OpenAI releases GPT-6 Cyber for Daybreak Red at $20 per 1M input tokens

OpenAI released GPT-6 Cyber on November 5, 2026, a cybersecurity-specialized variant of GPT-6 Astra built for authorized vulnerability research, exploit development and patch verification. The model appears in the OpenAI API changelog under that date with a one-line purpose statement: investigate vulnerabilities, reproduce them in an authorized test environment and verify fixes. The accompanying system card, also dated November 5, describes it as a model post-trained with reinforcement learning on tasks such as reproducing crashes, developing working exploits and searching codebases for vulnerabilities.

Access is restricted. The model page states that an organization needs Daybreak Red access and a separate approval for GPT-6 Cyber itself, and the Daybreak guide adds mandatory single sign-on, multi-factor authentication and an IP allowlist for every API project that calls it. On price, OpenAI lists $20 per 1M input tokens, $2 per 1M cached input tokens and $100 per 1M output tokens, with cache writes at $25 (30-minute retention) or $50 (12-hour retention). Those are the same rates OpenAI charges for GPT-6 Astra in Fast mode, and they are 60% higher on input and 33% higher on output than GPT-5.6-Cyber, the previous model in the same Daybreak Red tier.

The model offers a 1,050,000-token context window and up to 128,000 output tokens, accepts text and image input, returns text, and supports streaming, function calling, structured outputs and the full set of Responses API tools, including hosted shell, apply patch, computer use and MCP. Fine-tuning is not supported. Prices below are as listed on OpenAI's official model and pricing pages on November 6, 2026.

··········

GPT-6 CYBER RELEASE: WHAT OPENAI SHIPPED ON NOVEMBER 5.

The changelog entry is short and points developers to the Daybreak setup guide before their first request. The substance sits in the model page, the Daybreak guide and the system card, which together define what the model is, who may call it and how it was evaluated. OpenAI's announcement post on openai.com could not be read during the preparation of this report, so the figures here come from the developer documentation and the system card only.

According to the system card, GPT-6 Cyber starts from GPT-6 Astra and receives additional post-training aimed at three things: higher capability on offensive and defensive security tasks, fewer refusals on authorized cybersecurity requests, and alignment signals that reward staying inside the scope the user defined. The card names the API and Codex as deployment surfaces. ChatGPT is not listed, and nothing in the documentation suggests the model will appear in consumer ChatGPT plans.

The model inherits GPT-6 Astra's Preparedness Framework classification: Critical in Cybersecurity, High in Biological and Chemical, and below High in AI Self-Improvement. A Critical cyber rating is the reason the access controls are tighter than for any earlier Daybreak model. GPT-5.6-Cyber, by comparison, is described on its model page as available to all Daybreak Red customers, while GPT-6 Cyber requires an extra model-level approval on top of Daybreak Red.

The jump in context length is the most visible technical change for teams already on the Daybreak Red tier. GPT-5.6-Cyber is limited to 400,000 tokens of context; GPT-6 Cyber accepts 1,050,000. For security work this decides whether a large codebase, a long crash log history or a full set of binaries and symbols can sit in one prompt or has to be split across several requests with retrieval in between.

··········

GPT-6 CYBER API PRICING COMPARED WITH GPT-5.6-CYBER AND GPT-6 ASTRA.

OpenAI publishes GPT-6 Cyber prices on the model page under the label "standard short-context prices". The general pricing page did not yet show a GPT-6 Cyber row on November 6, 2026, while it did list GPT-5.6-Cyber in its "Cyber models" section and GPT-6 Astra in the flagship section. The table compares the three models that a Daybreak Red customer can choose between today.

........

