On 10 August 2026 OpenAI released GPT-5.6-Cyber, a cybersecurity model built on GPT-5.6 Sol, trained to be better at finding zero-days and building exploit chains — and trained to refuse fewer of the requests that work requires.
The headline number is the refusal rate.
| Model | Advanced Cybersecurity Completion Rate |
|---|---|
| GPT-5.6 Sol | 1.5% |
| GPT-5.6-Cyber | 95.0% |
That is OpenAI's own internal evaluation, and it measures how often the model completes a request rather than declining it. A jump from 1.5% to 95% is not a capability improvement with a safety side-effect. It is the point of the release.
OpenAI researcher Eric Wallace described it as the company's first large-scale attempt at directly improving capabilities for advanced cybersecurity tasks such as exploit development.
What it has already found
The claims attached to the launch are specific about impact and deliberately vague about targets:
- At least five vulnerabilities in an unnamed popular mobile operating system
- Three critical vulnerabilities in an unnamed popular database
- More than 400 vulnerabilities capable of producing privilege escalation in a popular operating-system kernel
The third figure is the one that should make you sit up. Four hundred privilege-escalation bugs in one kernel is not a research result. It is a throughput result — it says the cost of finding this class of bug has changed.
The anonymisation is standard disclosure hygiene, and it also means none of it is independently checkable yet.
The gate is the actual policy
GPT-5.6-Cyber is not available to ChatGPT or API customers. Access runs through Daybreak Red, a new tier of OpenAI's Daybreak cybersecurity programme, and organisations have to be accepted into it — with verification routed through trusted partners including Accenture, Cisco and Palo Alto Networks.
This is worth naming plainly, because it is the whole safety argument. The model's guardrails have been substantially removed. What replaces them is an admissions process.
That is a defensible design. It is also a different kind of control from the one the industry has spent three years building. Refusals are a property of the model and apply to everyone equally. An access tier is a property of a contract, and it works exactly as well as the vetting behind it — no better.
Why this is not the same as the misuse reports
We have covered a run of stories about attackers using AI: DeepSeek-agent-driven proxyjacking, and this week Kimsuky assembling a local model stack on its own infrastructure. Those are stories about capability leaking out.
This is the opposite shape. A frontier lab has decided the defensive value of a low-refusal offensive-security model outweighs the risk, and has built a gate rather than a guardrail.
Whether that is right depends entirely on a question the announcement cannot answer: does the defender's advantage from 400 kernel bugs found early exceed the attacker's advantage if the same capability reaches them? Vulnerability discovery is symmetric. The patch pipeline is not.
There is also a quieter problem, and it is already here. Security teams are dealing with AI-generated vulnerability reports that nobody has proved — findings that look rigorous and cost real triage hours. A model tuned to complete 95% of exploit-development requests will produce more output, not more verified output.
What to watch
- Who gets into Daybreak Red. The vetting is the control. If the tier grows quickly, the control weakens quickly.
- Whether the anonymised findings get confirmed. Five mobile OS bugs and 400 kernel escalations should surface as advisories eventually. If they do not, the numbers stay marketing.
- Whether competitors follow. The first lab to ship a low-refusal offensive model changes what the others can decline to ship.
- Triage load. If your team already fields AI-assisted reports, expect volume and expect a lower proportion of them to be real.
The honest summary: this is a considered bet, not a slip. OpenAI has traded a model-level control for an organisational one, in the open, with the numbers published. The bet is that the people they let in are the people they think they are letting in.
