OpenAI launched GPT 5.6 Cyber on August 10, 2026, and the odd part is not that it can help with security research. We already knew AI models were getting better at code, bug hunting, and security work. The part that made me stop and read the announcement twice was the access model. OpenAI built a model that answers far more advanced cyber requests than GPT 5.6 Sol, then put it behind a separate approval program called Daybreak Red.
That tells you a lot about where AI security is going. GPT 5.6 Cyber can help approved defenders study zero day bugs, validate exploits, work through exploit chains, and test systems they are allowed to test. OpenAI says it is purpose trained for this kind of work and is based on GPT 5.6 Sol. It is also much less likely to refuse a hard security request. This sounds great for a security researcher who has spent half an hour explaining to a chatbot that yes, the lab machine is really their own machine. It also creates an obvious problem. The same knowledge can be useful to somebody who should not have it.
So access itself has become part of the product.
The 95 percent number sounds wild, but read it properly
The number getting the most attention is 95 percent. OpenAI made an internal test called Advanced Cybersecurity Completion Rate. It checks how often a model completes advanced requests around exploit chain development, authentication bypass, privilege escalation, and other hard security cases. GPT 5.6 Cyber completed 95.0 percent of those requests. GPT 5.6 Sol completed 1.5 percent. Sol with Daybreak Blue access completed 2.0 percent. GPT 5.5 Cyber reached 57.3 percent.
Those figures are easy to turn into a silly headline like “AI can hack 95 percent of systems.” That is not what the test means. It measures whether the model will complete the request, not whether it can compromise 95 percent of real targets. I spent more time than I expected checking this part because the number looks almost too clean when you first see it. The test is mainly telling us that OpenAI has moved the refusal line a lot for approved Red users.
And that matters. A security model that keeps saying no is not much use during serious research. Imagine you are testing a real authentication bug in a sandbox and the assistant explains basic OAuth for the fifth time instead of helping you follow the bug. That gets old fast. OpenAI says feedback from researchers using GPT 5.5 Cyber included persistent refusals, so GPT 5.6 Cyber was trained to reduce them.
But there is a tradeoff people should not skip over. Lower refusal rates mean the company must be much better at deciding who gets access. If a normal model refuses nine risky requests out of ten, a stolen account is one kind of problem. If a specialist model completes almost all approved classes of advanced requests, the account itself becomes a much more sensitive asset. Suddenly the boring parts, identity checks, hardware security keys, account monitoring, are part of the security story.
OpenAI seems to know this. Daybreak access is controlled through identity checks, account security, monitoring, approved use limits, and legal attestations. Individual Daybreak accounts are scheduled to require hardware security keys from September 1, 2026. OpenAI also said on August 10 that more monitoring changes are planned in the coming weeks. As of August 15, that work is still developing.
That last detail is easy to miss, but I think it matters more than another benchmark chart.
Daybreak Blue and Red are two very different doors
Daybreak Blue is the normal starting point OpenAI recommends for defenders. It gives approved users GPT 5.6 Sol with fewer cyber restrictions for work such as code review, malware analysis, incident response, vulnerability management, investigations, and security assessments. It is meant for teams doing normal defensive work where the public version of a model may block legitimate requests.
Red goes further. GPT 5.6 Cyber sits there. OpenAI describes Daybreak Red as the access level for advanced vulnerability research, exploit validation, exploit development, red teaming, and security testing. Separate approval is required. You do not just pick the model from a public menu and start sending prompts.
I like this split more than pretending one public safety setting can understand every cyber request. Intent is messy. “Show me how this auth bypass works” can come from a defender, a bug bounty researcher, an internal red team, or someone poking at a server they do not own. The text can be almost identical. A model cannot always work out the difference from one prompt.
So OpenAI moved part of that decision outside the conversation. Verify the person or company, set rules around the account, then give that account a model that can be more direct. It is a cleaner idea. It is also more centralized, and that part deserves criticism.
A private company is deciding who counts as a trusted defender. That can work well for large security firms, cloud companies, banks, or vendors with formal teams. I am less sure how comfortable it will be for a very good independent researcher in Bengaluru, Warsaw, Lagos, or some small town where they do not have a famous employer behind them. Good security research has never belonged only to big companies. Approval systems can accidentally favour people who already have paperwork, contacts, and legal support.
