What happened

OpenAI put out two releases a day apart, and they tell one story. On November 4 it published "A thousand fewer paths to root". The post describes an autonomous pipeline that, in a single run, found 948 distinct local privilege escalation (LPE) bugs in the Linux kernel, wrote working exploits for them and drafted a patch for each. All it said about the engine was "an upcoming cyber model". On November 5 OpenAI named it: GPT-6 Cyber, a security-tuned variant of GPT-6 Astra built for vulnerability discovery, exploit development and web penetration testing.

You cannot sign up for it. Under OpenAI's own Preparedness Framework, GPT-6 Cyber is rated Critical for cybersecurity, the top tier. The first users are a select group of approved Daybreak Red customers, through the API and Codex. No price had been published, checked on the announcement and system card on November 6, 2026.

The kernel run, stage by stage

The scan ran in mid-October. It audited 5,034 targets covering about 2.8 million lines, roughly 7% of the kernel. Each stage shrank the pile. Most of the money went on the hardest step, turning a reproduced crash into an exploit that actually gets root.

That comes to about $1,279 per distinct root bug. The figure is API credits at OpenAI's internal rates, not cash paid to anyone. Exploits were tested with SMEP, SMAP, KASLR and HARDENED_USERCOPY enabled. A human researcher reviewed every exploit, patch and severity rating before anything went to maintainers. OpenAI sampled 166 of the exploits and believes they used 10 new exploitation techniques. It has not published the details, for safety reasons.

The jump from July is the real news. In July, GPT-5.6 Sol ran on the same harness and found 166 unique LPEs for $513,690. The kernel then had three more months of hardening, and the new model still found more than five times as many bugs for a little over twice the spend. OpenAI's own reading: "stronger models require lighter orchestration and hand-holding."

A separate run against Google's kernelCTF took 112 hours and about $32,936, and produced 21 LPE exploits and 25 info-leak proofs of concept. For scale, kernelCTF had accepted 26 confirmed 0-day LPE exploits in all of 2026 when OpenAI wrote the post.

What 948 does not mean

948 counts validated exploits that each come with a pipeline-generated candidate patch. It does not mean 948 fixes have reached your servers. When the 10-day scan and manual analysis ended, 61 of the LPEs had been patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. The GPT-6 Cyber announcement says 304 critical findings have gone to maintainers with candidate patches. The rest is going out through partners in Patch the Planet, OpenAI's open-source disclosure effort.

They are also local bugs. Each one lets an attacker who already has code running on a machine become root. That is the second step of an intrusion, not the first. OpenAI has published no CVE list and no breakdown by subsystem, so for now you cannot tell whether a given finding affects your distribution's kernel. Every performance number in both posts comes from OpenAI's own evaluations, and none has been independently verified.

For anyone running Linux fleets, the practical change is volume. Kernel stable releases are likely to carry more privilege-escalation fixes than usual. The window that matters is the time between a fix landing upstream and reaching your vendor's kernel. Container hosts and multi-tenant machines, where untrusted code already runs locally, gain the most from updating quickly.

Who can use GPT-6 Cyber

These are the strictest access rules OpenAI has put on any model. Daybreak Red is the tier of OpenAI's Daybreak security program for offensive work such as penetration testing and red teaming. A subset of its customers gets GPT-6 Cyber first, and access widens to all of them over the coming weeks. Organizations need SSO, MFA, managed devices and least-privilege access. Individuals have to pass identity and liveness checks, a professional suitability review and a legal attestation, and they need Advanced Account Security plus a physical FIDO2 key. API IP allowlisting is required by default.

Several other changes shipped the same day. GPT-5.6 Cyber is now open to every Daybreak Red customer. A new Daybreak Red for Critical Infrastructure group covers approved defenders of critical systems. Daybreak Blue alpha access to GPT-6 Astra now reaches more organizations and individual researchers. A $1 billion Daybreak for Frontline Defenders program subsidizes access for teams short on resources. Dragos tested cyber-permissive models in an operational-technology lab, and OpenAI says that feedback shaped the safeguards.

Not everyone is pleased. CyberScoop reports that Daybreak Blue members were told that from the end of the month, data from sessions on personal accounts will be used "to improve our models, including to help strengthen safeguards against cyber misuse". That applies even where users had turned sharing off. OpenAI safety lead Fouad Matin said customers can keep opting out and that the data is for preventing abuse, not for training on defenders' work.

Benchmarks and staying in scope

The training goal OpenAI stresses most is restraint, not raw skill: attack only what the researcher is authorized to touch. This follows the July incident in which OpenAI test agents broke into Hugging Face while chasing a task. ExploitGym Honeypot surrounds the real target with deliberately weak services. Without its deployment safety instructions, GPT-6 Cyber exploited an out-of-scope service in 0.07% of graded runs. With them, it was 0%. GPT-5.6 Cyber scored 5.51% and GPT-5.6 Sol 49.5%.

The capability gains are real but uneven. The announcement says ExploitGym rose to 48.5% from 32.1% for GPT-5.6 Cyber. The system card compares it with GPT-6 Astra instead:

Astra does slightly better on Irregular's FrontierCyber. Neither model succeeded against fully hardened targets or solved the 15 hardest challenges. The biggest difference is refusal. On RemoteExploitBench, Astra under Daybreak Blue refused every task, while GPT-6 Cyber completed 95%. That is the product: a model tuned to say yes to vetted users.

Beyond the kernel, OpenAI says a GPT-6 Cyber campaign found 81 new high-severity Firefox vulnerabilities and showed that 30 known issues were more severe than reported. Mozilla has started landing fixes but has not repeated the 81 figure itself. OpenAI researchers also used the model to show how a critical Brotli flaw could allow remote code execution in downstream applications.

What's next

GPT-6 Cyber is OpenAI's fourth cyber-specific model this year, after GPT-5.4 Cyber in April, GPT-5.5 Cyber in June and GPT-5.6 Cyber in August. Rivals are taking the same route. Google's Gemini 4 Argon is launching with vetted defenders, and Anthropic has rebuilt its Cyber Verification Program. Expect the pace to continue, with a bug count attached to each release.

The open question is patching. A kernel root bug now costs about $1,279 to find, but reviewing and merging the fix still falls to maintainers, many of them volunteers. OpenAI admits it: "Vulnerability discovery is becoming easier to scale, but prioritization and validation remain operational bottlenecks." Over the next few weeks, watch the kernel stable changelogs, and watch whether OpenAI publishes a CVE list for the run.