Restricted-access cyber AI models tracker: GPT-6 Cyber, Gemini 3.8 Flash Cyber and who gets in, dated

The strongest cyber-capable AI models are no longer released to everyone. Google and OpenAI now route their best vulnerability-finding systems through application-based programs for defenders, and the rules differ in ways that matter. This page logs each one with dates, the numbers the vendors publish and the caveats. It is a living tracker: when a program changes, we update this page rather than writing a new one.

How to read this tracker

Every figure below comes from a vendor announcement or from press reporting of one, and is labeled that way. None has been independently replicated in material we reviewed as of November 7, 2026. We list access rules because they are the policy substance: they decide who can use offensive-grade capability and under what monitoring.

Entry 1: Google Fairwind and Gemini 3.8 Flash Cyber (September 2, 2026)

Google's post introduced Gemini 3.8 Flash Cyber as "our most capable cybersecurity model with frontier-level performance in vulnerability detection and automated patching." It is "available to trusted defenders through our new Fairwind Program." Google says it carries looser cybersecurity safeguards than standard Gemini 3.8 Flash, which is why access is restricted.

The Fairwind page says the program pairs the model with Google's CodeMender harness and that more than 650 partners worldwide are participating. Initial access is staged to governments and national cyber authorities, critical infrastructure operators in healthcare, telecommunications, energy and financial services, core technology platforms and trusted Google Cloud customers. Participants must meet operational standards, including limiting access to staff on security, incident response or penetration testing teams and using protections such as multi-factor authentication.

Published numbers, all Google's: above 70% success on an internal multi-language vulnerability benchmark across 20 languages; 47.2% pass@1 on CWE-Bench against 47.8% for a leading frontier model; and, per Google, 2.6 times more correct patches than the best much larger commercial models in Chrome security team testing. Our Fairwind explainer covers who qualifies in more detail.

Entry 2: OpenAI GPT-6 Cyber and the Daybreak programs (November 5, 2026)

OpenAI announced GPT-6 Cyber on Thursday, November 5, per CyberScoop. SecurityWeek and The Hacker News report OpenAI rated it Critical for cybersecurity under its Preparedness Framework, one level above GPT-5.6 Cyber's High. CyberScoop's article does not mention the rating, so we mark it as reported by two outlets. We could not open OpenAI's own announcement page, so the figures below are as relayed by the press.

Reported numbers: 48.5% on ExploitGym against 32.1% for GPT-5.6 Cyber. In a scope test with off-limits decoy services, the model avoided exploiting them in 99.93% of cases without deployment safety prompts, up from 94.49%, and stayed in bounds every time with the prompts. SecurityWeek reports the model reproduced 1,724 Linux kernel vulnerabilities and built working privilege escalation exploits for 948, against 166 for GPT-5.6 Sol with the same tooling. OpenAI reported 304 critical issues to maintainers. It found 81 Firefox flaws that Mozilla rated high severity, and CyberScoop says all reported vulnerabilities were reported to owners and patched.

Access: GPT-6 Cyber is limited to select approved Daybreak Red customers through the API and Codex, with plans to open gradually to all Daybreak Red customers and a dedicated group for approved critical infrastructure defenders. Safeguards include monitoring that checks whether the model's actions match what a user is permitted to do, protections aimed at industrial control systems, and testing of Daybreak Red models by Dragos in a controlled lab.

The data-use condition to watch

CyberScoop reports that starting at the end of the month, data from Daybreak Blue sessions on personal accounts will be used to improve OpenAI's models, including cyber-misuse safeguards, and that after user backlash OpenAI says customers can opt out of training on Daybreak usage. The Hacker News gives the date as November 29, 2026 and says content from those sessions would be used even when the "improve the model for everyone" setting is off. The two accounts differ on the opt-out, so check OpenAI's terms before relying on either.

Related programs logged elsewhere

Anthropic runs a tiered cyber verification program that we covered in our report on its three tiers. For models released without gating, see our tracker of the open-weight cyber capability gap. We log those separately because the policy question is different.

What the programs have in common

Both programs admit organizations rather than individuals, tie access to defensive roles, and keep the vendor in the loop through monitoring. Both publish numbers chosen by the vendor. Neither names an outside body that decides who is admitted or audits the logs. OpenAI's stated rationale, in the words CyberScoop attributes to safety lead Fouad Matin, is a model "that could be used just specifically for safety purposes."

Dragos's Rob T. Lee put the risk plainly: "The skill floor is dropping for the reconnaissance and vulnerability research needed before an attack." That is the argument for gating, and also the argument that gating buys time rather than safety.

Changelog

• November 7, 2026: Tracker created with Google Fairwind (September 2) and OpenAI GPT-6 Cyber (November 5).
• Next review: when OpenAI's primary post is available, when either program changes admission rules, or when an outside group publishes replication of the headline benchmarks.

Our take

Gating is a sensible stopgap and a weak foundation. The details that matter most are not the benchmark scores but the admission criteria, the logging and data-use terms, and whether anyone outside the vendor can check them. We will update this page when those change.