# GPT-6 Cyber: $1,279 per exploit and your Azure defence plan

OpenAI published the GPT-6 Cyber system card on 5 November 2026: 948 working Linux privilege-escalation exploits for $1,213,430 in API credits, 81 new high-severity Firefox bugs, and a Critical cyber rating, available only to Daybreak Red customers with hardware keys and IP allowlisting. It is not in Microsoft Foundry, so here is what an Azure team in Sweden can run instead: MDASH in the EU region, Mythos via Glasswing, and the patch math the exploit curve now demands.

- Published: 2026-11-07 · Category: Security & Compliance · Tags: GPT-6 Cyber, OpenAI Daybreak, Security, Microsoft Foundry, Defender, MDASH, Claude Mythos, Azure Update Manager, AKS, NIS2, Cybersäkerhetslagen, Cyber Resilience Act, GDPR
- Author: Technspire AB, Stockholm (https://technspire.com)
- Canonical: https://technspire.com/en/blog/gpt-6-cyber-1279-per-exploit-your-azure-defence-plan

On 5 November 2026 OpenAI published the system card for GPT-6 Cyber, a cyber-specialised variant of GPT-6 Astra built for authorised security work. The numbers that travelled fastest: 948 working Linux kernel privilege-escalation exploits from one audit campaign, 81 previously unknown high-severity Firefox vulnerabilities, and a Critical rating for cybersecurity under OpenAI's own Preparedness Framework, one notch above the High that GPT-5.6 Cyber carried. The number that matters more for a budget meeting is the cost: the Linux campaign consumed $1,213,430 in API credits, roughly $1,279 per working exploit. You cannot buy the model on Azure. It ships only to approved Daybreak Red customers through OpenAI's API and Codex, with identity checks, hardware keys and IP allowlisting as conditions. So the useful question for an Azure team in Sweden is not "how do we get it" but "what does its existence change about our patch window, and which tools in our own tenant do the defensive half of the job".

## What the system card actually measures

Read the benchmarks against GPT-6 Astra, the model most Azure customers already run through Foundry, because that comparison tells you how much the specialisation adds.

| Benchmark | GPT-6 Cyber | GPT-6 Astra | What it tests |
| --- | --- | --- | --- |
| ExploitGym | 48.45% | 42.43% | Exploiting a specified vulnerability on a remote target (GPT-5.6 Cyber: 32.1%) |
| ExploitGym Hardened | 36.94% | 29.69% | Same task with mitigations in place |
| FrontierCyber (Irregular) | 90 of 288 | 96 of 288 | Discovery and exploitation on real software and hardware |
| CyScenarioBench (Irregular) | 61%, 11 of 11 scenarios | 54%, 8 of 11 | Multi-stage offensive operations |
| ExploitBench internal port | 42% | 39% | Recently disclosed vulnerabilities, arbitrary code execution |
| Honeypot, out-of-scope hits | 0.07% (0% with safety prompt) | n/a | Whether the agent attacks a service it was not authorised to touch |

Three things stand out. First, the gap between Cyber and Astra is real but modest on most tasks, and on FrontierCyber Astra is actually ahead. The specialisation buys consistency and scope discipline more than raw capability. Second, Irregular's independent evaluation reports "no successful attacks on fully hardened targets", and neither model solved any of the 15 hardest FrontierCyber challenges. Third, the system card is candid that recently disclosed vulnerabilities "remain challenging" at 42%, and that ExploitBench uses historical bugs from 2023 onward, with the contamination risk that implies.

The real-world campaigns are the part that should change a defender's planning. The Linux kernel audit started from 5,034 candidate targets, reproduced 1,724 vulnerabilities and produced 948 distinct local privilege-escalation exploits, all reported upstream. The Firefox work surfaced 81 new high-severity bugs and reclassified 30 known issues as worse than Mozilla had thought; the fixes shipped in Firefox 159 on 27 October, where Mozilla's advisory MFSA 2026-118 lists 131 individual CVEs and credits OpenAI's Codex Security as the single largest reporter. Dragos, red-teaming a mock power plant, reported the model separated OT assets from IT noise and found two zero-days in protective relay engineering software.

