OpenAI Released an ‘Offense-Grade’ AI Hacking Model: Who Can Actually Use GPT-5.6-Cyber

What exactly is GPT-5.6-Cyber and how does it differ from standard GPT-5.6 Sol?

GPT-5.6-Cyber is OpenAI’s first purpose-trained cybersecurity model, launched on August 10, 2026, as a variant of GPT-5.6 Sol built specifically for offensive security workflows. OpenAI’s official Daybreak announcement describes the model as designed for “advanced, authorized cybersecurity work,” covering zero-day vulnerability research, exploit chain development, privilege escalation testing, and authentication bypass analysis.

The core difference between GPT-5.6-Cyber and GPT-5.6 Sol is not primarily capability but policy. GPT-5.6 Sol refuses many dual-use security prompts, such as penetration testing against production systems, even when system-level guardrails are removed. GPT-5.6-Cyber is trained to answer those prompts for users OpenAI has vetted. This matters because security researchers routinely encounter exactly these refusals when trying to use general-purpose frontier models for legitimate red team and exploit validation work.

The two models also differ in their training objectives. Reduced refusals is a policy change. Improved zero-day discovery is a training change. GPT-5.6-Cyber pursues both goals, and they do not always move in the same direction. That distinction becomes important when evaluating what the model’s headline benchmark number actually measures, which is addressed in detail below.

What does the 95% completion rate benchmark actually mean?

OpenAI’s internal Advanced Cybersecurity Completion Rate benchmark, which measures willingness to assist with exploit-chain development, authentication bypass, and privilege escalation tasks, shows GPT-5.6-Cyber completing 95% of such requests, compared to just 1.5% for the standard safeguarded GPT-5.6 Sol and 2% under Daybreak Blue access. That is the figure that has dominated coverage since the launch, and it is genuinely significant for security workflows where refusals create friction during legitimate testing.

The limitation of that number is important to state clearly. The benchmark measures how often the model responds, not how often it is correct. It is a refusal metric, not a capability metric, and most coverage has blurred the two. OpenAI’s own evaluations reveal a more nuanced picture. On OpenAI’s own Vulnerability Discovery and Report Writing evaluation, GPT-5.6-Cyber scores worse than plain Sol, and Sol also wins ExploitBench at the standard 300-turn setting while using fewer tokens.

That marks a substantial jump from the predecessor GPT-5.5-Cyber, which completed only 57.3% of comparable requests, addressing persistent complaints from security researchers about excessive model refusals during legitimate work. For most security teams, the practical value of GPT-5.6-Cyber is concentrated in exploit validation, zero-day research, and multi-step attack chain construction, rather than replacing general analysis or report-writing workflows where Sol remains competitive.

What real-world vulnerabilities did GPT-5.6-Cyber find before launch?

Since the model finished training, OpenAI used it to extensively study and improve selected software projects. In one case, OpenAI used GPT-5.6-Cyber to investigate V8, the JavaScript engine used by Chrome, and uncovered two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox. Researchers validated the findings and reported them to Google through coordinated vulnerability disclosure. Google fixed the vulnerability and assigned it as CVE-2026-15903.

CVE-2026-15903 carries a CVSS score of 8.8 and is an out-of-bounds read and write vulnerability in the V8 JavaScript engine that could allow a remote attacker to potentially execute arbitrary code inside a sandbox via a crafted HTML page. The underlying flaw is specific: CVE-2026-15903 is a high-severity vulnerability in V8’s optimizing compiler that incorrectly skipped a safety check when converting values to integers, allowing undefined values to produce an unexpectedly large number instead of the expected result. Used as an array index, that number lets the compiler assume it falls inside the array’s bounds and omit the usual check, which opens up reading or overwriting memory belonging to other objects.

The Chrome findings were not isolated. OpenAI reports the model also helped identify at least five vulnerabilities in a major mobile operating system, three critical database vulnerabilities, and more than 400 privilege-escalation issues in a widely used operating system kernel. Disclosure and remediation work is ongoing with affected developers and open-source communities. These results represent the strongest public evidence that GPT-5.6-Cyber provides meaningful capability beyond refusal reduction. For organizations working on AI-assisted attack surface analysis, the Chrome findings illustrate what a model trained specifically for offensive security can surface at scale.

What is Daybreak Red and who qualifies for access?

Daybreak Red is the higher-access tier of OpenAI’s expanded Daybreak cybersecurity program, launched alongside GPT-5.6-Cyber on August 10, 2026. Daybreak Blue opens frontier general-purpose models, including GPT-5.6 Sol, to approved defenders for everyday security work, while Daybreak Red gates the new GPT-5.6-Cyber model behind tighter vetting for vulnerability research, exploit validation, and security testing.

The model is available only through Daybreak Red, and OpenAI controls entry through identity verification, account security requirements, monitoring, approved-use restrictions, and legal attestations. Starting September 1, 2026, hardware security keys become mandatory for all individual Daybreak accounts, covering both Blue and Red tiers. Requiring a physical security key closes off the easiest account-takeover paths, including SIM-swapping and phishing-based OTP theft, for accounts that in the Red tier can request functional exploit chains on demand.

There are 3 application routes depending on who is applying. Individuals verify their identity and request trusted access at chatgpt.com/cyber; organizations apply through OpenAI’s enterprise form; security vendors join the Daybreak Cyber Partner Program. Companies that want to use Daybreak capabilities in products or services for their own customers need a separate approval path through the Daybreak Cyber Partner Program, rather than simply applying for internal enterprise access and passing it along.

How do Daybreak Blue and Daybreak Red compare for security teams?

