Kingy AI
Subscribe, 2.2M subscribersWork with Kingy
AI News

GPT-6 Cyber explained: specs, pricing, benchmarks and access

November 5, 2026 Blog
Wordless bars comparing OpenAI-reported ExploitGym scores for GPT-5.6 Cyber and GPT-6 Cyber.

What you actually get today

GPT-6 Cyber: Limited testing only.

Where Who Status Notes
OpenAI API and Codex Selected approved Daybreak Red customers Limited testing only OpenAI does not say every account in this group has it. Broader Red access is promised; no date is given. (source)

Not included:

  • General ChatGPT access is not announced. (source)
  • Regions: Not stated in the OpenAI pages we checked.
  • Price: Standard API rates at up to 272,000 input tokens, per 1M tokens: $20 input, $2 cached input, $100 output. Cache-write fees are separate; longer-context prices are not published in the checked pricing table. (source)
  • Limits: 1,050,000-token context; maximum input 922,000 tokens and maximum output 128,000 tokens. Account and approval limits also apply. (source)
  • Tested by Kingy: Not tested by Kingy.

Checked against OpenAI’s own pages on Nov 5, 2026, 17:39 UTC. Rollouts change in the first days; this box is re-checked for 72 hours.

GPT-6 Cyber is OpenAI’s specialist model for authorized security research. Built from GPT-6 Astra, it combines cyber-focused training, agent tools and restricted access. OpenAI reports gains on several security evaluations, while a harder outside test in its system card favors Astra. The published token rates are higher, too.

Not tested by Kingy. This analysis uses the cited documents and our own cost calculations.

What makes GPT-6 Cyber different?

The system card describes Cyber as a version of GPT-6 Astra with additional cyber-focused training. OpenAI says that training targets technical performance, fewer refusals on authorized security work, adherence to the assigned scope and truthful reporting. That combination matters for a security agent: a useful researcher must know when it has hit a boundary and when its evidence is incomplete, as well as how to investigate a target.

OpenAI rates its cyber capability Critical under the company’s Preparedness Framework. This is a vendor risk classification, not an independent certification.

A defender considering an agent should separate three decisions: whether the task is authorized, whether the environment gives the agent only the access it needs, and whether a person can verify its report. A prompt describing the scope is useful, but network boundaries, isolated environments and review of tool actions provide additional controls. A low observed failure rate in a constructed test does not make those controls redundant.

Specifications and tools

The model documentation lists the API identifier gpt-6-cyber, a 1,050,000-token context window, a 922,000-token maximum input and up to 128,000 output tokens. It accepts text and images and returns text. It supports streaming, function calling and structured output; fine-tuning is not supported. The documentation lists both Responses and Chat Completions, and says Batch is unsupported.

The Responses API lists tools including web and file search, shell, patching, computer use and MCP. A listed tool is an integration option, not evidence that every customer has configured it or that a model can safely operate it unattended. Image input also does not mean the model itself produces images.

Context is a ceiling, not a guarantee that the model will use every supplied detail correctly. A security team still needs a way to select evidence, keep records of tool output and distinguish a model’s inference from a reproduced finding. Large repositories and long-running investigations can require repeated requests even when the advertised context window is generous.

Benchmarks: what improved, and what was measured

The table preserves the configurations in OpenAI’s launch charts. Scores are percentages; a dash means no value was shown. The system card reports its evaluations at the highest tested reasoning budget; exact numeric budgets and sample sizes for the new RemoteExploitBench and web suites were not located in the checked materials. Lower is better only for the honeypot row. The Astra column uses Daybreak Blue; results under ordinary safeguards would be a different comparison.

Evaluation and measure GPT-5.6 Cyber Astra Daybreak Blue GPT-6 Cyber
ExploitGym, strict supplied-vulnerability pass@1 32.1% 42.4% 48.5%
RemoteExploitBench, N-day target success — 0.0% 94.7%
Honeypot, out-of-scope exploitation without deployment prompts ↓ 5.51% — 0.07%
ExploitBench June–August, V8 and Chrome success — 39.0% 42.0%
SRE-Bench, all six objectives pass@1 — 88.0% 92.8%
Web pentesting, black-box vulnerability recall — 32.0% 40.3%
OpenAI reports ExploitGym success of 32.1% for GPT-5.6 Cyber and 48.5% for GPT-6 Cyber.

The ExploitGym difference between the two Cyber scores is 16.4 percentage points, or roughly 51% relative to the earlier score. A supplied-vulnerability task does not measure the proportion of unknown flaws an organization will find. SRE-Bench measures binary reverse engineering, not site reliability engineering.

Refusals complicate a capability comparison. Astra refused every task in OpenAI’s initial RemoteExploitBench evaluation; a zero under that configuration does not establish what the underlying model could do if permitted to attempt the work. The measures also differ: a black-box web score is not directly comparable with binary analysis.

The honeypot result measures behavior in a bounded test. A low observed failure rate does not guarantee that a model will respect every real-world boundary. Teams still need a way to detect and contain actions outside their authorization.

The harder results matter too

On the updated Irregular FrontierCyber set, the system card reports that Cyber solved 90 of 288 tasks and Astra solved 96. Neither solved the 15 hardest tasks, and neither solved a fully hardened target.

That result is a useful counterweight to a launch chart. A specialist can improve across several evaluations without winning every test. Changes in task design, harness, permissions, time budget and target hardness can affect the outcome. The current 288-task result should not be directly compared with an older FrontierCyber result using a different task count.

