OpenAI introduces GPT-5.6-Cyber for authorised security testing

OpenAI has introduced GPT-5.6-Cyber, a cybersecurity-focused model built on GPT-5.6 Sol for vulnerability research, penetration testing and incident response. Made available through the new Daybreak Red access tier, the model is intended for authorised vulnerability research, exploit validation and security testing.

OpenAI said GPT-5.6-Cyber is a more cyber-permissive version of GPT-5.6 Sol and follows GPT-5.5-Cyber, released in June 2026. Its specialised training targets tasks such as finding zero-day vulnerabilities and developing exploit chains, while reducing refusals for some higher-risk, dual-use cyber requests.

Completion rate rises sharply under Daybreak Red

To assess those reduced refusals, OpenAI created an internal metric called Advanced Cybersecurity Completion Rate. It measures whether a model responds to prompts involving exploit-chain development, authentication bypass, privilege escalation and other advanced cybersecurity scenarios.

GPT-5.6-Cyber completed 95.0% of the evaluated requests. GPT-5.6 Sol completed 1.5%, while the Daybreak Blue configuration completed 2.0%. GPT-5.5-Cyber completed 57.3% of the requests. Daybreak Blue provides access to frontier general-purpose models, including GPT-5.6 Sol, with guardrails tailored to authorised defensive work.

OpenAI said Daybreak Red is being provided to trusted customer partners including Accenture, Akamai, Cisco, Cloudflare, CrowdStrike, Fortinet, IBM, Palo Alto Networks, PwC and Sophos. The stated aim is to identify and patch weaknesses before attackers exploit them.

Benchmark results and a patched V8 flaw

In OpenAI’s ExploitGym evaluation, GPT-5.6-Cyber outperformed both GPT-5.6 Sol and GPT-5.5-Cyber. The company also reported improved performance in finding novel zero-days and calibrating their severity. For open-ended work involving repository investigation, proof-of-concept development and high-quality reporting, however, it performed worse than GPT-5.6 Sol because it sometimes produced shorter and less detailed reports.

One high-severity issue attributed to the model is CVE-2026-15903, a V8 JavaScript engine out-of-bounds read and write vulnerability with a CVSS score of 8.8. A remote attacker could potentially use a crafted HTML page to execute arbitrary code inside a sandbox. OpenAI said it could be chained with another previously unknown flaw to escape the V8 heap sandbox; Google patched CVE-2026-15903 in mid-July 2026.

The launch lands amid broader concern about AI-assisted attack workflows, including the incidents involving AI agents and exploit activity tracked in AI agent incidents and exploit activity and the growing speed from disclosure to exploitation. OpenAI acknowledged that reduced safeguards create risks from misuse or misalignment, even as it argues that defenders need frontier capabilities.

Human validation remains essential

OpenAI said its model has also flagged at least five vulnerabilities in a popular mobile operating system, three critical flaws in a popular database and more than 400 privilege-escalation issues in a popular operating system kernel. These claims illustrate the potential scale of AI-assisted research, but not a substitute for engineering review.

Research cited from 1Password highlights the limit: cyber-capable reasoning models fully resolved vulnerabilities without materially changing application behaviour in 26.0% of patch attempts. In 53.9% of cases, generated patches did not resolve the issue, introduced a new vulnerability, or did both. Businesses using such tools should restrict access to authorised teams, independently validate findings and test every proposed remediation before production deployment.