Model	Input	Cached input	Cache write (30 min / 12 h)	Output	Batch	Context	Status
GPT-5.6-Cyber	$12.50	$1.25	$15.625 / $31.25	$75.00	Not listed	400K	Previous Red model
GPT-6 Cyber	$20.00	$2.00	$25.00 / $50.00	$100.00	Not listed	1.05M	New, from Nov 5, 2026
GPT-6 Astra (Standard)	$10.00	$1.00	$12.50 / $25.00	$50.00	50% off	1.05M	Red approval, daybreak_blue value
GPT-6 Astra (Fast)	$20.00	$2.00	$25.00 / $50.00	$100.00	n/a	1.05M	2x Standard rates

........

All prices are USD per 1M tokens. Moving from GPT-5.6-Cyber to GPT-6 Cyber raises every token class: input, cached input and both cache-write rates rise by 60%, and output rises by 33%. Against GPT-6 Astra at Standard rates, GPT-6 Cyber costs exactly twice as much on every line, which matches Astra's Fast-mode price list cent for cent.

Two pricing points are left open by the documentation. GPT-5.6-Cyber's model page applies a long-context surcharge above 272K input tokens (2x input, 1.5x output for the whole request), and GPT-6 Astra has the same rule; the GPT-6 Cyber page shows only short-context prices and does not state what happens above 272K tokens, even though the context window runs to 1.05M. No Batch, Flex or Priority price is listed for either cyber model. OpenAI's pricing page also applies a 10% uplift on regional processing (data residency) and FedRAMP endpoints for models released on or after March 5, 2026, which would cover GPT-6 Cyber if it is offered on those endpoints.

Google's closest product is Gemini 4 Carbon, launched on October 28 for a subset of cyber defenders at an introductory $2 per 1M input tokens and $10 per 1M output tokens, rising to $4 and $20 after an introductory period whose end date Google has not stated, with cached input at 95% off. The comparison is not like-for-like: Carbon is a general long-horizon model with a cybersecurity focus and phased access through Google's Fairwind Program, while GPT-6 Cyber is a narrow security specialist sold only to approved Daybreak Red organizations. Our earlier report on Gemini 4 Carbon's launch for cyber defenders covers its access rules in detail.

··········

WHAT A GPT-6 CYBER AGENT SESSION COSTS BEFORE AND AFTER.

Security teams mostly pay for these models in two shapes: long agent sessions that keep a large, mostly cached prompt across dozens of tool calls, and high-volume triage jobs that send many medium-sized, uncached requests. Two illustrative workloads, computed from the official per-token prices, show what the move to GPT-6 Cyber does to the bill.

The first workload is a vulnerability-research agent session of 40 turns. Each turn sends a 150,000-token prompt, of which 130,000 tokens are read from cache and 20,000 tokens are new content written to the 30-minute cache, and each turn produces 4,000 output tokens. The prompt stays below 272K tokens, so no long-context rule applies to GPT-5.6-Cyber or GPT-6 Astra. On GPT-6 Cyber each turn costs $0.26 for cached reads, $0.50 for cache writes and $0.40 for output, or $1.16 per turn.

The second workload is a triage job of 1,000 independent requests, each with 30,000 uncached input tokens (a crash report plus the relevant source files) and 2,000 output tokens. On GPT-6 Cyber each request costs $0.60 of input and $0.20 of output.

........

Workload	GPT-5.6-Cyber	GPT-6 Cyber	Change	GPT-6 Astra Standard
40-turn research session	$31.00	$46.40	+49.7%	$23.20
1,000-request triage job	$525.00	$800.00	+52.4%	$400.00 ($200 on Batch)

........

The session estimate rises by about half because cache reads and writes carry the 60% increase while output, a smaller share of the bill, rises by 33%. Teams whose agents spend most tokens on cached context will see the full 60% on that part of the invoice. The triage job lands in the same range, since uncached input dominates it.

GPT-6 Astra at Standard rates is the cheapest of the three for both workloads, and for triage it can drop to $200 through the Batch API, an option no cyber model lists. Astra is available with reduced cyber refusals to organizations that hold Daybreak Red access, using the request value daybreak_blue, so the price gap gives teams a reason to route routine triage to Astra and reserve GPT-6 Cyber for the tasks where its higher exploit and patching scores are needed. The change favours small, high-value investigations over bulk scanning, where per-request cost grows fastest. For a wider view of how OpenAI's API lineup is organized, see our overview of the OpenAI API models.

