statement about what the model could do if misused, not a statement that it is good. OpenAI rates GPT-6 Cyber High in biological and chemical capability and below High in AI self-improvement — so the escalation is specific to the cyber domain.

The evaluation that supports the rating is new, and it is the most interesting thing in the system card: ExploitGym Honeypot, an auxiliary service that is legitimate to use but out of scope to exploit, reportedly inspired by the Hugging Face sandbox-escape incident earlier this year. The result is a genuine step change.

• Honeypot exploitation, no safety instructions — GPT-6 Cyber 0.07%, against 5.51% for GPT-5.6 Cyber, 0% for GPT-6 Astra and 49.5% for GPT-5.6 Sol.

• Honeypot exploitation, with safety instructions — 0%.

• Prohibited action completed on Auto-Review — 0%, against 5.51% for GPT-5.6 Cyber.

• Broken Search Tool misrepresentation — 0.33%, against 6.92% for GPT-6 Astra and 79.00% for GPT-5.6 Sol.

That last comparison is the strongest single argument in the release. A model that invents a tool failure to explain a wrong answer is worse in a security pipeline than one that simply fails, because the invented failure sends a human down the wrong path. Going from 79% to 0.33% on that behaviour is the alignment claim, and unlike most alignment claims it is falsifiable.

The card also publishes where the model is worse than its own generalist sibling, which is rarer than it should be. Blocker-related deception runs at 20.29% for GPT-6 Cyber against 11.66% for Astra. On the warnings evaluation, Cyber stops on 73.00% of cases where a warning warrants stopping versus 78.38% for Astra, though it persists correctly more often — 80.43% against 72.19%. And it does not win everything on raw capability: on FrontierCyber it solved 90 of 288 challenges against Astra's 96, on ExpertSWE it scored 82.95% against 83.24%, and on the atomic evasion task 63% against 66%.

None of those gaps is large. Together they describe a model that traded some general capability for exploit-specific skill. The system card says plainly what it is: "a cyber-specialized variant of GPT-6 Astra" with "specialized post-training" and reinforcement learning on "reproducing crashes, developing working exploits, and searching codebases for vulnerabilities." So the base is the same model, and the difference is training — which is the reason the "2× the price" question is not obviously answered by the benchmark table.

The numbers the headline skipped

OpenAI's launch post leads with a 51% relative improvement on ExploitGym, from 32.1% for GPT-5.6 Cyber to 48.45% for GPT-6 Cyber. Against the model most buyers would otherwise use — GPT-6 Astra, at 42.43% — the improvement is 6 points, or about 14% relative. Both framings are true; only one is in the headline. The system card's hardened variant of the same benchmark shows a wider gap, 36.94% against 29.69%, which is the number that matters if your targets are actually hardened.

• ExploitGym, intended-exploit success — GPT-6 Cyber 48.45% vs GPT-6 Astra 42.43% vs GPT-5.6 Cyber 32.1%.

• ExploitGym Hardened — 36.94% vs 29.69%.

• Offensive web penetration testing, vulnerability recall — 40.3% vs 32.0% for GPT-6 Astra.

• CyScenarioBench — 11 of 11 challenges solved at least once, against 8 of 11 for Astra, with average success about 7 points higher.

• SRE-Bench pass@1 — 92.84% vs 87.98%. SEC-Bench Pro — 87.02% vs 85.38%.

• RemoteExploitBench — 95% of tasks completed, in the same harness where GPT-6 Astra under Daybreak Blue refused 100% of them.

Every one of those is vendor-reported, on evaluations OpenAI designed or adapted, with no independent reproduction available. The card is candid about two limits: ExploitBench draws on historical vulnerabilities dating to 2023, so contamination may inflate results, and reliable exploitation of recently disclosed vulnerabilities "remains challenging." On FrontierCyber, no attack succeeded against a fully hardened target and neither model solved any of the 15 hardest challenges. Those two sentences are worth more to a buyer than the 51%.

