OpenAI has introduced GPT-5.6-Cyber, a new artificial intelligence model specifically engineered for cybersecurity applications, including the identification of zero-day vulnerabilities and the development of exploit chains. This model is based on GPT-5.6 Sol and is designed to process high-risk, dual-use requests with significantly fewer refusals than standard AI models. Access to GPT-5.6-Cyber is restricted to participants in Daybreak Red, OpenAI's higher-tier vetted access program for cybersecurity professionals.
According to OpenAI, the GPT-5.6-Cyber model is trained to enhance performance in exploit development and advanced security research workflows. The company developed an internal benchmark to measure how frequently its models accept requests related to exploit chains, authentication bypass, and privilege escalation. In these tests, GPT-5.6-Cyber successfully completed 95% of requests, a stark contrast to the 1.5% completion rate of the standard, guardrail-enabled version of GPT-5.6.
Furthermore, OpenAI stated that GPT-5.6-Cyber demonstrated superior performance on ExploitGym, a platform designed to evaluate an agent's ability to convert known vulnerabilities into functional exploits capable of achieving arbitrary code execution in controlled environments. On this benchmark, GPT-5.6-Cyber outperformed both GPT-5.6 Sol and GPT-5.5 Cyber.
OpenAI's own researchers have utilized GPT-5.6-Cyber to discover previously undocumented vulnerabilities. Among these findings were two flaws in Google Chrome's V8 JavaScript engine. These vulnerabilities, when chained together, could lead to memory corruption and allow an attacker to escape the browser's sandbox. Google has since addressed these issues, assigning the identifier CVE-2026-15903 to the combined vulnerability.
The company also reported the identification of high-severity vulnerabilities affecting a popular mobile operating system, a widely used database, and an operating system kernel. OpenAI has not publicly disclosed the names of these affected projects, stating that it is actively collaborating with partners and the open-source community to facilitate disclosure and remediation.
OpenAI confirmed that under its Preparedness Framework, the GPT-5.6 Sol model was assessed as "High" for cybersecurity capability, remaining below the "Critical" threshold. Prior to the launch of GPT-5.6-Cyber, its frontier cyber capabilities were also evaluated, and it similarly reached the "High" threshold but did not cross into the "Critical" category.
The release of GPT-5.6-Cyber follows a recent announcement from OpenAI that it was delaying the launch of its upcoming Astra model. Preliminary testing of Astra had indicated a potential to reach the highest tier of hacking capability under the company's internal risk framework, prompting the decision to hold back its release.
