By Naraway
In this article
Within two weeks, Google and OpenAI each released a model they describe as their strongest at cybersecurity, and neither is open to the public. Gemini 4 Carbon went to Google's vetted defenders on 28 October. GPT-6 Cyber followed in early November for approved customers of OpenAI's Daybreak Red programme. Both companies are betting that the safest way to ship an AI that can break software is to give it first to the people who fix it.
Sources: OpenAI via Help Net Security (November 2026); Red Hot Cyber (October 2026).
GPT-6 Cyber: OpenAI's First 'Critical' Cyber Model
GPT-6 Cyber is a version of GPT-6 Astra trained to find vulnerabilities, test whether they can be exploited and help develop patches. OpenAI rates it "Critical" for cybersecurity under its Preparedness Framework, one step above the "High" rating of GPT-5.6 Cyber.
The results OpenAI published are specific. Its researchers used the model to find 81 previously unknown Firefox vulnerabilities that Mozilla rated high severity, and Mozilla has shipped fixes for many of them. They built working exploits for 948 Linux kernel vulnerabilities. Dragos, an industrial security company, said the model found "two zero-days in engineering software" that manages protective relay data.
| Test | GPT-6 Cyber | GPT-5.6 Cyber |
|---|---|---|
| ExploitGym (exploitation) | 48.5% | 32.1% |
| ExploitGym Honeypot (stayed in scope, no safety instructions) | 99.93% | Not reported |
Source: OpenAI, as reported by Help Net Security. Vendor-reported figures.
Access runs through the API and Codex, for selected Daybreak Red customers first. Safeguards include monitoring for actions outside a user's authorisation, protections against stolen credentials, and checks that block high-risk help involving industrial controls, essential services and election systems.
Gemini 4 Carbon: Google's Strongest Model, Defenders First
Google DeepMind called Carbon its next frontier model, "state-of-the-art across cybersecurity and long-horizon capabilities." It arrived two weeks after Gemini 4 Argon. For now it is limited to cybersecurity professionals in Google's Fairwind programme, which has more than 650 partners. It is not in the Gemini app or the public API, and no general release date has been set.
| Test | Gemini 4 Carbon |
|---|---|
| SEC-bench Pro (finding vulnerabilities) | 88.2% |
| ExploitGym (exploitation) | 54.8% |
| CWE-bench (root-cause fixes) | 71.0% |
| Artificial Analysis Intelligence Index | 59 (Claude Opus 5.5: 58; GPT-6 Astra: 57) |
Source: Red Hot Cyber, citing Google and Artificial Analysis. Security scores are Google's own tests; outside developers cannot yet run the model.
Launch pricing for Fairwind users is $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the launch period.
GPT-6 Cyber vs Gemini 4 Carbon
GPT-6 Cyber
Released early November 2026. OpenAI Daybreak Red customers, via API and Codex. Rated Critical for cyber. Published real-world findings in Firefox and Linux.
Gemini 4 Carbon
Announced 28 October 2026. Google Fairwind defenders only. Tops a public intelligence index; security scores self-reported.
On the one test both report, ExploitGym, Carbon's 54.8% is higher than GPT-6 Cyber's 48.5%. Both numbers come from the companies themselves, and no outside lab has run the two side by side.
Also readWhat is Google DeepMind, the lab behind Gemini?
For companies shipping software, the practical change is that the strongest bug-finding tools now sit with defenders first, and attackers will get comparable tools later. Naraway's security team reviews products and AI features for the flaws these models are built to find.
In short
Google announced Gemini 4 Carbon on 28 October 2026 and OpenAI released GPT-6 Cyber in early November. Both are restricted to vetted security teams: Carbon through Google's Fairwind programme, GPT-6 Cyber through OpenAI's Daybreak Red programme via the API and Codex. OpenAI rates GPT-6 Cyber 'Critical' for cybersecurity under its Preparedness Framework. Researchers using it found 81 high-severity Firefox flaws. Google's benchmark scores for Carbon are self-reported.
- Gemini 4 Carbon (28 October) and GPT-6 Cyber (early November) both launched to security teams only.
- OpenAI rates GPT-6 Cyber 'Critical' for cybersecurity, up from 'High' for GPT-5.6 Cyber.
- GPT-6 Cyber scored 48.5% on ExploitGym against 32.1% for its predecessor.
- OpenAI researchers used it to find 81 high-severity Firefox flaws and build exploits for 948 Linux kernel bugs.
- Google reports 88.2% on SEC-bench Pro and 54.8% on ExploitGym for Carbon; outsiders cannot test it yet.
Sources
- OpenAI's GPT-6 Cyber found 81 Firefox flaws earlier AI testing missed, Help Net Security (November 2026)
- GPT-6 Cyber System Card, OpenAI (November 2026)
- GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents, OpenAI (November 2026)
- OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits, The Hacker News (November 2026)
- Gemini 4 Carbon Unveiled: Google AI Sets New Cybersecurity Standard, Red Hot Cyber (October 2026)
- Gemini 4 Carbon announcement, Google DeepMind on X (October 2026)
Frequently Asked Questions
What is GPT-6 Cyber?
A version of OpenAI's GPT-6 Astra trained to find software vulnerabilities, test whether they can be exploited and help write fixes. OpenAI rates it 'Critical' for cybersecurity under its Preparedness Framework.
Who can use GPT-6 Cyber?
Selected, approved customers in OpenAI's Daybreak Red programme, through the API and Codex. OpenAI plans to extend access to all Daybreak Red customers.
Can I use Gemini 4 Carbon?
Only for cybersecurity defenders accepted into Google's Fairwind programme. It is not in the Gemini app or the public API, and no general release date has been announced.
Which is better, GPT-6 Cyber or Gemini 4 Carbon?
There is no independent comparison yet. On ExploitGym, OpenAI reports 48.5% for GPT-6 Cyber and reports cite 54.8% for Carbon from Google's own tests; neither has been verified by outside testers.