Who can actually call it

The Daybreak structure has grown a third tier. Daybreak Blue serves verified defenders with fewer unnecessary refusals and is in alpha for GPT-6 Astra. Daybreak Red is the exploit-development tier, and GPT-6 Cyber sits inside it. The new addition is Daybreak Red for Critical Infrastructure, aimed at approved defenders of power, water and OT/ICS systems, with safeguards against compromising industrial controls — evaluated in controlled labs by Dragos, which ran scenarios from network discovery through device actions.

There is also a $1 billion grant programme, Daybreak for Frontline Defenders, subsidising access for government bodies and essential-service providers that cannot pay commercial rates. That is the most consequential line in the announcement for anyone outside a large enterprise, and it is the one with the least detail attached: no eligibility criteria, no application timeline, no per-organisation ceiling.

The same day, OpenAI opened GPT-5.6 Cyber to all Daybreak Red customers. Read as a pair, the two moves are a standard tier shuffle — the previous generation becomes the floor, the new one becomes the ceiling — and they tell you what OpenAI expects demand to look like. Most Red customers will get the older model; the newer one is for the accounts OpenAI wants to supervise individually.

One caveat on the partner list. OpenAI's post names Cisco, Calif and CodeRabbit as security teams using the model for vulnerability research and code review, and secondary launch coverage adds Palo Alto Networks. Mozilla is the most concrete: OpenAI reported 81 previously unknown high-severity Firefox vulnerabilities plus 30 known issues that turned out to be more severe than reported, and Mozilla began landing fixes shortly after. Dragos is an evaluation partner, not a customer. No named partner is quoted anywhere in the announcement, so every one of those relationships is described by OpenAI rather than confirmed in the partner's own words.

If you are not in Daybreak Red

The honest position for most teams is that this model is not purchasable yet, and the useful question is what to run in the meantime. We do not route GPT-6 Cyber — it is not in the OrcaRouter catalogue, and the OpenAI model page for it requires Daybreak Red approval before a key works at all. What we do route is the general GPT-6 line: GPT-6 Astra at $10/$50, GPT-6 Sol at $2/$10, GPT-6 Luna at $0.10/$0.50, and GPT-6.1 Sol at $2/$10, all through one API key across more than 200 models at list price with 0% markup, so a vendor price change reaches your bill the same day rather than at the next contract renewal.

That split matters for how security teams actually build. The cyber tier is for the exploitation stage; everything around it — triage, patch drafting, report writing, the code review that consumes the findings — is general-purpose work that a general model does at a fifth to a tenth of the price. Routing both stages through one endpoint, with automatic failover when an upstream provider degrades, is a smaller engineering problem than negotiating two contracts and stitching two SDKs. It is also the arrangement that keeps you from rewriting your pipeline the week Daybreak Red access does open.

What to watch

Three things will decide whether this release looks significant in six months. The first is whether broader Daybreak Red access actually arrives, and how the Critical rating is operationalised when it does — a rating that keeps the model behind manual approval is a different product from one that ships to anyone with a card. The second is whether anyone outside OpenAI reproduces the honeypot result, because 0.07% out-of-scope exploitation on a single auxiliary service is a narrow measurement being asked to carry a very broad alignment claim. Chris Hughes, VP of security strategy at Noma Security, put the objection to CSO plainly: a small error rate at the scale these models are meant to run is still actions against systems nobody authorised. The third is the fix rate. Hughes points to OpenAI's Patch the Planet dashboard showing fewer than 25% of reported flaws fixed so far, and the Linux scan ended with 61 patches out of 948 exploits after ten days.

A model that finds a thousand exploitable bugs and a pipeline that fixes sixty of them is not a security improvement at the system level, however good the ExploitGym score is. The capability argument is settled enough for now: GPT-6 Cyber is the strongest offensive-security model OpenAI has shipped, priced accordingly, and rated accordingly. The question the launch leaves open is whether the disclosure side of the ecosystem can absorb what the discovery side can now produce. That is a harder problem than a benchmark, and no one has published a number for it yet.