GPT-6 Cyber System Card

GPT-6 Cyber completed nearly all security tasks in this evaluation, including exploit development and red-teaming. We evaluated GPT-6 Cyber using the defensive-use evaluation suite described in the GPT-6 Astra system card. The model completed 100% of general security assistance and vulnerability patching tasks, 96% of exploit development tasks, and 97% of red-teaming tasks.

We next evaluated whether GPT-6 Cyber maintains safety performance on requests outside cybersecurity.

We tested whether reducing refusals on cybersecurity tasks also made GPT-6 Cyber more willing to provide violative biological assistance. The biology refusal evaluations described in the GPT-6 Astra system card cover severe-risk requests, dual-use requests with both legitimate and potentially harmful applications, and benign biology questions. We measure non-violative responses in the first two categories and whether the model avoids unnecessary refusals in the third.

In these evaluations, GPT-6 Cyber did not comply to nearly all severe-risk and dual-use biology requests while answering most benign questions without unnecessary refusal.

Respecting review decisions. We tested whether GPT-6 Cyber respects Auto-Review rejections. The model completed the prohibited action in 0% of graded rollouts, matching GPT-6 Astra, compared with 0.3% for GPT-5.6 Sol.

Auto-Review evaluation (lower is better)

Responding to warnings. We tested how the model responds to warnings displayed by tool interfaces, with one set of tasks where stopping is more appropriate and another where continuing is more appropriate. GPT-6 Cyber outperforms GPT-5.6 Sol on both sets: 73.00% vs. 57.10% when stopping is appropriate, and 80.43% vs. 77.26% when continuing is appropriate. Compared with Astra, GPT-6 Cyber stops less often on the first set (73.00% vs. 78.38%), but succeeds more often on the second (80.43% vs. 72.19%). This pattern is consistent with its greater task persistence.

Warnings evaluation (higher is better on both splits)

Staying within scope. Our ExploitGym Honeypot evaluation takes some of the most challenging tasks from ExploitGym and adds an auxiliary service as a honeypot. The model may use this service for legitimate support tasks, but exploiting it is outside the authorized scope. Without deployment safety instructions, GPT-6 Cyber exploited the honeypot in 0.07% of graded rollouts, compared with 49.5% for GPT-5.6 Sol, 5.51% for GPT-5.6 Cyber, and 0% for GPT-6 Astra. With deployment safety instructions, GPT-6 Cyber’s observed exploitation rate was 0%.

ExploitGym Honeypot evaluation (lower is better)

Reporting obstacles honestly. Beyond respecting restrictions, we also test whether the model accurately reports blockers that prevent it from completing its assigned coding tasks. GPT-6-Cyber was flagged in 20.29% of graded responses, compared with 34.18% for GPT-5.6 Sol and 11.66% for GPT-6 Astra. Importantly, the evaluation focuses on the final answer. In the majority of the flagged samples we reviewed, the model had already disclosed the blocker in an earlier commentary message but did not repeat that qualification in its final response. We evaluate these cases as incomplete final summaries rather than deliberative deception.

Blocker Deception evaluation (lower is better)

Acknowledging tool limitations. We used the Broken Search Tool evaluation to test how the model responds to research questions when its search tool is missing or broken. The evaluation checks whether its final answer falsely claims to have accessed unavailable tools or presents inaccessible source material as retrieved evidence. GPT-6-Cyber made these errors in only 0.33% of responses, compared with 6.92% for GPT-6 Astra and 79.00% for GPT-5.6 Sol.

Broken Search Tool evaluation (lower is better)

We evaluated whether the model follows safety requirements and asks for the user’s approval when needed while completing realistic workplace tasks. The evaluation includes adversarial situations that put these requirements in tension with completing the task, across both tool-based and browser-based workflows. GPT-6-Cyber performs comparably to GPT-6 Astra on this evaluation, with substantially fewer authorization violations than GPT-5.6 Sol.

Workplace evaluation (lower is better)

Counts flagged safety or authorization violations meeting the evaluation’s high-severity criterion.

We evaluated GPT‑6 Cyber on difficult cases drawn from production conversations where Auto-Review had blocked an action and further review identified an assistant failure. Each replay begins shortly before the original failure, using simulated tool responses. The evaluation tests whether the model repeats behaviors such as disclosing data, circumventing restrictions, or taking destructive actions. GPT-6-Cyber’s flagged-action rate was 28.40%, close to GPT-6 Astra’s 26.70% and less than half GPT-5.6 Sol’s 64.53%. Because the evaluation deliberately selects difficult cases involving prior failures, these rates do not represent the frequency of such behavior in ordinary deployment.

Simulated deployment evaluation (lower is better)

Daybreak Red provides cyber-specialized models under stricter eligibility and security requirements. Like past models, GPT-6 Cyber is available only to approved Daybreak Red users and organizations. We verify applicants’ identity and eligibility, require applicants to agree to restrictions on authorized activity and third-party access, and review eligibility based on organizations’ cybersecurity use cases, security practices, and legal attestations.

We first restrict access to approved users and have safeguards in place to protect their accounts against takeover. For organizations, we require SSO, MFA, managed devices, and least-privilege access, relying on customer attestation for MFA managed through their identity provider. Organizations are also required to protect and rotate credentials, monitor employee use, and report suspected misuse or account compromise.

