OpenAI releases GPT-6 Cyber and says the model beats GPT-6 Astra on most security tasks, while one third-party test in the system card has Astra slightly ahead

Concept illustration of a standing folded tent card with a beige header band lettered "OPENAI SYSTEM CARD", with an interlaced knot-like emblem between the words. On the card, two stacks of paper stand side by side on a black band lettered "FRONTIERCYBER", the left stack slightly taller, topped with a red sheet and with a pale pink square behind it, while a dark laptop lettered "GPT-6 ASTRA" at the far left and one lettered "GPT-6 CYBER" at the far right each have a speech bubble of gray lines above them. Printed on the image: 96 vs 90 Astra vs Cyber problems solved, Irregular test.

OpenAI on November 5 released GPT-6 Cyber, a security model available only to vetted customers (OpenAI, 2026-11-05). Security teams choosing a model should compare Cyber with Astra: OpenAI's announcement says Cyber leads on most tasks, while the system card cites Irregular's conclusion that the two are broadly comparable.

Against the previous generation, GPT-6 Cyber scored 48.5% on ExploitGym, a benchmark of whether a model can exploit a specified vulnerability, and GPT-5.6 Cyber scored 32.1%. Against the general-purpose model of the same generation, the gap is much smaller: the system card puts ExploitGym at 48.45% for Cyber and 42.43% for GPT-6 Astra. The security-evaluation firm Irregular ran three tests. FrontierCyber, which tests finding and exploiting vulnerabilities in real software and hardware, has 288 problems, and Astra solved 96 against 90 for Cyber. CyScenarioBench, which tests long-horizon offensive tasks, has 11 problems and counts those solved at least once across several attempts: 11 for Cyber and 8 for Astra. Atomic has 22 problems, and Cyber solved all of them; across vulnerability research and exploitation, network attack simulation and evasion, Cyber's average success rates were 97%, 98% and 63%, against 96%, 100% and 66% for Astra (system card, 2026-11-05).

OpenAI also says GPT-6 Cyber found 81 new Firefox vulnerabilities, which Mozilla rates high severity. SecondSource's November 5 issue carried another figure from the same announcement: in the Linux kernel, OpenAI first reproduced 1,724 suspected vulnerabilities, then wrote 948 working exploits. The 81 counts newly found vulnerabilities and the 948 counts exploits written, so the two can't be compared.

Our inference: 11 problems is a small sample, but that test measures long-horizon tasks, a different thing from the 288-problem test, so neither result cancels the other. OpenAI's announcement says GPT-6 Cyber beats Astra on most security tasks, and Irregular concludes the two are broadly comparable, with higher success for Cyber on long-horizon tasks. On OpenAI's own frontier-risk scale, the announcement says Cyber moved up from the previous generation's High to Critical. The system card says the general-purpose Astra is also Critical, so that rating doesn't separate the two.

Not proven yet: most of the figures are OpenAI's own measurements How we checked →

Next to watch: the vulnerability IDs and patched versions in Mozilla's security advisories, and how Linux kernel maintainers handle these reports.

Source and checks

This item ran in the brief of Nov 6, 2026, alongside 17 other items. How we checked it, the quote checks and what was still missing that day are on that issue's How we checked page.

Cite this item

SecondSource (2026). "OpenAI releases GPT-6 Cyber and says the model beats GPT-6 Astra on most security tasks, while one third-party test in the system card has Astra slightly ahead." https://secondsource.io/en/news/2026-11-06-3/. Accessed access date.