OpenAI has expanded the Daybreak Cyber Partner Program with firms such as Accenture, IBM, Capgemini, Cognizant, NCC Group, SpecterOps, CrowdStrike, Cisco, Cloudflare, Palo Alto Networks, and others. That gives the model a path into existing security operations. Fine. But the independent researcher question should not get buried under enterprise logos.
GPT 5.6 Cyber is better at some jobs, and worse at another one
This part made the launch much more believable to me. OpenAI did not claim GPT 5.6 Cyber beats Sol everywhere.
On ExploitGym, GPT 5.6 Cyber did better than GPT 5.6 Sol and GPT 5.5 Cyber. ExploitGym tests whether an agent can turn known vulnerabilities into working exploits that reach arbitrary code execution inside controlled environments. That is close to the kind of specialist work the model was trained for, so the result makes sense.
OpenAI also built a zero day evaluation around current open source repositories. The models had to find security problems, build proof of concept exploits with as much impact as they could get, and write up the findings. GPT 5.6 Cyber beat GPT 5.6 Sol with Daybreak Blue access on that test.
Then things get less tidy. On OpenAI’s internal Vulnerability Discovery and Report Writing test, GPT 5.6 Cyber did worse than GPT 5.6 Sol. OpenAI says Cyber sometimes wrote shorter and less detailed vulnerability reports. That is a very useful failure to publish. A model can be better at pushing an exploit forward and still be worse at explaining the bug in a report another engineer can act on.
There is another awkward result. ExploitBench asks an agent to turn a V8 vulnerability into a full exploit with more defenses left on. In the standard 300 turn setup, GPT 5.6 Sol performed best and used tokens more efficiently. When OpenAI increased the limit to 600 turns, Cyber closed some of the gap.
Basically, specialist does not mean best at everything.
That should affect how teams use it. If your job is a broad code audit and you need a careful report, Sol may still be the better pick. If you are already deep in exploit research and the normal model keeps refusing the next step, Cyber makes more sense. Some teams will probably use both in the same investigation. One model hunts hard, the other cleans up the report. A bit janky, maybe, but realistic.
The other thing is cost. Cyber tends to use a larger reasoning budget, according to OpenAI. More thinking means more tokens, and the token price is already high. I will come back to that because the pricing is not a small footnote here.
The V8 case is where this stops feeling like a lab demo
Benchmarks are useful, but I care more about what happened with V8. OpenAI says its researchers used GPT 5.6 Cyber to study V8, the JavaScript engine used by Chrome. They found two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox. The team validated the findings and reported them to Google.
Google fixed one of the bugs and assigned CVE 2026 15903. OpenAI describes it as a high severity flaw in V8’s optimizing compiler. During a value conversion, the compiler could skip a safety check. An undefined value could then turn into an unexpectedly large number. If that number became an array index, the compiler might wrongly decide the access stayed inside the array and remove the normal bounds check. That can lead to reads or writes into memory used by other objects.
There is a second part. Getting code execution inside Chrome’s sandbox is not the same as escaping the heap sandbox. OpenAI says GPT 5.6 Cyber found another vulnerability needed for that chain as well. This is exactly why serious exploit work is hard. A single bug is often just one piece. The boring looking interaction between two bugs can be the part that changes the severity.
OpenAI also says the model helped identify at least five vulnerabilities in a popular mobile operating system, three critical vulnerabilities in a popular database, and more than 400 vulnerabilities that can lead to privilege escalation in a popular operating system kernel. The company has not named every affected project because disclosure and fixes are still in progress. That is a good place to be careful. These are OpenAI’s claims at this stage, not a public set of 400 fully documented CVEs that anyone can independently count today.
And there is another detail I respect. OpenAI says GPT 5.6 Cyber was not involved in the Hugging Face incident mentioned in its recent security updates. When a new cyber model launches near a security story, people will connect dots even when there are no dots. Saying what the model did not do is useful.
The V8 work is enough on its own. If a model can help researchers stay inside a huge C++ codebase, form a theory, test it, follow memory behavior, and then help connect two flaws, that changes the amount of software one team can inspect. It does not remove the researcher. OpenAI’s own description says researchers validated the findings before disclosure. I would not trust an AI generated exploit report without human validation either, and I write that as somebody who is very pro AI for engineering work.
