GPT-6 Cyber: Record Access and Test Scope Separately

OpenAI announced GPT-6 Cyber on November 5, 2026, with initial API and Codex availability for a select group of approved Daybreak Red customers. For a security team evaluating the release, that access statement answers one question: who may currently use the model. A proposed assessment still needs its own record of which systems and activities the system owner has authorized.

Keep access and scope in separate fields

OpenAI says it plans to expand GPT-6 Cyber access progressively to all Daybreak Red customers. Its launch post does not give an exact date for that expansion. An application or an announcement therefore should not be entered as confirmed access for a particular account.

The accompanying system card describes restricted access through Daybreak Red, including identity verification, use restrictions and organizational security requirements. It also describes training intended to keep the model within the user’s authorized scope. These are provider descriptions; they do not establish what a particular system owner has approved for an assessment.

Build a small evaluation worksheet

• Provider access: record the account, model and access channel actually confirmed, with the date of the check.
• Assessment scope: identify the system owner, permitted environment, allowed activities and time window in the team’s approval record.
• Execution evidence: record whether work ran and what was observed. Keep a planned activity separate from a completed check.

This worksheet is an editorial planning suggestion, not a claim that OpenAI supplies these fields. Treat an unknown entry as unresolved. Provider access can be confirmed while a proposed activity remains outside the documented scope; an approved internal plan can also exist while model access is still pending.

Try a fictional three-item plan

Imagine a team proposes reviews of three synthetic training repositories. Its owner has approved two repositories for read-only review; the third has no recorded decision. The scope worksheet contains two approved entries and one unresolved entry. That count says nothing about whether the model is available, whether either review ran or whether any issue was found.

Before an authorized pilot, assign a person to resolve each missing field and retain the decision with the corresponding work item. Afterward, compare the actual activity with that specific record. No account was accessed and no security assessment was performed for this article.

For the post-assessment record, see the Arnica example of tying completed checks to a tested build and documenting components outside the run’s coverage.

Primary sources

OpenAI: GPT-6 Cyber launch and initial availability, November 5, 2026

OpenAI: GPT-6 Cyber System Card, November 5, 2026