OpenAI on Monday launched GPT-5.6 Cyber, a model designed specifically for security tasks that general-purpose AI routinely refuses to handle. In an internal test covering exploit chains, authentication bypass, and privilege escalation, GPT-5.6 Cyber successfully answered 95% of requests. By contrast, GPT-5.6 Sol — OpenAI's flagship general-purpose model — answered just 1.5% under standard safeguards and 2% through the lower-restriction Daybreak Blue tier. The new model is now available through Daybreak Red, a new tier in OpenAI's gated cybersecurity program.

OpenAI structured access through two distinct tiers with separate purposes. Blue grants approved defenders access to GPT-5.6 Sol with system-level restrictions removed for defensive security work, including secure code review, malware analysis, incident response, patch validation, and vulnerability discovery. Red provides access to GPT-5.6 Cyber, which OpenAI trained to find zero-days, build exploit chains, and handle advanced security tasks that Sol continues to reject even after its filters are removed. In a test where models were asked to produce code that could bypass macOS Keychain prompts and decrypt Chrome cookies, Sol refused under both standard safeguards and Daybreak Blue, while GPT-5.6 Cyber answered the request through Red. However, Cyber didn't outperform Sol across the board — while it scored higher on ExploitGym, which tests whether an agent can turn known flaws into working exploits in a sandbox, it fell behind Sol when asked to find flaws and write up findings. Sol was also more token-efficient on ExploitBench and outperformed Cyber when agents were capped at 300 turns, though the gap narrowed at 600 turns.

The model used the reasoning capabilities to examine V8, Chrome's JavaScript engine, where it identified two previously undisclosed flaws that could be chained to corrupt memory and escape the V8 heap sandbox, which Google fixed under CVE-2026-15903. The report states the model also found three critical vulnerabilities in a popular database, including a remote path to code execution, at least five in a popular mobile operating system, and more than 400 possible privilege-escalation flaws in a popular operating-system kernel. OpenAI has not named the affected software because disclosure is still underway. SpecterOps CTO Jared Atkinson said GPT-5.6 Cyber "finished work in less than a day that earlier models had not resolved after weeks," pointing to its ability to reason through real exploit constraints free of repeatedly refusing legitimate requests. Under OpenAI's Preparedness Framework, GPT-5.6 Cyber reached "High" for cybersecurity capability but stayed below the "Critical" threshold.

The release came three days after OpenAI acknowledged that Astra, its upcoming model, could reach that Critical threshold, and the company has paused some internal work involving Astra while it studies the model under tighter controls. For DevSecOps teams, the two tiers split along workflow lines — Blue handles pull request reviews, malware analysis, and patch validation, while Red reaches into exploit development and will probably need its own CI/CD environment, credentials, and approval chain. Cyber's reports tended to be shorter and less detailed than Sol's, and because Cyber uses a larger reasoning budget, longer research sessions will likely cost more. OpenAI recommends keeping security agents away from production systems and the open internet, with controls that limit what they can reach and require further review before they move beyond those boundaries. The company is also urging Daybreak customers who use Codex to replace full-access mode with auto-review, which checks commands that need elevated permissions and can stop destructive actions before they run. SpecterOps, SentinelOne, and Palo Alto Networks all received early access, with Palo Alto Networks delivering the models through its Frontier AI Defense offering and SentinelOne through Wayfinder Frontier AI Services. Starting September 1, 2026, individual accounts will be required to use hardware security keys. The tiered approach signals that organizations will need to choose between speed and detail in their security automation, while also accepting that the most capable tools now come with mandatory monitoring and legal attestations. The release also makes clear that the gap between defensive and offensive AI capabilities is narrowing faster than many security teams anticipated.