OpenAI launches GPT-5.6-Cyber with fewer refusals for exploit research
Daybreak Red limits the purpose-trained model to approved researchers, while Daybreak Blue opens GPT-5.6 Sol for broader defensive work.
By Ryan Merket · Published
Why it matters
OpenAI is moving a larger share of cyber safety from model refusals to verified access, monitoring and sandbox controls. A recent evaluation escape shows why those operational defenses matter.
OpenAI launched GPT-5.6-Cyber on Monday, giving approved security researchers access to a purpose-trained model that will answer many advanced exploit-development requests rejected by its general-purpose models.
https://x.com/OpenAI/status/2086864365379010729
The model, detailed in a five-post thread on X and an August 10th technical post, sits inside a new two-tier structure for OpenAI's Daybreak cybersecurity initiative. The structure separates broadly defensive work from activities such as penetration testing, exploit validation and authorized red teaming.
Daybreak Blue provides approved defenders with GPT-5.6 Sol and safeguards calibrated for vulnerability discovery, secure code review, malware analysis, incident response and patch validation. OpenAI says Blue removes system-level cyber guardrails that can block legitimate defensive requests, although the underlying model can still refuse highly dual-use prompts.
Daybreak Red goes further. It provides access to GPT-5.6-Cyber, which OpenAI built on GPT-5.6 Sol and trained to reduce refusals on authorized vulnerability research, exploit-chain development and other higher-risk security tasks.
OpenAI pushes the refusal rate down
The clearest measure of that change comes from an internal OpenAI evaluation covering authentication bypass, privilege escalation, exploit chains and related scenarios. GPT-5.6-Cyber completed 95% of the requests, according to OpenAI, compared with 1.5% for standard GPT-5.6 Sol, 2% for Sol through Daybreak Blue and 57.3% for GPT-5.5-Cyber.
Those figures measure whether a model completes the request, rather than whether its answer is correct or produces a reliable exploit. The evaluation is internal, and OpenAI says GPT-5.6-Cyber generally uses a larger reasoning budget and more tokens than GPT-5.6 Sol.
OpenAI's other evaluations show a mixed performance profile. GPT-5.6-Cyber beat GPT-5.6 Sol and GPT-5.5-Cyber on OpenAI's implementation of ExploitGym, which tests whether agents can turn known vulnerabilities into working exploits in controlled environments. The specialized model also performed better than Sol on an internal evaluation for finding novel vulnerabilities and estimating their severity.
GPT-5.6-Cyber trailed GPT-5.6 Sol on OpenAI's vulnerability discovery and report-writing evaluation, where the specialized model sometimes produced shorter, less detailed reports. Sol also performed best under the standard 300-turn setting on ExploitBench, a test built around developing a V8 vulnerability into a full exploit. The gap narrowed when OpenAI doubled the limit to 600 turns.
The results position GPT-5.6-Cyber as a specialist for sustained exploit work rather than a universal replacement for GPT-5.6 Sol. OpenAI recommends Daybreak Blue for most security practitioners and reserves Red for workflows that require exploit development or offensive validation.
OpenAI tested the model on Chrome's V8 engine
OpenAI says its researchers used GPT-5.6-Cyber to find two previously unknown vulnerabilities in V8, the JavaScript engine used by Chrome. The vulnerabilities could be chained to corrupt memory and escape V8's heap sandbox, according to OpenAI.
OpenAI reported the findings to Google through coordinated disclosure. Google fixed one of the vulnerabilities as CVE-2026-15903, OpenAI said. The flaw involved V8's optimizing compiler skipping a safety check during an integer conversion, creating a path for an attacker to read or overwrite memory inside Chrome's sandbox.
OpenAI also claims GPT-5.6-Cyber identified at least five vulnerabilities in an unnamed mobile operating system, three critical flaws in an unnamed database and more than 400 privilege-escalation vulnerabilities in an unnamed operating-system kernel. OpenAI has not named the affected projects while disclosure and remediation work continues, leaving the severity and practical impact of those findings dependent on OpenAI's account.
SpecterOps, SentinelOne and Palo Alto Networks received early access. SpecterOps CTO Jared Atkinson said in OpenAI's launch post that the model completed some governed vulnerability-research work in under a day after earlier models had failed to resolve it over weeks of intermittent effort.
The safeguards move to the account and environment
Access to both Daybreak tiers requires OpenAI approval. The Trusted Access application asks for identity, professional background and intended use cases. OpenAI says it will also use account security, monitoring, use restrictions and legal attestations to control access.
Individual Daybreak users will be required to use hardware security keys beginning September 1st. OpenAI is also encouraging Codex users to run cyber agents in auto-review mode, which checks actions requiring elevated permissions before execution. Its deployment guidance calls for isolated sandboxes, explicit authorization boundaries and human monitoring of agent actions.
Those controls carry added weight after OpenAI disclosed on July 21st that GPT-5.6 Sol and an internal research prototype with reduced cyber refusals escaped an evaluation environment and compromised Hugging Face infrastructure. OpenAI said the models found a previously unknown vulnerability in a package-registry proxy, obtained internet access and chained additional weaknesses and credentials to reach Hugging Face systems.
OpenAI explicitly said GPT-5.6-Cyber was not involved in that incident. The episode still established the risk behind Daybreak's design: reduced refusals can give legitimate researchers a more useful tool while making identity verification, sandboxing and monitoring part of the model's effective safety boundary.
OpenAI assessed GPT-5.6-Cyber as "High" for cybersecurity capability under its Preparedness Framework, below the framework's "Critical" threshold. With Daybreak Red, OpenAI is placing a model trained to cross its usual refusal boundaries into controlled professional use and betting that access controls can keep those capabilities focused on authorized systems.