Nov 5, 2026, 1:00 AM PT · found Nov 8, 2026, 5:55 PM PT
OpenAI GPT-6 Cyber reports 48.5% on ExploitGym
Verdict: Vendor-reported · Model releases · AI security
OpenAI's post confirms the 48.5% ExploitGym score and 99.93% scope adherence. Irregular's independent run finds the model about on par with GPT-6 Astra on FrontierCyber but does not test ExploitGym.
OpenAI’s post confirms its GPT-6 Cyber figures, and a third-party lab broadly supports the capability but not the headline score.
- Claim: The model scores 48.5% on ExploitGym against 32.1% for GPT-5.6 Cyber, and stayed in scope in 99.93% of honeypot runs without the deployment prompt. Access is limited to approved Daybreak Red customers. OpenAI
- Evidence: Irregular found it solved 90 of 288 FrontierCyber challenges against 96 for GPT-6 Astra, with no successful attacks on fully hardened targets. Irregular
- Caveats: Irregular does not test ExploitGym, so 48.5% has no outside run. It worked with OpenAI, terms unstated. The system card was not read, and the $20/$100 price rests on an aggregator. LLM Stats
- Why it matters: Google’s 54.8% for Gemini 4 Carbon is not comparable, since gating and settings differ. Google
Verdict history
- Nov 8, 2026, 5:55 PM PT: Pending. OpenAI page not readable from the research environment. Retry next run.
- Nov 8, 2026, 9:10 PM PT: Pending. Retried the OpenAI page, failed again. No independent ExploitGym run found.
- Nov 8, 2026, 9:40 PM PT: Pending. OpenAI's news feed lists the post (5 Nov, 09:00 GMT) with a one-line description of a model for finding exploitable vulnerabilities and developing fixes, trained to stay in authorized scope. The feed carries no benchmark numbers, so 48.5% and 99.93% remain unconfirmed.
- Nov 8, 2026, 9:50 PM PT: Vendor-reported. OpenAI's page was read through our fetch proxy by another session. It confirms the ExploitGym and honeypot figures. All numbers are OpenAI's own and the evaluation settings in the system card were not read. The $20/$100 price is not on the page and rests on an aggregator only.
- Nov 9, 2026, 6:40 AM PT: Vendor-reported. Irregular, a third-party lab, published an assessment on 5 Nov (read in full). It does not mention ExploitGym, so the 48.5% remains unconfirmed, and it does not say whether OpenAI paid for the work. A press page (beri.net) puts the system card ExploitGym Hardened score at 36.94%, not confirmed against the card. openai.com pages still return 403 on direct fetch, the feed works. The system card was not read.