Put the cost figure next to those outputs. At about $1,279 per working kernel exploit, the campaign is expensive for a bug bounty hunter and trivial for a state actor or a ransomware crew with one good quarter. Tom Tunguz's estimate this week, drawing on published evaluations, puts the cost of an autonomous 32-step corporate network compromise at $5,000 to $10,000 in April with Claude Mythos Preview and about $90 in September with an open-weight model. Whatever precision you grant those numbers, the direction is settled: the cost of finding and weaponising a bug is falling faster than most patch calendars.

## Who can get it, and why Foundry is not on the list

GPT-6 Cyber is a Daybreak Red model. Daybreak is OpenAI's two-tier cyber access programme: Blue gives approved defenders general-purpose models with more precise cyber safeguards for code review, triage and incident response; Red gives approved organisations the specialised offensive variants for penetration testing, exploit validation and vulnerability research. GPT-6 Cyber launched to a first group of approved Red customers through the API and Codex, with expansion to the rest of the Red tier planned.

| Daybreak Red condition | What it means on an Azure estate |
| --- | --- |
| Business or enterprise approval, legal attestation of authorised use | Individuals need not apply; your security lead signs for scope |
| Identity verification per user, Advanced Account Security, FIDO2 hardware key | Entra ID passkeys or FIDO2 keys for the named testers |
| SSO with MFA attested by the identity provider, managed devices, least privilege | Conditional Access with device compliance for the Daybreak group |
| API IP allowlisting on by default | A fixed egress address: NAT Gateway with a static public IP in front of the testing subnet |
| Private Safety Processing generally required for Zero Data Retention customers | A DPIA line item; see the EU section below |

None of this runs through Microsoft Foundry. Foundry's OpenAI catalogue carries GPT-6 Astra, Sol and Luna, and the Daybreak programme is sold and gated by OpenAI directly. The one cloud route OpenAI has announced is Amazon Bedrock in AWS GovCloud (US-East), where approved Daybreak Red customers have been able to run GPT-5.6 Cyber since 4 November; it is a US government cloud and not an option for a Swedish enterprise. If your pentest supplier tells you they are using GPT-6 Cyber, they are using OpenAI's API from an allowlisted address, and you should ask to see the scope attestation.

The fixed-egress requirement is the one that trips up teams who test from laptops. On Azure the clean pattern is a dedicated testing subnet with a NAT Gateway and one static Standard public IP, which is then the only address you register with OpenAI.

```
# One static egress address for the red-team subnet
az network public-ip create -g rg-sec-redteam -n pip-redteam-egress \
  --sku Standard --allocation-method Static --location swedencentral

az network nat gateway create -g rg-sec-redteam -n nat-redteam \
  --public-ip-addresses pip-redteam-egress --idle-timeout 10 --location swedencentral

az network vnet subnet update -g rg-sec-redteam --vnet-name vnet-sec \
  -n snet-redteam --nat-gateway nat-redteam

# The address to put on the Daybreak allowlist
az network public-ip show -g rg-sec-redteam -n pip-redteam-egress --query ipAddress -o tsv
```

## What you can run in your own tenant today

Two Microsoft paths cover the defensive half of what GPT-6 Cyber does, and both already live in an Azure or Defender subscription you may hold.

### Codename MDASH in Security Exposure Management

MDASH is Microsoft's agentic code scanner, in preview inside Microsoft Security Exposure Management since July 2026. More than 100 specialised agents (injection auditor, memory-safety auditor, auth-bypass auditor and so on) rank files by risk, scan with several LLMs, validate findings through taint analysis and language servers, and run a multi-model debate to kill false positives before anything reaches the Defender portal. It connects to GitHub and to Azure DevOps (connector in preview since August), runs from the Defender CLI locally or in a pipeline, and can generate fixes with the defender fix command. Microsoft's own cyber model, MAI-Cyber-1-Flash, joined the scan configuration in August; Microsoft reported its MDASH configuration scoring 95.95% on the CyberGym any-crash measure, ahead of the GPT-5.5 Cyber and Mythos 5 figures it published alongside. In October the recommended configuration moved to MAI-Cyber-1.1-Flash.