OpenAI’s own positioning frames Blue as the default entry point; most defensive workflows, including vulnerability discovery, code review, and incident response, do not need Red-tier permissiveness. Security teams that only need to analyze malware, review code for weaknesses, or triage incident data should apply for Blue first and reserve a Red application for engagements that specifically require AI-assisted exploit construction or zero-day research under an authorized scope. OpenAI recommends isolated environments and defined authorization scopes, with human oversight retained for higher-risk activity.

What are the verified costs, and what governance controls apply?

OpenAI’s documents list pricing for GPT-5.6-Cyber at $12.50 per million input tokens and $75 per million output tokens, with cached input at $1.25 per million tokens. That makes GPT-5.6-Cyber more expensive than GPT-5.6 Sol in the same Daybreak pricing table, where Sol is listed at $5 per million input tokens and $30 per million output tokens for short-context use. These are baseline token rates sourced from OpenAI’s Daybreak program documentation; confirm current pricing on OpenAI’s official pricing page before budgeting, as rates are subject to change. OpenAI does not list long-context pricing for GPT-5.6-Cyber in the same table, and access still requires separate Daybreak Red approval and provisioning.

The governance layer around the model is more extensive than a standard API key. Program rules include identity verification and account-security requirements, while usage is monitored under restrictions for authorized work. OpenAI recommends isolated environments and defined authorization scopes, with human oversight retained for higher-risk activity. OpenAI is also directing Daybreak customers using its Codex coding agent toward an auto-review mode that evaluates actions requiring elevated permissions before execution. Security teams running the model inside agentic pipelines should treat the auto-review mode as a required control, not an optional one, given that exploit-chain generation on demand presents a significant misuse surface if an account is ever compromised. This is also relevant context for teams tracking broader OpenAI’s approach to high-risk AI capabilities.

What are the risks and limitations of this model that every organization should understand?

GPT-5.6-Cyber is rated “High” in cybersecurity capability under OpenAI’s Preparedness Framework, meaning the company judged that the model meaningfully elevates attacker capability if misused. Under the Preparedness Framework, Sol, Terra, and Luna are treated as High capability in both cybersecurity and biological and chemical risk. None of them reach OpenAI’s Critical threshold in AI self-improvement. OpenAI has implemented a tailored set of safeguards, adapted to each model’s capability profile, to sufficiently minimize the associated risks. GPT-5.6-Cyber sits in the same High tier but with the refusal controls that normally prevent exploit-chain generation largely removed for approved users.

The practical risks for organizations applying for access fall into 3 categories. First, the account-security risk: a compromised Daybreak Red account grants access to a model that can generate functional exploit chains on request, which is why the September 1, 2026 hardware key mandate matters. Organizations tracking the real-world cost of credential theft should treat Daybreak account security as equivalent to privileged infrastructure access. Second, the scope-creep risk: the model’s legal attestations bind the user to authorized-work restrictions, and use against systems outside the defined scope could constitute unauthorized access under the Computer Fraud and Abuse Act (CFAA) and equivalent state statutes. Third, the accuracy risk: OpenAI’s internal Advanced Cybersecurity Completion Rate reports 95.0% for GPT-5.6-Cyber. That metric measures whether the model responds to advanced requests, not answer accuracy, exploit validity, safety, or successful remediation. All model-generated findings must be validated by a qualified security researcher before being treated as confirmed vulnerabilities or used in a report to a client or vendor.

Stop and involve qualified legal counsel before using GPT-5.6-Cyber in a commercial engagement. Authorization scope, responsible disclosure timelines, and the terms of any bug bounty or penetration testing agreement determine whether a particular use is lawful. OpenAI’s Daybreak approval is a prerequisite, not a legal authorization to test a third party’s systems.

FAQ

Can an individual security researcher access GPT-5.6-Cyber without an enterprise account?

Individual researchers can apply for Daybreak Red access through chatgpt.com/cyber, where OpenAI conducts identity verification and evaluates the stated use case. Approval is not guaranteed, and starting September 1, 2026, a hardware security key is mandatory for all individual Daybreak accounts regardless of tier.

Does GPT-5.6-Cyber replace GPT-5.6 Sol for security teams already using Daybreak Blue?

GPT-5.6-Cyber does not replace GPT-5.6 Sol for all security work. On OpenAI’s own Vulnerability Discovery and Report Writing evaluation and on ExploitBench at the standard 300-turn setting, Sol outperforms GPT-5.6-Cyber and uses fewer tokens. The Red-tier model is best suited to exploit validation and zero-day research where refusal reduction matters most.

Is CVE-2026-15903 still an active threat to Chrome users?

CVE-2026-15903 was patched by Google in mid-July 2026. Chrome users running a current version are protected. Update Chrome to version 150.0.7871.128 or later to confirm the fix is applied, and enable automatic updates to receive future security patches without manual intervention.

Which companies have already been granted access to Daybreak Red?

At launch, OpenAI says GPT-5.6-Cyber went first to a group of trusted customer partners; press reporting names Accenture, IBM, CrowdStrike, and Cloudflare among them, which OpenAI has not itself confirmed in the announcement. The broader list of Daybreak partners includes major services firms such as EY, KPMG, and PwC, and cybersecurity companies including Palo Alto Networks, Sophos, Fortinet, and Akamai.

What is the difference between Daybreak Red and the previous Trusted Access for Cyber program?

OpenAI introduced Trusted Access for Cyber (TAC) in February 2026, an identity-and-trust framework that gave vetted defenders lower classifier-based refusals for authorized work such as vulnerability triage, malware analysis, and binary reverse engineering. Daybreak Red extends that framework by gating access to purpose-trained offensive models, including GPT-5.6-Cyber, rather than simply adjusting refusal thresholds on general-purpose models.