OpenAI teases its next hacking AI: 77 percent on an exploit benchmark

What's going on

OpenAI has offered a preview of its next AI model for cybersecurity. The "Cyber at the Frontier" livestream, which aired overnight into November 13, 2026 (Japan time), was meant to showcase the company's existing security products. But as Gizmodo Japan reports, a red line labeled "next cyber specialist model" unexpectedly appeared in one benchmark chart. OpenAI gave no name, no release date and no technical details.

The number alone is enough to make you sit up, though. The model scores 77.0 percent on ExploitGym. The benchmark tests whether an AI can take a given vulnerability and write working code that actually exploits it. That code is known as an exploit.

How the numbers compare

According to Gizmodo Japan, the chart showed the new model alongside OpenAI's current general-purpose flagship GPT-6 Astra and the specialist model GPT-6 Cyber. Anthropic's Mythos 5.2, a special version of Claude Fable 5.2, wasn't in the chart. Instead, OpenAI cited a figure of around 38 percent verbally and boasted that its new model nearly doubles it.

The GPT-6 Cyber figures don't quite match up. At launch on November 5, OpenAI reported 48.5 percent, according to Pulse 2.0. That was a 51 percent improvement over GPT-5.6 Cyber. In the livestream, Gizmodo Japan saw 52.6 percent. It's unclear where the gap comes from. A different test configuration or an updated version are both possible. Either way, the new model leads by about 25 percentage points. Gizmodo Japan argues that this effectively puts it in a different league. All of these figures come from OpenAI itself and haven't been independently verified.

What GPT-6 Cyber can already do

The teaser stands out because the current model is already very capable. GPT-6 Cyber launched on November 5. It's a version of GPT-6 Astra trained specifically for authorized vulnerability research. Here's what OpenAI claims, as reported by Pulse 2.0 and Mashable:

• Firefox: The model found 81 previously unknown vulnerabilities that Mozilla rates as "high" severity. For 30 already known issues, it showed they were more serious than thought. According to SiliconANGLE, Mozilla has since fixed many of them.
• Linux kernel: GPT-6 Cyber reproduced 1,724 vulnerabilities and wrote working exploits for 948 of them. GPT-5.6 Sol managed only 166 using the same method. According to Mashable, the 948 are local privilege escalation bugs, which let an attacker gain more rights on a machine than they're supposed to have. OpenAI reported 304 critical findings, along with proposed fixes, to the Linux developers.
• Other tests: In web penetration tests without access to source code, the model found 40.3 percent of vulnerabilities, compared with 32 percent for GPT-6 Astra. Penetration tests are commissioned break-in attempts that check how well a system is defended. On RemoteExploitBench, which uses known vulnerabilities in software such as GitLab, PostgreSQL and Jenkins, it solved 95 percent of tasks.

Firefox developer Brian Grinstead said:

"Firefox entered 2026 as one of the most hardened and closely scrutinized codebases in the world. Even after further hardening with multiple generations of frontier models, GPT-6 Cyber has uncovered previously unknown, high-severity vulnerabilities."

An independent voice sounds more cautious. Irregular, the AI security lab named in the system card, considers GPT-6 Cyber and Astra largely equivalent, according to SiliconANGLE. GPT-6 Cyber only came out ahead on long, multi-step tasks. Neither model broke through fully hardened targets from OpenAI's own test set.

Safety: keeping the AI within bounds

One focus with GPT-6 Cyber is making sure the model only attacks systems it's authorized to target. SiliconANGLE recalls the backstory. In July, AI agents in OpenAI's test environments broke into Hugging Face systems while working on a task. For the new ExploitGym Honeypot test, the model gets a difficult task and is surrounded by deliberately easy-to-attack side services. Any attack on one of those services counts as a violation. Without extra safety instructions, GPT-6 Cyber broke the rules in 0.07 percent of runs, compared with 5.51 percent for GPT-5.6 Cyber. With the instructions, GPT-6 Cyber stayed within bounds in every case tested.

OpenAI rates the model as "Critical" under its Preparedness Framework, its internal system for assessing dangerous capabilities. That's the highest level for cybersecurity, the same rating GPT-6 Astra received in September. GPT-5.6 Cyber was rated "High."

OpenAI also tested attacks on critical infrastructure. Together with industrial security firm Dragos, it pointed a frontier model at a simulated power plant. The model autonomously separated the control systems from the regular office network. It also found two zero-days, meaning previously unknown vulnerabilities, in software for protective relays. Rob T. Lee, Chief AI Officer at Dragos, warns:

"The barrier to the reconnaissance and vulnerability research that precede an attack is coming down."

Who gets access

Because these capabilities are useful to attackers too, GPT-6 Cyber isn't freely available. Access runs through OpenAI's Daybreak program, which has two tiers. Daybreak Blue is meant for defense, Daybreak Red for offensive work such as penetration testing. At first, only a select group of Red customers get access, via the API and Codex from pre-approved networks. All Red customers are set to follow in the coming weeks. There's also a new group for critical infrastructure operators. A $1 billion grant program is meant to cover access for government agencies and utilities on tight budgets. For individuals, the teased successor isn't on the horizon.

The bigger picture

The teaser shows how quickly AI models are getting better at finding and exploiting security flaws. Between GPT-5.6 Cyber and the announced successor, the ExploitGym score has more than doubled. The competition is in the same race. In September, Google gave Gemini 4 Argon to vetted defenders first. Anthropic has restructured its verification program for cyber users into three access tiers.

Still, caution is warranted. The 77 percent is a single number from a presentation, with no model name, no system card and no external review. The comparison figure for Mythos 5.2 comes from a competitor, and there are already two different numbers floating around for GPT-6 Cyber. Gizmodo Japan suspects OpenAI has more unreleased models up its sleeve. According to OpenAI, one internal model has already produced a proof for the Navier-Stokes problem, one of the Millennium Prize Problems in mathematics, but it still hasn't been released. Since GPT-6 Astra arrived in September, Gemini 4 Carbon and Claude Fable 5.2 have launched, and Gizmodo Japan expects a response from OpenAI before the end of the year. Tools like these are valuable for defenders. The open question is whether access controls and safeguards can keep pace with the models.