Two details matter for a Swedish buyer. The models are deployed into your own Microsoft Foundry resource, connected to Defender with a managed identity rather than a stored key, so the consumption and the data path sit inside your subscription. And the service is listed for the EU region of the Azure commercial cloud, so the scan does not need to leave Europe. The published limits during preview are a repository size of around 256 MB and one concurrent scan per tenant, which is fine for a weekly pass over the repositories that face the internet and not yet a replacement for a full SAST pipeline.

```
# From a checked-out repository on a build agent; DEFENDER_ASPM_TENANT_ID set
./defender scan ai-scan submit . --model-profile mai-cyber --severity high
# Output: Job submitted: <JOB_ID>

# Block until the scan finishes, pull the SARIF for the pipeline
./defender status wait <JOB_ID> -o results.sarif
```

### Claude Mythos Preview through Foundry, if you are in Glasswing

Anthropic's frontier cyber model, Claude Mythos Preview, is available as a gated research preview in Microsoft Foundry for Azure customers who are part of Project Glasswing, the defensive coalition Anthropic launched on 7 April with Microsoft, AWS, Google, Cisco, CrowdStrike, Palo Alto Networks and the Linux Foundation among the launch partners. Anthropic lists the model at $25 per million input tokens and $125 per million output tokens after the preview period, with more than 40 organisations beyond the launch partners granted access for securing critical software. Microsoft's Security Response Center has said it is embedding the model into its Security Development Lifecycle for vulnerability discovery. For most Swedish enterprises the practical route is the Cyber Verification Program Anthropic expanded on 6 October, which adds access tiers below the Glasswing circle.

### A decision guide

| You need to | Use | Gate |
| --- | --- | --- |
| Find exploitable bugs in your own source before release | MDASH with MAI Cyber configuration, EU region | Exposure Management preview, your Foundry resource |
| Triage, detection engineering, incident write-ups | GPT-6 Astra or Claude in Foundry; Daybreak Blue if you want OpenAI's cyber safeguards | Foundry; Daybreak Blue approval |
| Authorised exploit development and red teaming | GPT-6 Cyber via Daybreak Red, or Mythos via Glasswing or the Cyber Verification Program | Legal attestation, hardware keys, fixed egress; or coalition membership |
| Prove your estate is patched faster than the exploit curve | Azure Update Manager and Defender vulnerability management | None; the gap is usually the maintenance window, not the licence |

## The patch math

The Linux campaign is the number to take to your platform team. 948 working local privilege-escalation exploits means that on any Linux host where an attacker has a foothold, the odds that an unpatched kernel hands them root have moved from "plausible" to "assume it". The exploits were reported and fixed upstream, so the question is whether the fixed kernels have reached your VMs and your AKS node pools. Alpine's OpenSSH bypass this week, covered in [yesterday's audit](/en/blog/sshhole-openssh-bypass-your-azure-alpine-audit), gives the foothold; a stale kernel gives the escalation.

Azure Update Manager writes its assessment results into Azure Resource Graph, so the "how far behind are we" question is one query across every subscription.

```
// Machines with pending critical or security updates, oldest assessment first
patchassessmentresources
| where type =~ "microsoft.compute/virtualmachines/patchassessmentresults"
   or type =~ "microsoft.hybridcompute/machines/patchassessmentresults"
| extend critical = toint(properties.availablePatchCountByClassification.critical),
         security = toint(properties.availablePatchCountByClassification.security),
         reboot   = tobool(properties.rebootPending),
         assessed = todatetime(properties.lastModifiedDateTime),
         os       = tostring(properties.osType)
| where critical > 0 or security > 0
| extend machine = tostring(split(id, "/patchAssessmentResults")[0])
| project machine, os, critical, security, reboot, assessed, subscriptionId
| order by assessed asc
```

