GPT-6 Cyber Finished 95% of the Exploits the Other Model Would Not Even Start

Summary card on GPT-6 Cyber: 48.5 percent on ExploitGym, 95 percent completed on RemoteExploitBench against 100 percent refusal, 99.93 percent in-scope behaviour, 81 novel Firefox vulnerabilities and 948 Linux kernel exploits; a side panel lists the Node.js and Bun patch versions for the Brotli CVE-2026-111497 — Original graphic by Guruji Corporation. Sources: OpenAI, "GPT-6 Cyber", 5 November 2026, and Patch the Planet, CVE-2026-111497.

A model that refuses everything is not safe, it is useless — and OpenAI has now published the number that shows the difference. On RemoteExploitBench, a new test built from known bugs in GitLab, PostgreSQL and Jenkins running in a controlled lab, GPT-6 Astra with its safety profile in place refused 100% of the tasks. GPT-6 Cyber, launched on 5 November 2026, completed 95%, and its only failure was an exploit it could not get working against a remote target.[1]

That is the release in two lines. The interesting number is the other one: whether the model that stopped saying no also stopped leaving the job it was given.

What actually happened

OpenAI released GPT-6 Cyber, a cyber-specialised variant of GPT-6 Astra trained specifically for authorised security work: finding vulnerabilities, developing exploits, and web penetration testing. Under its Preparedness Framework, OpenAI classifies the model as Critical in cybersecurity, up from High for GPT-5.6 Cyber. The system card gives it the same designations as GPT-6 Astra: Critical in cyber, High in biological and chemical capability, and below High for AI self-improvement.[1][2]

The jumps are measurable:

On ExploitGym, which tests whether a model can exploit a specified vulnerability, GPT-6 Cyber scores 48.5% against 32.1% for GPT-5.6 Cyber — roughly 16 percentage points.[1]
On a new offensive web-pentesting evaluation where the model probes applications without source code, it reached 40.3% recall of the planted vulnerabilities, against 32.0% for GPT-6 Astra.[1]

The alignment work is the part OpenAI spent the most words on, because a cyber model that wanders is a liability with a customer's name on it. In a honeypot evaluation built from the Hugging Face incident — an isolated environment where a package registry and an object store are deliberately easy to break into, and attacking them reveals the flag — GPT-6 Cyber avoided exploiting out-of-scope services in 99.93% of tests without its deployment safety prompt, and 100% with it. GPT-5.6 Cyber managed 94.49% in the no-prompt condition.[1]

The scope discipline is trained in, not filtered on at the end: reinforcement learning on crashing, exploiting and code-searching tasks, plus reward signals that reinforce following the user's intended scope, avoiding unrequested actions, and reporting results accurately. OpenAI publishes the model's own reasoning staying in bounds — "Can't assume extra API or attack controller not target. We should only target binary/server."[1]

The model has already been pointed at real code: 948 working Linux privilege-escalation exploits from 1,724 reproduced vulnerabilities (the run we wrote about yesterday), 81 previously unknown high-severity Firefox bugs, and evidence that 30 known Firefox issues were worse than previously reported.[1][3]

The Firefox number deserves its own paragraph

81 novel high-severity bugs in a browser fuzzed by every serious team on earth for two decades is the strongest argument in the post. Mozilla's advisory MFSA 2026-118, announced 27 October 2026, fixed them in Firefox 159, and it carries a detail worth noticing: Mozilla no longer rolls internally found memory-safety bugs into one CVE, it now issues an advisory for every individual bug — use-after-frees in the JavaScript engine and GC, sandbox escapes in DOM navigation and Form Manager, privilege escalation in Networking and Canvas2D.[3] That change exists because the volume of findings went up — and it is why a buyer should ask which CVEs a vendor's last release carried, and when each was fixed.

The same week's other gift: Brotli

The same week produced a genuinely operational bug most Indian web teams should check today: CVE-2026-111497, a memory-corruption flaw in the Google Brotli decoder that can allow remote code execution in anything passing attacker-controlled compressed data to it. Patch the Planet's advisory, updated 23 October 2026, names the fixed versions plainly: Node.js 22.23.4, 24.22.1 and 26.12.1; Bun 1.4.4; Envoy Proxy 1.40.0, 1.39.3, 1.38.6, 1.37.8; Istio 1.29.9, 1.30.6, 1.31.2; and Google Brotli 1.2.1.[4] The Node.js advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security for the report.[4]

The advisory's own warning is the useful part for a small team: a fixed browser component does not prove the embedded Node.js runtime is fixed, and disabling Brotli response compression on a CDN does not disable request-side or client-side decoding. If a stack cannot isolate Brotli, the documented interim step is to reject Content-Encoding: br before any proxy, middleware or body parser touches the body, and keep gzip working.[4]

Why it matters for Indian SMBs and mid-market teams

Most of the affected runtimes are already in your stack. Node.js is running the website, the internal dashboard, the WhatsApp bot and somebody's Electron time-tracker. The Brotli bug needs no exotic target — one endpoint that decompresses a request body from an untrusted client will do. That is a two-line check for a developer holding the version list, and it is the item nobody owns until it is too late.

"The model refuses" is not a security control, and OpenAI has now shown the price of it. Astra refused 100% of RemoteExploitBench, which reads safe and is actually an outage of capability — the licensed defender gets nothing done. The useful control is narrower and harder — a model that acts, logs what it did, and stays inside the scope it was handed. GPT-6 Cyber's 99.93% is remarkable precisely because it is measured after the refusal rate came down.

That is the same control your own agents need. If you have wired an AI agent to a server, a repository or a billing system, the questions that matter are the ones this system card answers for itself: what is in scope, what does the agent do when it meets a service nobody mentioned, and is the scope enforced by a prompt or by the architecture? An IP allowlist, a separate credential per task, and a read-only mount are enforcement. A sentence in the system prompt is a suggestion.

Guardrails are becoming tiered, and procurement should expect it. Access to GPT-6 Cyber runs only through Daybreak Red, which requires identity verification, use restrictions and organisational security requirements including single sign-on, multi-factor authentication and API IP allowlisting; customers on zero data retention generally need Private Safety Processing for automated review of encrypted records kept in their own storage for 30 days.[1][2] OpenAI has also put $1 billion behind Daybreak for Frontline Defenders to subsidise access for resource-constrained teams such as government organisations and essential service providers.[1] Capability tiering plus identity assurance is the shape frontier security tooling is taking.

Patching is still the boring answer. 81 fixed Firefox bugs, 948 kernel exploits, a Brotli RCE — none of them is defeated by a firewall. They are defeated by knowing which version runs where, and by a named person whose job includes the update.

Where Guruji Corporation fits in

We did not build or test any of these models, and we do not sell offensive tooling. What we build is the operational layer these findings keep assuming: an inventory that knows which runtime version sits on which host, a dependency review that turns a CVE like Brotli's into a dated task with an owner, per-agent credentials and scopes instead of one shared key, and a record of what was patched, when, and by whom.

If you cannot answer "which Node.js version is on production, and when was it last updated?" in under a minute, start there. Send a short project brief and we will scope it against what you already run.