GPT-5.6-Cyber: OpenAI’s Hacking Model, and Why You Cannot Use It

GPT-5.6-Cyber is a model built to break software, and OpenAI will not let you near it. On August 10, 2026, the company released a version of GPT-5.6 Sol trained for authorised offensive security work and deliberately tuned to refuse fewer high-risk requests. On OpenAI’s internal Advanced Cybersecurity Completion Rate, it answers 95.0% of advanced cyber prompts. The standard GPT-5.6 Sol behind ChatGPT answers 1.5% of the same prompts.

That gap is the entire story, and almost all of the coverage so far has been written for security professionals. This article covers what the model is, what it has already found in real software, and how the two-tier access programme works. It also covers why OpenAI restricted a model it built deliberately, and what any of it means if you are not a penetration tester. Where a number comes from OpenAI rather than an independent source, it is labelled that way.

The Key Takeaways

• You cannot get it. GPT-5.6-Cyber exists only behind Daybreak Red, an applicant-vetted tier. Ordinary ChatGPT and API customers have no route to it, and it is not coming to consumer apps.
• 95.0% versus 1.5%. On OpenAI’s own benchmark for exploit-chain development, privilege escalation and authentication bypass, the cyber model answers 95.0% of prompts where standard GPT-5.6 Sol answers 1.5%.
• It has already found real bugs. Two previously unknown flaws in Chrome’s V8 JavaScript engine, one of them now fixed and logged as CVE-2026-15903 at CVSS 8.8, plus more than 400 privilege-escalation vulnerabilities in an operating system kernel.
• The safeguard is the gate, not the model. Protection comes from identity verification, monitoring and legal declarations, with hardware security keys mandatory for individual Daybreak accounts from September 1, 2026.
• It is priced like a specialist tool. $12.50 per million input tokens and $75.00 per million output tokens, with a 400,000-token context window, according to OpenAI’s developer documentation.

What GPT-5.6-Cyber Actually Is

GPT-5.6-Cyber is an OpenAI model built on GPT-5.6 Sol and trained for authorised cybersecurity work such as finding zero-day vulnerabilities and building exploit chains. It is configured to refuse fewer high-risk dual-use requests than any model OpenAI sells to the public, and it is not publicly available. Access runs only through the vetted Daybreak Red tier.

Two words in that description carry most of the weight. A zero-day is a flaw nobody has patched yet, because nobody outside the finder knows it exists. An exploit chain is a sequence of smaller flaws strung together so that each one unlocks the next, turning three harmless-looking bugs into full control of a machine. Finding one bug is useful. Chaining them is what turns research into a working attack.

What “purpose-trained” means here

Most security-adjacent AI models are general models with a safety layer bolted on. GPT-5.6-Cyber inverts that. OpenAI took Sol, its frontier reasoning model, trained it further on offensive security tasks, and then loosened the refusal behaviour rather than tightening it. The model is not smarter than Sol in general. It is more willing, and better practised, at a narrow and dangerous set of jobs.

This is the first time OpenAI has shipped something described in those terms. The company framed the launch around defenders rather than capability. Bringing its frontier cyber models into partner services, it said, helps more defenders “find serious vulnerabilities, validate which ones matter, and fix them faster”, as reported in BleepingComputer’s write-up of the release.

The 95% Number Is the Whole Story

OpenAI measures this on something it calls the Advanced Cybersecurity Completion Rate, which tracks how often a model actually answers prompts involving exploit-chain development, authentication bypass, privilege escalation and similar scenarios rather than declining them. It is a measure of willingness, not of skill.

It is also an internal evaluation. OpenAI has not yet published a system card for GPT-5.6-Cyber, so none of the figures below have been independently audited.

The spread across OpenAI’s own lineup is stark.

