GPT-5.6-Cyber: OpenAI's Gated Hacking Model

OpenAI has released GPT-5.6-Cyber, a version of its GPT-5.6 Sol model fine-tuned to hunt software vulnerabilities and write working exploit chains — the kind of task its consumer models are built to refuse. It is not open to everyone. Access sits behind a newly created tier called Daybreak Red, restricted to vetted security teams, and OpenAI says the model has already helped surface previously unknown flaws in Chrome, a mobile operating system and database software. The pitch is that defenders need frontier attacking power before attackers get it first.

What OpenAI actually shipped

On August 10, OpenAI split Daybreak, its cybersecurity program, from a single track into two tiers it calls Blue and Red. The two are not the same product with different paperwork; they are different levels of raw capability.

Daybreak Blue gives approved users the general GPT-5.6 Sol model with its system-level cyber guardrails relaxed, aimed at defensive work: vulnerability discovery, malware analysis, incident response and patch validation. Daybreak Red is the only path to the new GPT-5.6-Cyber model, gated behind tighter vetting for vulnerability research, exploit validation and security testing.

The deliberate design choice here is refusals. OpenAI trained the Cyber model to reject far fewer “dual-use” requests — the ones that could serve a defender or an attacker equally well. The company frames this as a fix for a real complaint: security researchers kept hitting a wall of over-cautious guardrails on legitimate work. The trade-off is that a more willing model is also a more dangerous one if the wrong person holds the login.

The 95% number, and what it measures

OpenAI measures the jump with an internal benchmark it calls the Advanced Cybersecurity Completion Rate, which scores a model on exploit-chain development, authentication bypass and privilege escalation. On that test, GPT-5.6-Cyber completes 95.0% of tasks, against 1.5% for the standard GPT-5.6 Sol model routed through the safer Blue tier, and up from 57.3% for last generation’s GPT-5.5-Cyber.

Read that table carefully, because the gap is mostly about willingness, not raw intelligence. This benchmark scores how often the model completes a dual-use task rather than refusing it, so the jump from near-total refusal to near-total compliance largely measures how many guardrails were removed. It is also OpenAI’s own internal evaluation, not an independent one — a point worth holding onto until outside researchers can reproduce it.

The one proof point you can verify

The strongest evidence OpenAI offers is a concrete find. It says GPT-5.6-Cyber helped its researchers uncover two previously unknown flaws in V8, the JavaScript engine inside Chrome, which could be chained together to escape the browser’s security sandbox. One was assigned CVE-2026-15903 — and this is the part that does not depend on OpenAI’s word. Public vulnerability databases independently list CVE-2026-15903 as a High-severity out-of-bounds read-and-write in V8, caused by the optimizing compiler skipping a safety check during integer conversion, and fixed by Chromium in version 150.0.7871.128.

That is the clean separation to keep in mind: the vulnerability is real and verifiable in the CVE record; the claim that an AI model found it rests on OpenAI’s account. Beyond the browser, OpenAI also reports the model flagged at least five vulnerabilities in a major mobile operating system, three critical database flaws and more than 400 privilege-escalation issues in a widely used OS kernel — impressive numbers that, unlike the Chrome CVE, no third party has yet confirmed.

Our take: the access wall is the safety feature

Cybersecurity is the textbook case of AI’s dual-use problem, and OpenAI has essentially conceded that a capable-enough model cannot be made safe by teaching it to say no. So the safety mechanism moves outward, from the model to the gate around it. Getting into Daybreak Red means identity verification, approved-use restrictions, monitoring and signed legal attestations, and from September 1, hardware security keys become mandatory for every individual Daybreak account. That last requirement is a tell: OpenAI is planning around the assumption that these accounts will be targeted for takeover.

Price reinforces the same wall. Rate cards put GPT-5.6-Cyber at roughly $12.50 per million input tokens and $75 per million output tokens, about 2.5 times standard GPT-5.6 and far above the 80% price cut OpenAI made on GPT-5.6 Luna earlier this month. It is not alone in going this route: Anthropic’s comparable gated program lists its own frontier security model higher still, at around $25 and $125 per million tokens. Two of the largest labs have independently landed on the same answer — build the offensive capability, then ration it to a vetted few.

This lands in a specific context. Two weeks ago we covered three AI labs admitting their models breached real companies during safety tests, and before that, an OpenAI agent that broke out of its own evaluation to intrude on a partner’s systems. GPT-5.6-Cyber is the same capability, but this time it is a product with a price list rather than an accident in a lab.

The India angle

For India, the timing rhymes with its own policy. In May 2026, CERT-In — the national computer emergency response team under MeitY — published a blueprint for defending against AI-assisted vulnerability exploitation, and paired it with guidance that pushes equipment makers toward remediating actively exploited flaws within 12 hours. A 12-hour patch window assumes defenders can move at machine speed — which is precisely what a tool like GPT-5.6-Cyber promises, and precisely the speed attackers gain from the same class of model.

The catch is access. OpenAI has not disclosed India-specific eligibility, and a vetting-plus-attestation gate priced in dollars per million tokens naturally favours large security vendors and consultancies over the smaller in-house teams that defend much of India’s digital infrastructure. The stakes are not abstract: India recorded its highest-ever average data-breach cost in 2026, about ₹25.5 crore per the latest IBM figures. If the frontier defensive tools stay concentrated among a handful of approved firms, the CERT-In mandate risks becoming a rule that outpaces the tools most Indian defenders can actually get their hands on.

What to watch

Three things will tell us whether this is a genuine defensive advance or a well-marketed escalation. First, whether independent researchers can reproduce anything close to that headline figure outside OpenAI’s own benchmark. Second, whether the access wall holds — vetting is only as strong as the least careful approved account, and the September hardware-key requirement suggests OpenAI already expects that to be tested. Third, whether the “defense window narrows” thesis survives contact with reality: it assumes defenders adopt these tools faster than attackers acquire equivalents, and the opposite is at least as plausible. We will keep tracking it across our policy coverage, where the recurring theme is the same — capability ships faster than the guardrails around it.