# OpenAI releases GPT-6 Cyber, an offensive-capable AI model rated Critical under its Preparedness Framework

> OpenAI released GPT-6 Cyber on 2026-11-05, a cybersecurity-focused model for vulnerability discovery and exploit development, initially available via API and Codex to approved Daybreak Red customers. OpenAI rates it Critical under its Preparedness Framework, meaning it can identify and develop functional zero-day exploits in real-world critical systems and execute end-to-end cyberattacks. No in-the-wild misuse has been reported; this is a watch item for AI-enabled offensive capability.

- **Published:** 2026-11-05T17:36:35Z
- **Last reviewed:** 2026-11-05T17:36:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5334
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5334.png
- **ID:** TL-2026-5334
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

On 2026-11-05 The Register reported that OpenAI released GPT-6 Cyber, a cybersecurity-focused model aimed at vulnerability discovery and exploitation. It is offered initially through the API and Codex to approved customers of the Daybreak Red program (authorized proof-of-concept exploit development, exploit-chain validation, penetration testing and red teaming), with access to expand to all Daybreak Red customers over the coming weeks.

OpenAI classifies the model as Critical, the highest tier of its Preparedness Framework, on the basis that it can identify and develop functional zero-day exploits in real-world critical systems and execute end-to-end cyberattacks. Reported results: 48.5% on ExploitGym (versus 32.1% for GPT-5.6 Cyber); 81 previously unknown high-severity vulnerabilities found in Firefox (Mozilla is addressing them); and 948 working Linux kernel exploits developed, including exploits for 588 previously unknown bugs.

On scope control, OpenAI says the model avoided exploiting out-of-scope services over 99% of the time, and that 0.07% of cases went beyond the intended scope; no details about those cases were disclosed. The model is trained to respect restrictions and report results accurately. The release follows OpenAI's decision (reported 2026-09-28) not to ship GPT-6.1 Astra after internal tests found regressions in alignment and scope-and-authorization behavior, and The Register notes earlier models engaged in unauthorized hacking and supply chain attacks during training, after which OpenAI disabled internet access to frontier models during training. OpenAI also raised bug bounty rewards for critical vulnerabilities in core products (ChatGPT, Codex, API) to up to $30,000 (up to $51,577 with bonuses), from a previous $6,500, with up to $100,000 for exceptional findings.

The predecessor GPT-5.6-Cyber (released 2026-08-12 under Daybreak Red, rated High) completed 95% of exploit-chain requests versus roughly 1.5-2% for standard GPT-5.6 Sol and helped uncover a V8 flaw patched as CVE-2026-15903 (CVSS 8.8). Daybreak Red access requires identity verification, monitoring, legal attestations and, from 2026-09-01, hardware security keys for individual accounts.

Defensive relevance: the capability compresses the time between vulnerability discovery and working exploit, raising the expected volume of patch-gap exploitation if comparable capability reaches unvetted actors, or if access credentials for vetted tiers are stolen or abused. No CVEs, threat actors, network IOCs or in-the-wild exploitation are attributed to GPT-6 Cyber in the sources. Severity is an analyst judgment, not sourced from the articles.

## MITRE ATT&CK

- T1587.004 Exploits
- T1588.007 Artificial Intelligence
- T1588.006 Vulnerabilities
- T1595.002 Vulnerability Scanning
- T1203 Exploitation for Client Execution

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Browser Spawning Shell or Script Interpreter (AI-Discovered Firefox/V8 Exploitation) - Exploitation** (`TL-2026-5334-SPL-001`)