Then shorten the window. Enable periodic assessment on every VM and Arc server so the table is never older than 24 hours, and put the internet-facing tier on a weekly maintenance configuration rather than the monthly one it probably inherited. For AKS, turn on the node OS auto-upgrade channel so kernel fixes arrive with the node image instead of waiting for a cluster upgrade.

```
# Assess daily, patch weekly, for the internet-facing resource group
az vm update -g rg-web-prod -n vm-edge-01 \
  --set osProfile.linuxConfiguration.patchSettings.assessmentMode=AutomaticByPlatform \
        osProfile.linuxConfiguration.patchSettings.patchMode=AutomaticByPlatform

az maintenance configuration create -g rg-web-prod -n mc-weekly-edge \
  --maintenance-scope InGuestPatch --location swedencentral \
  --maintenance-window-duration 03:00 --maintenance-window-recur-every "Week Saturday" \
  --maintenance-window-start-date-time "2026-11-14 01:00" --maintenance-window-time-zone "W. Europe Standard Time" \
  --install-patches-linux-parameters "{\"classificationsToInclude\":[\"Critical\",\"Security\"]}" \
  --reboot-setting IfRequired --extension-properties InGuestPatchMode=User

# AKS: let kernel fixes ride the node image
az aks update -g rg-aks-prod -n aks-prod-swc --node-os-upgrade-channel NodeImage
```

Browsers are the other campaign, and Intune handles them. Firefox 159 fixed the 81 new bugs on 27 October; eleven days later any managed device still on 158 is running software with 131 published CVEs. A Defender vulnerability management query for Firefox below 159 across the fleet is a thirty-second check, and the [triage plan from October's Patch Tuesday](/en/blog/patch-tuesday-1400-cves-your-azure-triage-plan) already has the ring structure to push it.

## The Swedish and EU angle

**NCSC Sweden has already told you what to prepare for.** On 24 April, after Mythos Preview, Sweden's national cybersecurity centre announced a collaboration with AI Sweden on the consequences of models that find and exploit vulnerabilities autonomously; nearly 1,000 people joined the webinar and AI Sweden published a report, "AI and Resilience", for decision-makers. The Dutch NCSC was blunter the week before: zero-days cannot be prevented, so time-to-patch must come down, and delays of days or weeks are no longer acceptable. GPT-6 Cyber is the second frontier lab shipping a model in this class with a published campaign behind it. Treat the guidance as current.

**Cybersäkerhetslagen and the CRA measure you in hours.** Sweden's cybersecurity law, SFS 2025:1506, in force since 15 January, gives in-scope organisations 24 hours from awareness of a significant incident to file an early warning. The Cyber Resilience Act's 24-hour duty to report actively exploited vulnerabilities has applied to product manufacturers since 11 September. Neither law cares which model found the bug. Both assume you can tell, quickly, whether a published exploit class applies to you, which is what the Resource Graph query above is for.

**The DPIA line nobody has written yet.** OpenAI's EU data residency for the API has always required an Enterprise agreement and a Zero Data Retention amendment. The GPT-6 Cyber system card says Private Safety Processing is generally required for API customers using Zero Data Retention, which secondary reporting describes as a 30-day encrypted retention of safety records. If your red team's prompts contain hostnames, credentials found in testing or customer environment details, that retention is a processing activity under GDPR Article 28 and belongs in the data protection impact assessment before the first engagement, not after. Ask OpenAI where PSP records are stored and under which sub-processor before you sign the attestation.

**Upphandling: three questions for your pentest supplier.** Which AI models do you use in authorised testing, and under which programme are you approved? How is scope enforced in the tooling, as opposed to in the contract? And where does the prompt and finding data go, and for how long? A supplier using Daybreak Red can answer all three from their approval paperwork. A supplier who cannot answer the second is relying on a model's 99.93% honeypot score to keep them off your neighbour's servers, and Anthropic's July disclosure that three of its models reached real third-party systems during an evaluation, through unauthenticated endpoints and weak passwords, is the reminder that the remaining fraction lands somewhere.