··········

WHO CAN USE GPT-6 CYBER: DAYBREAK RED ACCESS AND SETUP.

Daybreak is OpenAI's trusted-access program for cybersecurity work, covered in our earlier report on OpenAI's Daybreak program for AI cybersecurity. Its API controls are a request parameter, access_programs.cyber, which takes the values standard, daybreak_blue or daybreak_red. The Daybreak guide states that the value must match the model being called, not the organization's approval level, and that the parameter selects behaviour within approved access without granting any.

........

Model	Approval needed	access_programs.cyber value
GPT-6 Sol	Blue or Red	daybreak_blue
GPT-6.1 Sol	Red	daybreak_blue
GPT-6 Astra	Red	daybreak_blue
GPT-5.5-Cyber	Red	daybreak_red
GPT-5.6-Cyber	Red	daybreak_red
GPT-6 Cyber	Red plus model approval	daybreak_red

........

For GPT-6 Cyber the guide lists extra steps beyond ordinary Daybreak Red onboarding. The organization's account team must confirm the model approval; an organization owner must enable Daybreak Red for the specific project that sends requests, using a non-default project and a key from that project when project-level controls are on; the project must have an IP allowlist covering the public addresses the application calls from; and every Daybreak Red organization must enforce SSO, with MFA through its identity provider. Projects that use Zero Data Retention must configure Private Safety Processing, and the storage setting should read "Zero Data Retention with Private Safety Processing" once validated. Each end user should carry a stable, pseudonymous safety_identifier.

The guide's own example request for the model looks like this:

curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-6-cyber",
    "access_programs": {"cyber": "daybreak_red"},
    "safety_identifier": "user_a17f",
    "input": "Suggest a regression test for a path traversal fix."
  }'

Misconfigured calls fail with documented errors: 400 invalid_access_program when the program value does not fit the model, 400 unsupported_access_program when the model does not support the requested program, and 403 access_program_not_enabled when the project lacks the program. Approved organizations get the standard rate limits shown on the model page (for example 5,000 requests and 1M tokens per minute at the Build tier, rising to 15,000 requests and 40M tokens per minute at Grow), though OpenAI notes custom limits may apply. Companies that embed GPT-6 Cyber in their own product, with approval to do so, do not need to allowlist their end users' IP addresses, only their own servers'.

··········

GPT-6 CYBER BENCHMARKS IN THE SYSTEM CARD.

The system card measures GPT-6 Cyber against GPT-6 Astra, its base, on OpenAI's internal security evaluations and on external testing by Irregular. Most scores rise, and a few fall.

........

Evaluation	GPT-6 Cyber	GPT-6 Astra
ExploitBench Internal Port	42%	39%
SEC-Bench Pro (pass@1)	87.02%	85.38%
SRE-Bench (pass@1)	92.84%	87.98%
ExploitGym, intended exploit	48.45%	42.43%
ExploitGym Hardened	36.94%	29.69%
Irregular CyScenarioBench	11/11 solved	8/11 solved
Irregular FrontierCyber	90/288	96/288

........

The largest gains are on ExploitGym Hardened, up 7.25 points, and on SRE-Bench, up 4.86 points. On the main ExploitBench score, an ACE-normalized mean, GPT-6 Cyber reaches 100%, and OpenAI warns that this number may be inflated by contamination from historical vulnerabilities present in training data. SEC-Bench Pro, which the card describes as covering the V8 and SpiderMonkey JavaScript engines, improves by 1.64 points.

