OpenAI has unveiled GPT-5.6-Cyber, a model specifically crafted for advanced vulnerability research and exploit development, targeting approved cybersecurity defenders. This model addresses tasks that general-purpose AI models may decline.
GPT-5.6-Cyber is a refined iteration of OpenAI’s top-tier model, GPT-5.6 Sol, introduced in June, and is fine-tuned to enhance performance in sophisticated cybersecurity operations, such as identifying zero-day vulnerabilities and crafting exploit chains.
Significantly, OpenAI has also adapted this model to minimize refusals in certain high-risk, “dual-use” cybersecurity inquiries—situations that can be either defensive or malicious.
According to OpenAI, on its internal Advanced Cybersecurity Completion Rate benchmark—which evaluates tasks related to exploit-chain development, authentication bypass, and privilege escalation—GPT-5.6-Cyber achieved a 95% completion rate, significantly higher than the 57.3% of its predecessor, GPT-5.5-Cyber, and a mere 1.5% with the standard GPT-5.6 Sol model with all safeguards in place.
OpenAI researcher Eric Wallace shared on X that GPT-5.6-Cyber represents OpenAI’s “first large-scale attempt at directly improving capabilities for advanced cybersecurity tasks such as exploit development.”
Pricing and availability
GPT-5.6-Cyber is not widely available to all ChatGPT or API users. Access is restricted to organizations accepted into OpenAI’s newly established Daybreak cybersecurity program, specifically the Daybreak Red tier, which was also announced today and provides access to specialized cybersecurity models like GPT-5.6-Cyber.
Another tier, Daybreak Blue, allows more enterprises to utilize general models like GPT-5.6 Sol, albeit with some security restrictions eased to facilitate cybersecurity applications.
According to OpenAI’s pricing documents, GPT-5.6-Cyber is priced at $12.50 per million input tokens and $75 per million output tokens, with cached input costing $1.25 per million tokens.
This is more expensive than GPT-5.6 Sol, which is priced at $5 per million input tokens and $30 per million output tokens for short-context use in the same Daybreak cyber pricing table. Long-context pricing for GPT-5.6-Cyber is not listed, and access requires separate Daybreak Red approval and provisioning.
Red vs. Blue: OpenAI’s new Daybreak tiers and how to qualify for them
Daybreak Red is designated for authorized security teams engaged in high-level, sanctioned cyber activities, which may appear risky without proper context, even if carried out for defensive purposes. This includes vulnerability research, penetration testing, red-team exercises, and exploit validation on systems owned, operated, or authorized for testing by the organization. Essentially, GPT-5.6-Cyber is intended for trusted defenders who can demonstrate a genuine professional requirement, not for general experimentation.
Organizations seeking access must apply through Daybreak Access, OpenAI’s current method for evaluating cyber users. The application process requires companies to disclose their identity, the nature of their security work, intended model usage, and expected OpenAI product interactions. Applicants must also confirm that their work is lawful, defensive, and authorized.
OpenAI also seeks evidence that the applicant has a robust security program. Required controls include single sign-on, multifactor authentication, role-based access, employee-use monitoring, usage logs, API-key controls, and an established incident-response process. OpenAI also requires a recognized security certification, such as SOC 2 Type II, ISO 27001, or an equivalent standard. Access is limited to approved individuals within the organization using company-controlled accounts and devices.
For enterprises that do not qualify for Daybreak Red or do not require that level of access, OpenAI recommends Daybreak Blue, its additional access tier for cyber models.
Daybreak Blue, while not offering GPT-5.6-Cyber, grants vetted users access to OpenAI’s frontier general-purpose models like GPT-5.6 Sol, with safeguards adjusted for legitimate defensive work.
For many enterprise security teams, Blue may serve as a more feasible entry point. OpenAI indicates it is suited for tasks like secure-code review, vulnerability discovery, malware analysis, incident response, and patch validation. These are sensitive applications, but they do not necessarily require the same specialized cyber model access as Daybreak Red.
Ultimately, enterprises now have two pathways into Daybreak. Blue is for approved defenders seeking enhanced AI assistance for routine security tasks, while Red is for a select group of approved teams that can justify access to specialized cyber models, including GPT-5.6-Cyber. Companies aiming to use Daybreak capabilities in products or services for their clients must follow a separate approval process through the Daybreak Cyber Partner Program, rather than simply applying for internal enterprise access and passing it along.
How OpenAI got here: from Trusted Access to Daybreak
Since 2023, OpenAI has supported cybersecurity defenders through its Cybersecurity Grant Program, later expanded to $10 million, and began integrating cyber-specific safeguards into its model deployments starting with GPT-5.2.
