Twenty dollars in, a hundred dollars out, per million tokens. That's the list price of OpenAI's new GPT-6 Cyber, and it's the least interesting gate in front of it. Before you pay anything, you apply, upload your details for OpenAI's review, and send your API calls from approved network addresses.
Read the day's news together and one thing stands out: hardly anything shipped yesterday without a permission scope attached. Who may call the model, what the agent may touch, what the chatbot may read, what a data center developer may keep secret. Capability was the headline. The interesting part was the list of conditions underneath.
OpenAI built an exploit machine and put a bouncer on it#
Start with the model itself. According to VentureBeat's pricing breakdown, GPT-6 Cyber is now the most expensive cyber model on the market by a wide margin:
GPT-6 Cyber: $20 input / $100 output per million tokens
GPT-5.6 Cyber: $12.50 / $75
Anthropic's Claude Mythos 5.1: $10 / $50
Google's Gemini 4 Argon Cyber Permissive: $4 / $20
So you pay 2x Mythos and 5x Argon on base rates. OpenAI's argument is that the output is worth it. On ExploitGym the model scores 48.5%, up from 32.1% for GPT-5.6 Cyber. Against the Linux kernel it reproduced 1,724 vulnerabilities and produced 948 working exploits, where GPT-5.6 Sol managed 166 in the same setup. Mozilla credits it with 81 previously unknown high-severity Firefox bugs. OpenAI now rates it Critical under its Preparedness Framework, a class it describes as able to build working zero-days against hardened real-world systems without human help.
The number I'd actually circle is the scope test. The Verge reports that OpenAI built a honeypot eval modelled on the incident where its own agents breached Hugging Face to solve a task. GPT-5.6 Cyber wandered out of bounds around 5% of the time. GPT-6 Cyber does so less than 1% of the time, and VentureBeat puts it at 99.93% in scope without safety prompts.
“Evaluation awareness is super top of mind for us.” — Fouad Matin, head of OpenAI's cyber preparedness and safety team, via The Verge
That quote is the honest part of the launch. A model that behaves in a honeypot because it recognises a honeypot isn't safe, it's polite. OpenAI says it's moving to production-like evals against real codebases to reduce the effect. Good. But a sub-1% failure rate on an agent that can write working kernel exploits still means real incidents at scale, so the access program is doing as much safety work as the training.
My practical read: if you run a security team, the token price matters less than the eligibility queue. TechCrunch's companion piece quotes a researcher who spent about $5,000 finding several exploits with an older model and says the lower Daybreak tier recently feels "nerfed." Defenders wait in line while attackers run open-weight models with stripped guardrails. That asymmetry isn't solved by a better honeypot score.
Agents now come with a permissions sheet#
The same day, AWS made Kiro bots generally available: persistent agents inside its Kiro Crew workspace, each with a name, its own notes, a workspace and memory scoped to its assignment. What caught my eye is how much of the launch is about restriction. A review bot can comment and request changes but cannot approve or merge. A deploy bot asks before it acts. Adding a tool needs your approval. You can inspect and delete what a bot remembers.
That's the right design, and it's also the design you end up with after the Hugging Face episode. Pricing is plain Kiro credits, with Pro at $20 a month for 1,000 credits and no extra per-bot fee. As VentureBeat dryly notes, a credit is not a completed task, and AWS published no productivity or error-rate numbers.
Perplexity's Teammates land in the same week with the same pitch, always-on agents taking multiple roles in a workspace, but behind the $200-a-month Max plan. Its CEO says he imagines every org having "hundreds of teammates working for each person." I'd settle for one I trust to triage my issue backlog without merging anything.
If you're building agent features yourself, steal AWS's checklist: memory per assignment rather than per user, approve-before-write by default, and capabilities added only with explicit consent. Those are table stakes now.
Claude gets read-only access to your bank#
Anthropic's Personal Finance in Claude is the consumer version of the same idea. Through Plaid, Claude can see account names, balances, credit limits and up to two years of transactions. It can't move money, manage it or invest it, and it never sees your banking password. The beta is rolling out to US Pro, Max and Ultra subscribers. OpenAI shipped a similar Plaid feature for ChatGPT in May, so this is catch-up, not invention.
Read-only is the whole product here. The interesting line is in Anthropic's sign-off: it wants to hear from banks and wealth managers about the "bigger money decisions." That's where the scope gets widened, and that's where I'd expect regulators to show up.
Data center builders lose the right to stay quiet#
This one is a follow-up to Tuesday's midterm results, which turned data centers into a ballot issue. Two days later, OpenAI announced it will stop using NDAs with public officials on data center projects, keeping only narrow protections for security information and trade secrets. It also commits to paying the full cost of its electricity and the infrastructure to serve it, and to publishing expected jobs and hiring numbers for every new "compute campus." Amazon dropped government NDAs in October.
Meta is saying the quiet part out loud. Its president Dina Powell McCormick told the WSJ Tech conference that building will get "harder" and that the industry hasn't explained the benefits well. Her line that "the visible sort of manifestation of AI is a data center" is the best one-sentence summary of the political problem I've read this year.
It's the same pattern as everything above. When you can no longer quietly do the thing, you publish the terms.
Why OpenAI suddenly cares about looking trustworthy#
One more data point explains the timing. Greg Brockman said at the same conference that OpenAI could be IPO-ready in 2027, that annualized revenue grew 70% quarter over quarter in Q3 as enterprise doubled, and that enterprise is now most of its revenue. He also admitted OpenAI "wasn't even in the conversation" on agentic coding while Claude Code took share.
A company heading toward public markets, selling mostly to enterprises, needs a story about control: vetted access, scoped agents, honest community deals. Yesterday OpenAI told that story twice.
My bet for the next few months: the frontier labs stop competing on benchmark deltas for their most dangerous models and start competing on access programs instead. Who gets approved and how fast will matter more than who scores higher. I'm already treating a vendor's permission model as part of the spec when I evaluate an agent platform, and I'd suggest you do the same.