Read the bottom two rows again. Daybreak Blue removes the system-level safeguards that screen cybersecurity requests, and it moves the number from 1.5% to 2.0%. Note what that does not mean. OpenAI’s usage policies and access controls still apply under Blue, and Sol still refuses the most dual-use prompts on its own. Stripping the request screening off a general model barely changes what it will do. The jump to 95.0% comes from the training, not from the permissions. That is the argument for why a separate model had to exist at all, and it is also the argument for why it had to be locked down.

The generational jump matters too. GPT-5.5-Cyber sat at 57.3%, so the new model nearly doubles the completion rate in a single release. That is the figure to watch if you want a sense of how fast this capability is moving. Set it against our breakdown of GPT-5.6 Sol, Terra and Luna, where the models you are allowed to use sit.

What the Model Has Already Found

OpenAI published concrete results rather than adjectives, which is rarer than it should be.

The headline finding is in Chrome. The model turned up two previously unknown flaws in the V8 JavaScript engine, the component that runs the code on every web page you open. The two could be chained together to corrupt memory and escape the browser sandbox. Google has fixed one of them and assigned it CVE-2026-15903, an out-of-bounds read and write carrying a CVSS 8.8 rating in the CVE record. That is a high-severity score on a component with roughly the widest install base in consumer software.

The second flaw has no CVE yet. OpenAI describes it as still under coordinated disclosure, which is why some reports count one Chrome bug here and others count two. Both counts are describing the same work.

The larger number is elsewhere. In an operating system kernel that OpenAI describes only as widely used, the model surfaced more than 400 vulnerabilities capable of leading to privilege escalation. It found at least five issues in an unnamed mobile operating system, one of them a chain running from an untrusted app all the way to local privilege escalation. A popular database yielded three critical flaws with a path to remote code execution.

Those four findings are separate, and several aggregator write-ups have already fused the 400-plus kernel figure with the Chrome result into a single claim. They are unrelated pieces of work on unrelated software. Treat any article that merges them as unreliable on the rest of its detail.

Daybreak Blue and Daybreak Red

Daybreak is OpenAI’s programme for vetted security work. This release split it into two tiers with very different risk profiles.

Blue is the defensive tier and Red is the offensive one, following the standard blue-team and red-team naming that security has used for decades. The distinction is not cosmetic. Blue gives a trusted defender a familiar model with fewer unnecessary refusals. Red hands over a model trained specifically to build the thing an attacker would build.

Getting into either requires identity verification, account security measures, monitoring and legal declarations. From September 1, 2026, OpenAI requires individual Daybreak accounts to adopt hardware security keys, as covered in The Decoder’s report on the launch. OpenAI has also been explicit that a partner’s customers never touch the model directly, stating that access to the underlying models stays with the approved partner and is not transferred to the customer.

The named partners skew heavily toward large consultancies and security vendors. On the services side: Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group and SpecterOps. Among the vendors: Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet and Cloudflare. Treat that as a snapshot rather than a roster. OpenAI introduces its own list with the words “such as”, its partner page already names others including Tenable, Zscaler, Check Point and Darktrace, and the programme is still expanding. Any article presenting a fixed list of partners will be out of date quickly.

Can You Use GPT-5.6-Cyber?

Almost certainly not. There is no consumer path, no paid upgrade, and no waiting list you join by clicking a button. Every route runs through vetting.

Cybersecurity providers and consultancies apply to join the Daybreak Cyber Partner Program. Organisations that want the capability usually reach it indirectly, through a participating security provider that has already been approved. Individual security professionals can request trusted access on their own account, which means the door is not sealed, but it opens only after identity verification, monitoring and legal declarations. If you do not do authorised security work for a living, none of these apply to you.

The model does have public documentation, which is where the practical details live. OpenAI’s developer page for gpt-5.6-cyber lists a 400,000-token context window with a 272,000-token input ceiling and a knowledge cutoff of February 16, 2026. Pricing runs $12.50 per million input tokens against $75.00 per million output tokens, on the Responses API only. None of that helps you use it. It does confirm the model is a real product with real economics rather than a research demonstration.