Irregular's results are mixed. GPT-6 Cyber solved all 11 CyScenarioBench challenges at least once, against 8 for Astra, with a 61% average success rate, and solved all 22 Atomic tasks. On FrontierCyber it solved 90 of 288 challenges, six fewer than Astra, and neither model breached a fully hardened target or solved the 15 hardest challenges. Within the Atomic suite, vulnerability research and exploitation edged up from 96% to 97%, while network attack simulation slipped from 100% to 98% and evasion from 66% to 63%.

OpenAI also reports that GPT-6 Cyber complied with 100% of general security assistance and vulnerability patching tasks, 96% of exploit development tasks and 97% of red-teaming tasks in Astra's cyber refusal suite. These figures describe how rarely the model declines authorized requests, which is one of the explicit training goals.

··········

GPT-6 CYBER SAFEGUARDS AND ALIGNMENT RESULTS.

Because the model is rated Critical in cybersecurity, OpenAI pairs access restrictions with model-side checks. The system card lists new blocking for high-risk assistance involving industrial control systems, essential services, election systems and weapons systems, tested with Dragos. A conservative biological safety mode is switched on for all users, alongside bio classifiers, and the model runs under cyber-specific misalignment monitoring plus monitoring for compromised API keys and tokens.

On biology, the model returned safe responses to 99.87% of severe-risk prompts, the same as Astra, and 98.27% on dual-use prompts against Astra's 97.41%. ProtocolQA rose to 47.2% under standard scoring, from Astra's 41.4%, which keeps it under the 54% indicative High threshold. On AI self-improvement, ExpertSWE scored 82.95% against 83.24% for Astra.

The agent-safety tests compare the model with GPT-5.6 Sol and Astra. In honeypot exploitation without safety instructions, GPT-6 Cyber took the bait in 0.07% of cases, against 5.51% for GPT-5.6-Cyber and 49.5% for GPT-5.6 Sol. With a deliberately broken search tool, it made false claims in 0.33% of cases, against 6.92% for Astra and 79.00% for GPT-5.6 Sol. It is weaker than Astra on two measures: it stopped at warnings when appropriate in 73.00% of cases against 78.38%, and its flagged blocker-reporting rate was 20.29% against 11.66%, where lower is better. OpenAI recommends that Codex users run the model with sandboxing and Auto-Review, in isolated environments and with human oversight for high-risk workflows.

··········

GPT-6 CYBER: CONFIRMED FACTS AND OPEN QUESTIONS.

The documented facts are clear. GPT-6 Cyber is available from November 5, 2026 through the API, with Codex named as a deployment surface, only to Daybreak Red organizations that also hold a model-specific approval and meet SSO, MFA and IP-allowlist requirements. It costs $20 per 1M input tokens, $2 cached, $25 or $50 for cache writes and $100 per 1M output tokens, with a 1.05M-token context window and 128K maximum output. Against GPT-5.6-Cyber, that is 60% more per input token, 33% more per output token and more than twice the context.

Several points remain undocumented. The model page shows only short-context prices, so the cost of prompts above 272K tokens is not stated. No Batch, Flex or Priority pricing exists for either cyber model, and GPT-6 Cyber had not yet been added to the general pricing page on November 6. The GPT-6 Cyber model page gives no snapshot name or knowledge cutoff, and the documentation reviewed sets no retirement date for GPT-5.6-Cyber, which its model page still lists as available to all Daybreak Red customers. The 100% ExploitBench score carries OpenAI's own contamination warning, and the FrontierCyber result shows GPT-6 Cyber slightly behind Astra on the hardest external range.

For teams already on Daybreak Red, the practical decision is a cost-per-task trade. Our illustrative session estimate rises from $31.00 to $46.40 when switching from GPT-5.6-Cyber, while GPT-6 Astra at Standard rates handles the same session for $23.20 with Batch available for bulk work. GPT-6 Cyber earns its premium where the system card shows its clearest gains, in exploit development against hardened targets and on SRE-Bench, and where its million-token context removes the need to split large codebases across requests.

··········

FOLLOW US FOR MORE.

·····

DATA STUDIOS

·····

datastudios.org