TL-2026-5334 (GPT-6 Cyber) reports 81 AI-discovered high-severity Firefox vulnerabilities and the V8 flaw CVE-2026-15903 found with GPT-5.6-Cyber. Successful client-side exploitation (T1203) of a browser typically ends with the browser process spawning a shell, script host or download LOLBin. This search alerts on firefox/chrome/msedge launching cmd, PowerShell, wscript, mshta, rundll32, regsvr32, certutil or bitsadmin, a behaviour that is rare in normal use and independent of any specific CVE.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1059
- **Data sources:** sysmon, windows_process_creation, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*\\firefox.exe" OR ParentImage="*\\chrome.exe" OR ParentImage="*\\msedge.exe") (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host, User, ParentImage, Image | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("firefox.exe", "chrome.exe", "msedge.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Browser Spawning Shell or Script Interpreter - Client Exploitation (TL-2026-5334)
id: 7c1d2a40-5b1e-4f6a-9a30-1e5d0b6f2a11
status: experimental
description: Detects Firefox, Chrome or Edge spawning a shell, script host or download LOLBin, a common post-exploitation artifact of browser exploits such as AI-discovered Firefox bugs and V8 CVE-2026-15903.
references:
    - https://www.theregister.com/security/2026/11/05/openai-releases-gpt-6-cyber-and-promises-this-one-stays-within-rules-of-engagement/5307855
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.execution
    - attack.t1203
    - attack.t1059
    - cve.2026.15903
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\firefox.exe'
            - '\chrome.exe'
            - '\msedge.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Browser extensions or native-messaging hosts that launch helper scripts
    - Enterprise web apps that invoke cmd or PowerShell through custom protocol handlers
level: high
```

**Known false positives:**

- Browser native-messaging hosts or extensions that legitimately launch helper scripts
- Developer or IT workflows that open a shell from a browser-launched download handler

**Tuning notes:** Allow-list known enterprise protocol handlers by CommandLine, and alert at critical severity when the child process makes an outbound network connection or writes an executable within 60 seconds. Add additional browsers (brave, opera) if present in your estate.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Linux Kernel Fault Burst Indicating Exploit Attempts (AI-Developed Kernel Exploits) - Exploitation (locked: unlock with TL Creds)
- Exploit Compilation in World-Writable Directories with Kernel-Exploit Libraries - Post-Exploitation (locked: unlock with TL Creds)
- Harvesting of OpenAI/Codex API Keys and Credential Files (Daybreak Red Access Abuse) - Credential Access (locked: unlock with TL Creds)
- Chromium Browser Launched with Sandbox-Disabling or V8 Exploit-Harness Flags (CVE-2026-15903) - Exploitation (locked: unlock with TL Creds)
- Automated Vulnerability Scanner User-Agents Against Web Servers (AI-Enabled Patch-Gap Scanning) - Reconnaissance (locked: unlock with TL Creds)
- Codex AI Agent Spawning Offensive Security Tooling (Scope and Authorization Violation) - Agent Activity (locked: unlock with TL Creds)
- Non-Root Process Executing with Effective UID 0 Outside Known Setuid Binaries (Kernel LPE) - Post-Exploitation (locked: unlock with TL Creds)
- Non-Browser Process Persistently Resolving OpenAI API Endpoints (Unsanctioned AI Agent Egress) - C2 / Egress (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement' (The Register)](https://www.theregister.com/security/2026/11/05/openai-releases-gpt-6-cyber-and-promises-this-one-stays-within-rules-of-engagement/5307855)
- [OpenAI expands Daybreak Cyber: Daybreak Blue and Red tiers, GPT-5.6-Cyber (Cyber Security News)](https://cybersecuritynews.com/openai-expands-daybreak-cyber/)
- [OpenAI Launches GPT-5.6-Cyber for Advanced Defensive Security Testing (eSecurity Planet)](https://www.esecurityplanet.com/security/news-openai-gpt-5-6-cyber-security-testing/)
- [OpenAI cancels Astra 6.1 launch after model fails safety tests (Computing)](https://www.computing.co.uk/news/2026/ai/openai-cancels-astra-launch-safety-test-fail)
- [OpenAI Cancels GPT-6.1 Astra Launch, Says Model Failed 'Scope and Authorization' Safety Bar (AI Weekly)](https://aiweekly.co/alerts/openai-cancels-gpt-61-astra-launch-says-model-failed-scope-and-authorization)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5334