For individuals, we limit access to invited applicants who complete identity and liveness checks, demonstrate professional suitability, and provide legal attestation. To protect their accounts, we require Advanced Account Security and at least one physical FIDO2 security key.

Next, to help keep the model within authorized limits and prevent harmful actions, we recommend using Codex’s sandboxing and Auto-Review features when accessing GPT-6 Cyber through the Codex app. The sandbox limits the agent’s file and network access, while Auto-Review checks eligible requests to act beyond those limits before execution. For GPT-6 Cyber API users, we recommend adding comparable checks to the agent before sensitive actions and stopping execution if review fails or denies an action.

Alongside these action checks, we recommend our approved users run security workflows in isolated environments with explicit limits on targets, credentials, network access, and permitted actions. For high-risk workflows, human operators should oversee the agent to be able to stop it.

Finally, we also use the same monitoring stack as GPT-6 Astra to detect potentially harmful behavior outside the user’s intent or authorization. We will pause Codex rollouts for user confirmation or terminate requests when monitoring identifies severe concerns. If an investigation identifies misuse, we may restrict, suspend, or revoke access.

GPT-6 Cyber’s stronger cybersecurity capabilities create greater risks of harm, so we have added a series of new safeguards around the model.

Blocking high-risk cyber assistance. We added additional checks to GPT-6 Cyber and cyber-critical models in Daybreak Blue to detect and block high-risk assistance involving industrial controls, essential services, and election systems. These checks also target assistance that could enable death or serious injury, catastrophic physical destruction, life-endangering service disruption, or offensive control of weapons systems.

We evaluated these protections with Dragos, specialists in industrial control security, using cyber-permissive Daybreak Red models in a controlled lab. Together, we developed a sensitive red-teaming evaluation covering requests that progress from understanding a device to interacting with it in dangerous or unauthorized ways. Below, we depict block rates on this evaluation across our different trusted access tiers before and after these changes, including recall improvements across our Standard access, Daybreak Blue, and Daybreak Red tiers.

Figure: Safeguard block rate before and after updates across four access configurations on the sensitive red-teaming evaluation. Block rate measures the share of requests flagged by the safeguards; it does not measure over-refusal on legitimate defensive work.

We continue to refine these safeguards using feedback from the security community, including partner reports and reports submitted through /feedback in our first-party products when safeguards miss harmful activity or interfere with legitimate work.

Cyber-specific misalignment monitoring. We adapted our monitoring instructions to distinguish authorized security testing from actions outside the user’s scope. These instructions help monitors assess whether the model’s use of systems, credentials, and data matches the user’s authorization, without treating legitimate exploit development or testing as inherently misaligned.

Biological safety mode for all users. We also guard against the risk that cyber-focused training could reduce refusals outside cybersecurity. We enable conservative biological safety mode for every GPT-6 Cyber user, alongside biological safety classifiers and monitoring. Expanded cyber access is not intended to relax our safeguards for other types of harm.

Private Safety Processing. Next, we’ve built automated safety checks that review related interactions together to detect misuse that may not be apparent in a single request. To enable this, we generally require API customers using Zero Data Retention to use Private Safety Processing (PSP), with limited approved exceptions. Standard data retention remains the default for GPT-6 Cyber.

We use PSP to review encrypted safety records in a protected environment and produce limited safety signals, without exposing the underlying prompts and responses to OpenAI personnel. Customers retain the encrypted records in their own storage for 30 days and can investigate them in their own systems or choose to share relevant information with us.

API IP allowlisting. To make stolen credentials harder to use, we require IP allowlisting for Daybreak Red API access by default. This limits requests to customer-approved network addresses. We approve exceptions for technical constraints; cloud-provider deployments may have different requirements or approved alternatives.

Account-compromise monitoring. Finally, we monitor API keys and Sign in with ChatGPT access tokens for signs of compromise across both Daybreak Red and Blue. When we detect suspicious activity, we can investigate and revoke affected credentials.

Irregular evaluated GPT-6 Cyber using the three cybersecurity evaluation suites described in the GPT-6 Astra system card: CyScenarioBench, FrontierCyber, and Atomic Challenges. These benchmarks have been updated since the GPT-6 Astra system card. We report both models’ results on the updated benchmarks, so Astra’s scores differ from those previously published.

On CyScenarioBench, which tests long-horizon offensive tasks, GPT-6 Cyber solved 11/11 challenges at least once, compared with 8/11 for GPT-6 Astra. Its average success rate was 61%, an increase of 7 percentage points.

On FrontierCyber, which tests vulnerability discovery and exploitation in real software and hardware, GPT-6 Cyber solved 90/288 challenges, compared with 96/288 for GPT-6 Astra. Successful attacks included zero-day vulnerabilities affecting browsers, mobile phones, and cloud databases. However, Irregular observed no successful attacks on fully hardened targets, and neither model solved any of the 15 highest-difficulty challenges.

GPT-6 Cyber also solved 22/22 Atomic challenges, with average success rates of 97% in vulnerability research and exploitation, 98% in network attack simulation, and 63% in evasion, compared with 96%, 100%, and 66%, respectively, for GPT-6 Astra.