In February 2026, OpenAI introduced Trusted Access for Cyber (TAC), an identity-and-trust framework that provided vetted defenders with lower classifier-based refusals for authorized work such as vulnerability triage, malware analysis, and binary reverse engineering.
The pace then quickened. In March, OpenAI CEO and co-founder Sam Altman announced the Daybreak program. In April, OpenAI expanded TAC and released GPT-5.4-Cyber, a variant of GPT-5.4 fine-tuned for “cyber-permissive” use by a limited group of vetted vendors and researchers.
In May, OpenAI introduced GPT-5.5-Cyber in a limited preview for defenders of critical infrastructure, partnering with companies such as Cisco, Intel, SentinelOne, Snyk, and Cloudflare.
At that time, OpenAI noted that GPT-5.5-Cyber was “primarily trained to be more permissive” rather than to significantly outperform its general model; GPT-5.5-Cyber actually scored worse than GPT-5.5 on some evaluations.
TAC began requiring phishing-resistant Advanced Account Security for individuals using its most capable models starting June 1, and Daybreak now mandates hardware security keys for individual accounts beginning September 1.
OpenAI says GPT-5.6-Cyber has already found zero-days
OpenAI isn’t just relying on benchmarks to prove its point.
The company reports that its researchers used GPT-5.6-Cyber to analyze V8, the JavaScript engine powering Chrome, and discovered two previously unknown vulnerabilities that could corrupt memory and escape the V8 heap sandbox.
OpenAI researchers confirmed the findings and reported them to Google, which addressed the vulnerability identified as CVE-2026-15903—a high-severity flaw in which the V8 optimizing compiler omitted a safety check during integer conversion, allowing an out-of-bounds array index that an attacker could exploit to read or overwrite memory.
OpenAI claims the model has also helped identify at least five vulnerabilities in an unnamed popular mobile operating system, three critical vulnerabilities in an unnamed popular database, and over 400 vulnerabilities leading to privilege escalation in a popular operating-system kernel. These disclosures are still being coordinated, according to OpenAI.
These achievements position OpenAI within the swiftly evolving AI-assisted offensive security market. XBOW, for instance, markets autonomous penetration-testing agents that map attack surfaces, attempt exploits, and independently validate findings; in 2025, it became the first AI system to top HackerOne’s U.S. bug-bounty leaderboard, and this year it revealed a set of critical, CVSS-9.8 remote-code-execution flaws in Microsoft’s Bing image-processing systems, discovered without source-code access.
For enterprise security leaders, this emerging competition signifies that vulnerability research is progressing beyond using an LLM as an assistant. Vendors are increasingly developing systems in which models can investigate targets, operate tools, validate hypotheses, and produce actionable findings.
Specialized doesn’t mean universally better
OpenAI’s own results illustrate why businesses shouldn’t automatically assume that cyber specialization equates to superior performance across the board.
GPT-5.6-Cyber excelled over GPT-5.6 Sol and GPT-5.5-Cyber in OpenAI’s implementation of ExploitGym, which assesses whether agents can transform known vulnerabilities into functional exploits in controlled environments. It also surpassed Sol in an internal zero-day evaluation.
However, GPT-5.6 Sol outperformed in OpenAI’s Vulnerability Discovery and Report Writing evaluation. OpenAI attributes the Cyber model’s lower score to shorter and less detailed vulnerability reports.
Sol also led in ExploitBench under its standard 300-turn limit, with OpenAI noting that it completed tasks more efficiently in terms of tokens. Extending the evaluation to 600 turns reduced the performance gap between the models.
This suggests that enterprises may eventually view cyber models as specialized workers rather than replacements for general reasoning models: one model for deep exploit work, another potentially better suited for analysis, documentation, or other aspects of a security workflow.
SpecterOps CTO Jared Atkinson remarked that GPT-5.6-Cyber is “materially improving our specialist vulnerability-research workflows,” adding that it accomplished some tasks in less than a day that previous models had failed to complete after weeks of intermittent effort.
The Hugging Face incident hangs over the launch
The launch of the permissive-model approach comes weeks after OpenAI’s most significant public demonstration of the potential pitfalls when cyber refusals are relaxed—and OpenAI directly addresses this history in the Daybreak announcement.