OpenAI Paused One Model and Shipped Another Three Days Later

The timing here is the part nobody has written about.

On August 7, 2026, OpenAI paused internal work on Astra, its next frontier model, saying its evaluations could not rule out a Critical cybersecurity capability level under its Preparedness Framework. Read that wording carefully, because a lot of coverage has mangled it. OpenAI did not classify Astra as Critical. It said it could not yet exclude the possibility, and paused the internal work that did not meet its strengthened security requirements. We covered the whole episode in our piece on what Astra proved and why it stopped.

Three days later the company shipped a model trained specifically to develop exploits. The two decisions look contradictory at a glance and are not. Astra was paused because OpenAI did not yet know where its capability topped out. An unknown ceiling on an unreleased model is a different problem from a known capability handed to a vetted partner list under identity verification and monitoring. One is uncertainty. The other is a controlled deployment.

Still, the week tells you something about how OpenAI now reasons. The company is no longer treating offensive cyber capability as a thing to suppress. It is treating it as a thing to meter, on the argument that attackers will get there anyway and defenders should get there first. Whether that argument holds depends entirely on whether the gate holds.

Does GPT-5.6-Cyber Make You Less Safe?

Not directly, and probably not this year. You are not the target, and neither is your laptop. The model is aimed at the software underneath everything you run, and the realistic outcome of a Chrome flaw being found by OpenAI rather than by somebody else is a patch arriving sooner.

The honest concern is structural rather than immediate. The safeguard protecting everyone from this model is a permissions list, not the model’s own behaviour. A model that answers 95% of exploit prompts is dangerous the moment it lands in the wrong hands, and the entire defence is that OpenAI has decided whose hands those are.

Hardware keys and monitoring make that harder to defeat. None of it is impossible to defeat.

There is also precedent for AI running an attack end to end. Anthropic disclosed a campaign in which attackers used Claude Code to autonomously hit around 30 organisations, and that used a general coding model with guardrails in place, not a purpose-built one. The direction of travel is not in dispute. If you want the pattern rather than the individual headlines, we keep a running list of AI safety incidents through 2026.

What OpenAI did not disclose

Three details are missing, and their absence is deliberate. OpenAI has not named the mobile operating system with the five flaws, the kernel behind the 400-plus privilege-escalation issues, or the database with the remote code execution path. Every report describes them only as popular or widely used.

Withholding those names is standard practice during coordinated disclosure, because publishing them before patches ship would hand attackers a map. It also means anybody telling you which mobile OS was affected is guessing. It has not been confirmed as iOS, and it has not been confirmed as Android.

What This Changes for the AI You Already Use

Nothing, today.

The ChatGPT on your Mac still runs the guardrailed Sol that answers 1.5% of these prompts, and that behaviour is unchanged by the existence of a sibling model you will never see. No consumer AI app, this one included, has a route to a Daybreak-tier model, and any tool claiming otherwise is misrepresenting what it has.

What changes is the shape of the argument about AI risk. Until now the debate over frontier models was mostly hypothetical, conducted in terms of what a model might one day do. GPT-5.6-Cyber moved it into the present tense with a CVE number attached, and capability thresholds stopped being a drafting exercise for regulators and started describing a shipped product.

The practical takeaway is smaller than the headline suggests. Patch your browser when Chrome prompts you. That is the end of the chain where this reaches you. The V8 flaw the model found is already fixed, and the only thing between you and that fix is an update you keep postponing.

The Verdict

GPT-5.6-Cyber is the most capable offensive security model any lab has publicly shipped, and OpenAI has handled it about as carefully as a company can while still shipping it. The evidence is concrete, the access controls are real, and the numbers were published rather than hinted at.

The uncomfortable part is what the 95% figure implies about the gap between what these models will do and what they are permitted to do. That gap is now enormous, and it is held shut by paperwork. For you, nothing changes this week. For the security industry, the clock on AI-assisted attacks just moved, and OpenAI has decided the answer is to arm the defenders first.

Frequently Asked Questions