## This week's checklist

- **Today.** Run the Resource Graph query. Every Linux machine with pending security updates and an assessment older than seven days goes on a list with an owner.
- **Today.** Defender vulnerability management: Firefox below 159, Chromium-based browsers behind current. Push through the fast ring.
- **Monday.** Internet-facing VMs move to periodic assessment and a weekly maintenance configuration. AKS clusters get the NodeImage channel.
- **Tuesday.** Onboard MDASH in Security Exposure Management with the EU region and a managed-identity Foundry connection. Scan the three repositories that face the internet first.
- **Wednesday.** If you run or buy red teaming, decide the access tier: Daybreak Blue for the defenders, Daybreak Red or the Anthropic Cyber Verification Program for the testers. Stand up the fixed-egress subnet before you apply.
- **Thursday.** Send the three supplier questions. File the answers with the patching record you keep for cybersäkerhetslagen.
- **Next sprint.** Write the PSP and data-retention paragraph into the DPIA for AI-assisted testing. It is shorter to do now than to explain later.

GPT-6 Cyber made no successful attack on a fully hardened target in Irregular's evaluation. That is the most useful sentence in the system card, because "fully hardened" is a state you control, and this week the price of being anything less dropped again.

## Sources

- [OpenAI: GPT-6 Cyber system card (5 November 2026)](https://deploymentsafety.openai.com/gpt-6-cyber)
- [OpenAI: GPT-6 Cyber, advancing the frontier of aligned cybersecurity agents](https://openai.com/index/introducing-gpt-6-cyber/)
- [Irregular: Assessing GPT-6 Cyber against offensive security benchmarks (5 November 2026)](https://www.irregular.com/research/assessing-gpt-6-cyber-against-offensive-security-benchmarks)
- [OpenAI: Daybreak Red is now available in AWS GovCloud (US-East) (4 November 2026)](https://openai.com/index/daybreak-red-aws-govcloud/)
- [OpenAI: Expanding Daybreak as the cyber defense window narrows](https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/)
- [Mozilla: Security advisory MFSA 2026-118, Firefox 159 (27 October 2026)](https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/)
- [Microsoft Learn: Codename MDASH, agentic code scanner overview](https://learn.microsoft.com/en-us/security-exposure-management/ai-code-security-overview)
- [Microsoft Learn: What's new in Microsoft Security Exposure Management](https://learn.microsoft.com/en-us/security-exposure-management/whats-new)
- [Microsoft AI: Introducing MAI-Cyber-1-Flash inside MDASH (13 August 2026)](https://microsoft.ai/news/introducing-mai-cyber-1-flash-inside-mdash/)
- [Microsoft Security Response Center: How MSRC is evolving with AI (7 April 2026)](https://www.microsoft.com/en-us/msrc/blog/2026/04/strengthening-secure-software-global-scale-how-msrc-is-evolving-with-ai)
- [Anthropic: Project Glasswing](https://www.anthropic.com/glasswing)
- [CNBC: Anthropic says its Claude models gained unauthorized access to other organizations' systems (30 July 2026)](https://www.cnbc.com/2026/07/30/anthropic-says-claude-gained-unauthorized-access-to-others-systems.html)
- [NCSC Sweden: Samverkansinitiativ om säkerhetsrisker med avancerade AI-modeller (24 April 2026)](https://www.ncsc.se/sv/aktuellt/samverkan-med-ai-sweden/)
- [Techzine: Dutch NCSC warns about Anthropic's Mythos model (15 April 2026)](https://www.techzine.eu/news/security/140472/dutch-government-warns-against-controversial-anthropic-mythos-model/)
- [Tom Tunguz: A $90 key into your company's secrets (6 November 2026)](https://tomtunguz.com/a-90-dollar-key-into-your-companys-secrets/)
- [Microsoft Learn: Query Update Manager results with Azure Resource Graph](https://learn.microsoft.com/en-us/azure/update-manager/query-logs)
- [OpenAI Help: Data residency for the OpenAI API](https://help.openai.com/en/articles/10503543-data-residency-for-the-openai-api)
- [Riksdagen: Cybersäkerhetslag (2025:1506)](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/cybersakerhetslag-20251506_sfs-2025-1506/)

---

Technspire AB builds AI agents, Azure OpenAI solutions, and production web platforms for Swedish and EU enterprises. Book a call: https://calendly.com/technspire · hello@technspire.com · More articles: https://technspire.com/en/blog · Site overview for agents: https://technspire.com/llms.txt