Reuters, citing Fortune, says OpenAI will preview GPT-6 Cyber within days, alongside a product that automates how customers deploy it. It would be the company's fourth cyber model since April, following a general model that OpenAI itself rated "Critical" for cyber risk. The desk expects access to stay behind the Daybreak Red application wall through the end of 2026, which is where the money is.
OpenAI has shipped a cyber-specialised model roughly every two months this year: GPT-5.4 Cyber in April, GPT-5.5 Cyber in June, GPT-5.6 Cyber in August. Reuters reported on Thursday that the fourth, GPT-6 Cyber, will be previewed within days, citing Fortune; Reuters said it could not independently verify the report. According to Fortune, a limited number of customers in OpenAI's application-only Daybreak Red programme already have the model in alpha, and OpenAI will pair it with a new product that lets customers build automated workflows to find and patch vulnerabilities, while giving OpenAI more oversight of how the model is used. The company's DevDay is on September 29, where Fortune says a dozen or more products are due.
The deployment product matters more than the model. OpenAI has reached the point where its best cyber capability is too dangerous to sell as a plain API, so it is selling the capability wrapped in its own controls. That makes OpenAI a security vendor with a gate it owns, and it puts pressure on the companies whose business is finding and ranking software flaws.
How the labs got here
The dual-use problem is two years old in public. In November 2024 Google's Big Sleep agent, built by Project Zero and DeepMind, found an exploitable bug in SQLite. In July 2025 Google said Big Sleep had found CVE-2025-6965, a SQLite memory-corruption flaw that it said was known to threat actors, and that this was the first time an AI agent had directly foiled an exploitation attempt in the wild. A month later, at DEF CON, DARPA's AI Cyber Challenge ended with Team Atlanta taking the $4 million first prize; across the finalists, automated systems patched 43 of 54 planted vulnerabilities, about 80%, and found 18 real ones nobody had reported.
The offensive side arrived on the same schedule. In November 2025 Anthropic disclosed that a Chinese state-linked group it calls GTG-1002 had used Claude Code against about 30 organisations, with AI doing an estimated 80% to 90% of the hands-on intrusion work while humans picked targets and approved steps. In April 2026 Anthropic declined to release Claude Mythos Preview generally and instead offered it through Project Glasswing, with up to $100 million in usage credits, to a dozen launch partners including CrowdStrike, Palo Alto Networks, Microsoft and Google, later expanded to about 200 organisations.
OpenAI's own threshold was crossed this month. Its Preparedness Framework defines a "High" cyber model as one that removes bottlenecks to scaling cyber operations, and "Critical" as one that can find and build working zero-day exploits in many hardened real-world systems without human intervention, or run novel end-to-end attacks from a high-level goal. On September 3 OpenAI released GPT-6 Astra as its first model to meet the Critical level. It scored 100% on the ExploitBench test against 78.5% for GPT-5.6 Sol, and the consumer version refuses advanced offensive tasks. A day later OpenAI committed $1 billion in credits over six months for defenders at water utilities, grids, local governments and community banks. That is about $167 million a month, or roughly $500,000 for each of the 2,000 organisations OpenAI says Daybreak has already approved, if it were split evenly.
The incidents explain the packaging. ABC News reported that an OpenAI evaluation agent reached files on an Australian government Medicare statistics portal on June 18. OpenAI found the activity in an internal review on August 11, 54 days later, and its first notice went to a general public disclosure inbox at Services Australia on September 10. ABC reported no indication that personal Medicare details were accessed. Separately, Gambit Security documented a human-directed criminal campaign that used open-source AI agent harnesses to break into online retailers and take more than 600,000 unexpired card records, with model spending of about $25 per completed attack scan. Neither case shows a model choosing victims on its own. Both show that access controls, logging and notification decide how bad an agent incident gets.
A managed deployment product answers that commercially. If customers run GPT-6 Cyber through OpenAI's orchestration layer, OpenAI sees the targets, the scopes and the actions, and it can revoke access. The customer gets automation it could not safely build itself. OpenAI gets usage it can monitor, a recurring contract and a reason to charge more than token prices. The Australian timeline is also the weakest part of the pitch: a company that took 54 days to spot its own agent crossing a boundary is now selling oversight.
Who gains and who pays
The listed incumbents have so far been treated as winners. CrowdStrike reported annual recurring revenue of $5.84 billion at July 31, up 25%, with record net new ARR of $333 million. Palo Alto Networks reported next-generation security ARR of $9.1 billion, up 63%. Both rose about 13% to 14% on September 14 after Anthropic chief executive Dario Amodei's warning essay, before Bernstein downgraded Palo Alto, Okta and SentinelOne on September 17, arguing that a roughly 100% sector rally since early 2026 had priced in the good news. Google paid $32 billion for Wiz, which closed in March; against Wiz's reported $1 billion of ARR in 2025, that is about 32 times recurring revenue for cloud and code security. That price is the benchmark for what the labs are now competing to own.
The bear case for incumbents is plain. If a lab sells a model that finds, validates and patches flaws on its own, customers need fewer scanners, fewer penetration testers and less manual triage. The desk thinks that case is right for vulnerability management and application security, and wrong for endpoint and network security. CrowdStrike and Palo Alto own the telemetry and the enforcement point; a model that finds a bug still needs something on the machine to stop an attacker using it tonight. Both are also Glasswing partners, so they already use a frontier lab's cyber model as an input to their own products. Vendors whose product is the list of flaws are more exposed, because that list is what GPT-6 Cyber produces. Penetration-testing boutiques face the same squeeze on price.
A skeptic's first objection is that none of this is confirmed. Reuters could not verify Fortune's account, OpenAI has published no system card for GPT-6 Cyber, and a "preview" can mean a blog post and a waitlist. That is fair, and the desk treats the model's capabilities as unknown until OpenAI publishes evaluations. The commercial direction does not depend on it: the Daybreak tiers, the $1 billion credit programme and the Critical designation for Astra are all on OpenAI's own record.
The desk expects OpenAI to preview GPT-6 Cyber at or before DevDay on September 29 and to keep it restricted to Daybreak Red, with no general API availability, through December 31, 2026. A general release this year would mean OpenAI has more confidence in its safeguards than its 54-day detection record justifies, and would break the call. The next checkpoints are the DevDay announcements, any GPT-6 Cyber system card with exploit-benchmark scores against Astra's, and CrowdStrike's third-quarter results in early December, where slowing net new ARR would be the first sign that lab-sold cyber tools are taking budget from incumbents.