A security report that omits a blocker can make a partially investigated system look more thoroughly assessed than it was. Ask for the commands and evidence behind a conclusion, the areas that were not examined, and a clear record of failed or inconclusive checks.

Historical benchmark material can also be present in training data. OpenAI flags that possibility for ExploitBench. Recent-target evaluations help reduce that concern, but even fresh benchmarks do not replace independent testing against a team’s own authorized workloads.

Evidence from actual research campaigns

OpenAI’s Linux research campaign offers a larger view of the work around model inference. The company reports 2,308 candidates, 1,724 dynamically reproduced results and 948 distinct local privilege escalation vulnerabilities or exploits, counted using distinct patches. The mid-October run used $1,213,430 in API credits, about $1,280 per distinct result when the full stated pipeline cost is divided by 948.

That arithmetic is a campaign average, not a price a customer can expect for each vulnerability. It includes a particular selection of targets and pipeline stages, and it says nothing about the value of the next finding. The work involved human review, and candidate patches should not be assumed merged. A model can increase the number of leads while creating a substantial verification and maintenance queue for the people responsible for the software.

Mozilla’s October 27 Firefox 159 advisory independently documents shipped security fixes and credits OpenAI researchers. It does not name GPT-6 Cyber. A maintainer’s release advisory gives readers stronger evidence of a shipped fix than a discovery announcement alone.

In industrial environments, the cost of a bad action can include service interruption. A Dragos assessment of the earlier GPT-5.5 Cyber and GPT-5.6 Sol models describes expert involvement and disruptions in test environments. These historical tests did not evaluate GPT-6 Cyber or demonstrate physical sabotage. They do support a practical precaution: keep experiments separated from operational systems and give operators a clear stop mechanism.

API pricing and the cost of an investigation

For standard requests with up to 272,000 input tokens, OpenAI’s pricing page lists GPT-6 Cyber at $20 per million input tokens, $2 per million cached input tokens and $100 per million output tokens. The listed 30-minute and 12-hour cache-write rates are $25 and $50 per million tokens. The page showed dashes for Cyber’s long-context rates when checked on November 5; confirm the applicable terms before budgeting a larger request.

At the standard rate, a request with 100,000 uncached input tokens and 10,000 output tokens costs $3 in tokens: $2 for input and $1 for output. If the same input were billed entirely at the cached-input rate, it would cost $1.20, excluding the cost of creating the cache. These are illustrations, not quotes for a completed security assessment.

Agent work can require many turns, tool calls, retries and long outputs. Reasoning tokens can add to billed output, while engineering, sandbox infrastructure, review, applicable tool charges and other pricing conditions can add costs outside the example. Track actual usage on a small authorized pilot before committing a budget for a recurring workflow.

Cyber, Astra, the predecessor and Mythos

At the published standard rates, Astra costs $10 per million input tokens and $50 per million output tokens. Cyber’s corresponding rates are twice as high. The same 100,000-input, 10,000-output example costs $1.50 on Astra. A team should ask whether Cyber’s extra access and performance on its own tasks justify the additional cost, rather than assume a benchmark difference will transfer to every investigation.

GPT-5.6 Cyber lists a 400,000-token context window and the same 128,000-token maximum output. Its standard input and output rates are $12.50 and $75 per million tokens, respectively. Cyber’s new input rate is 60% higher and its output rate about 33% higher. The predecessor model page specifies long-context multipliers, while the pricing table shows dashes for that model’s long-context rates. Confirm the applicable terms; do not copy those multipliers to GPT-6 Cyber.

Anthropic’s Claude Mythos 5.1 is another specialist option, with restricted access for vetted defenders and scientists and listed starting rates of $10 per million input and $50 per million output tokens. Claude Security uses Mythos 5.1. We did not find a matched, independent comparison against GPT-6 Cyber, so unrelated vendor scores cannot establish a winner. Access, supported workflows, privacy terms, tool controls and the cost of human validation all belong in a buying decision.

Access and practical limits

OpenAI’s Daybreak guide distinguishes program approval from model approval. A request for GPT-6 Cyber uses the daybreak_red cyber access program, but setting a request parameter does not grant either approval. The guide also requires program enablement for the project, a suitable project key and an IP allowlist for application requests. Approved embedded-product end users do not each need their own allowlisted IP.

For a project using Zero Data Retention, the guide requires Private Safety Processing (PSP). Under OpenAI’s PSP documentation, customers retain encrypted safety records in their own cloud storage for at least 30 days, maintain storage and key permissions, and respond to safety notices. The documented processing is automated and designed to protect plaintext from OpenAI personnel. This configuration has operational responsibilities even though OpenAI does not retain the prompts or responses itself.

For an approved team, a sensible first trial is a bounded investigation with written authorization, isolated targets and a reviewer who can reproduce the evidence. Record the model and settings, the scope, tool permissions, token use, successful findings, false leads and unresolved blockers. Compare that record with the team’s existing process before deciding where the higher-priced model earns its place.

OpenAI has not supplied enough evidence to infer a universal success rate, a per-vulnerability price or an independent head-to-head ranking. Architecture and parameter count are also undisclosed in the cited model documentation. Those gaps matter most when a procurement decision depends on a number the public material does not provide.

Sources

Revision log

November 5, 2026: Initial publication.