OpenAI released GPT-6 Cyber through the API and Codex to a select group of approved Daybreak Red customers. OpenAI reports 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, 40.3% recall in its web-pentesting evaluation, and materially stronger scope adherence.
Why it matters: The release raises the capability ceiling for vulnerability discovery and exploit validation while making access controls, authorization and human review part of the product boundary rather than optional deployment advice.
Z.ai announced GLM-5.3, a general-purpose coding model trained further on cybersecurity tasks. It reported 84.5% on CyberGym and 54.4% on ExploitBench, delayed public weights for roughly two weeks of safety work, and limited sensitive capabilities to verified users.
Why it matters: An open-weight model with stronger vulnerability discovery can widen defensive access while lowering the cost of scaling reconnaissance and exploit development.
UK AISI and NIST's CAISI found Kimi K3 stronger than GLM-5.2 but below leading closed models on exploit development and a 32-step cyber range. It achieved arbitrary code execution on zero of 41 ExploitBench samples.
Why it matters: A government evaluation separates an open model's general release claims from concrete offensive-cyber capability under documented tasks and token limits.