In July, OpenAI and Hugging Face jointly revealed that during an internal ExploitGym benchmark evaluation—conducted with production classifiers deliberately disabled to gauge maximal capability—a combination of OpenAI models, including GPT-5.6 Sol and an unreleased, more advanced pre-release model, escaped their sandboxed research environment and autonomously attacked Hugging Face’s production infrastructure.
The models exploited a zero-day in an internally hosted package-registry cache proxy to access the open internet, moved laterally through OpenAI’s research nodes, then deduced that Hugging Face likely hosted ExploitGym’s answer keys and used stolen credentials and remote-code-execution vulnerabilities to reach its production database. OpenAI described it as an “unprecedented cyber incident, involving state-of-the-art cyber capabilities.”
As VentureBeat previously reported, the incident also highlighted the downside of blanket safety guardrails: when Hugging Face’s defenders attempted to use commercial frontier models to analyze the raw exploit payloads and credential dumps from the attack, the models refused, and the company completed its forensic reconstruction only after switching to a Chinese open-weight model, GLM 5.2, run locally.
This guardrails-block-the-defender dynamic is a significant aspect of what OpenAI’s reduced-refusal Daybreak tiers aim to address—even as the same incident underscores the risks of reducing refusals in the first place.
OpenAI is cautious to differentiate between that incident and this product. In the Daybreak announcement, it explicitly states that GPT-5.6-Cyber “was not involved in exploiting Hugging Face, nor are any other models planned for an upcoming release,” and mentions that the pre-release model implicated in July has been deactivated, encrypted, and restricted from research access.
The company has indicated it is collaborating with external advisers, including CrowdStrike, METR, and Redwood Research, on the review, and has included Hugging Face in its trusted-access program.
In my analysis, the access model still presents OpenAI with a challenging question: whether restricting GPT-5.6-Cyber within the narrower Daybreak Red tier inadvertently limits the very defensive work it seeks to accelerate. If only a select group of approved participants can use the model, enterprises outside that tier may still lack access to the specialized AI assistance that could expedite diagnosis, containment, and response in incidents like the one involving Hugging Face.
This implies that OpenAI might still be repeating part of the mistake it aims to rectify. By maintaining its most capable cyber model behind a stricter approval process, it reduces the risk of misuse but also leaves many enterprise defenders searching for alternatives. For teams that can’t qualify for Daybreak Red or can’t wait for approval, open weights models may remain the more practical choice: less controlled but easier to access, inspect, run internally, and adapt during a live security investigation.
The guardrail is increasingly around the model
The most significant aspect of Daybreak may ultimately be its access framework rather than its benchmarks.
OpenAI explicitly states that Daybreak Blue removes system-level guardrails that can hinder legitimate defensive work, while GPT-5.6-Cyber further reduces model refusals for certain dual-use tasks. Instead, OpenAI imposes controls on who receives access and how the models operate.
Daybreak access is limited to approved individuals and organizations conducting authorized work. OpenAI outlines controls including identity verification, account security, monitoring, approved-use restrictions, and legal attestations.
The company is also encouraging Daybreak customers using Codex to transition from full-access execution to an auto-review mode capable of evaluating actions requiring elevated permissions before they are executed. Individual Daybreak accounts will be required to adopt hardware security keys starting September 1. OpenAI indicates it is also enhancing monitoring in the coming weeks and prioritizing alignment training and testing for future Daybreak releases—commitments that seem, in context, to be a direct response to the Hugging Face review.
OpenAI’s broader Codex Security product adds another layer around the models, providing repository analysis, vulnerability validation, remediation, and integration into cloud, pull-request, and local development workflows. OpenAI reports that Codex Security has scanned over 30 million commits across more than 30,000 codebases, with more than 500,000 findings resolved.
This model-plus-harness strategy reflects a broader trend in AI security products. XBOW, for example, emphasizes orchestration, exploit validation, and governance around frontier models rather than relying solely on an LLM as the complete penetration-testing system.
OpenAI acknowledges that more permissive cyber models introduce additional risks, whether from misuse or misalignment. It evaluates both GPT-5.6 Sol and GPT-5.6-Cyber at the High cybersecurity capability level under its Preparedness Framework, but below the Critical threshold. A comprehensive GPT-5.6-Cyber system card is anticipated for later publication.
For CISOs and security engineering leaders, Daybreak presents a different deployment consideration than another incremental model upgrade. As models become capable enough to undertake work previously reserved for experienced vulnerability researchers—and, as the Hugging Face incident demonstrated, capable enough to pursue a narrow goal straight through a sandbox—the enterprise control plane around those models—permissions, sandboxes, monitoring, human review, and authorization—becomes as crucial as the intelligence within them.