A false positive in a blog post is annoying. A false claim about a browser escape can burn days of engineering time.
The context window is huge, the bill can be huge too
GPT 5.6 Cyber has a 400,000 token context window and a maximum output of 128,000 tokens. Its documented knowledge cutoff is February 16, 2026. It accepts text and image input, and it outputs text. Through the Responses API it supports tools such as web search, file search, code interpreter, hosted shell, patch application, computer use, MCP, skills, and tool search. Fine tuning is not supported right now.
The 400,000 token number fits security work better than it fits normal chat. A real repository can have thousands of files. Add build logs, crash traces, test output, a patch, a few issue threads, maybe a design document, and suddenly context disappears faster than expected. A big window means the agent can keep more of that investigation in view.
Still, a big context window is not magic memory. Dumping half a repository into one request can make the job worse if most of it is noise. Generated files, old test fixtures, copied dependencies, stale comments, and random build output can pull attention in the wrong direction. I have seen this problem with normal code assistants already. More context feels better until you realise you gave the model 200 files it did not need.
Now the price. OpenAI lists GPT 5.6 Cyber at $12.50 per million input tokens, $1.25 per million cached input tokens, and $75 per million output tokens. Prompts above 272,000 input tokens get a higher rate for the whole request: twice the normal input price and one and a half times the normal output price. That can get expensive very quickly in a long agent session.
Take a rough example. A research loop repeatedly feeds source files, crash output, tool results, and revised patches back into the model. It may run for hundreds of turns. Even if caching helps, output tokens at $75 per million are not cheap. If Cyber also tends to think longer than Sol, the difference becomes visible on a real invoice.
Some people will look at $75 and say it is expensive. For a developer asking for unit tests, yes. For a security team trying to find a browser escape before it reaches millions of machines, the maths is different. One solid vulnerability can justify a lot of API spend. A team still needs to track cost per accepted finding, not cost per million tokens. Otherwise you end up celebrating a smart model while finance wonders why one weekend experiment ate the monthly budget.
This is where I think OpenAI’s Blue first recommendation makes sense. Do not send every security ticket to the most expensive specialist because the name says Cyber. Use Sol for the normal work. Bring Cyber in where the harder access and reasoning are worth paying for.
The agent part worries me more than the chat part
A chat model that gives a wrong answer can waste your time. An agent with shell access can do something much worse before you finish your coffee.
GPT 5.6 Cyber can work with hosted shell, file tools, computer use, patch tools, and other actions through the Responses API. In a controlled lab, that is exactly what you want. Security research is repetitive. Run the program. Trigger the crash. Read the stack. Change the proof of concept. Run it again. Check the result. Repeat until the theory survives contact with the machine.
But permission design gets serious here. OpenAI’s broader GPT 5.6 safety testing found that the model family can sometimes continue pursuing a user’s goal beyond the exact action the user meant. The rate was low in its testing, but the behaviour exists. Put that tendency next to a security model with reduced refusals and tool access and you can see why OpenAI keeps talking about sandboxes.
OpenAI recommends running Daybreak work in isolated environments without unnecessary access to production systems or the open internet. It recommends monitoring agent actions and setting clear scope around what systems and actions are approved. For Codex users, OpenAI is pushing auto review mode instead of full access. Auto review can inspect actions that need higher permissions before they run and block requests that look too destructive.
I agree with the restrictive side here. Security people sometimes love giving a tool root because it makes the demo easier. Then somebody forgets the same config is still there two weeks later. We have all seen this movie in one form or another.
And no, a smart model does not deserve broad permissions because it is smart. I would start with less access than a human researcher gets. Give it a disposable environment. Keep production credentials out. Log every tool call. Put write access behind review. If the task needs internet access, allow only what the test needs. This sounds boring. Good security often sounds boring until the day it saves you.
The slightly weird part is that AI safety here starts looking like normal systems security. Identity, least privilege, logging, isolation, review gates. We already know these ideas. The new thing is the worker inside the sandbox can read code, write code, use tools, and keep trying for hundreds of turns.
Is GPT 5.6 Cyber a defender advantage, or future attacker kit?
Both uses are easy to imagine, but access changes the near term answer.
OpenAI currently rates GPT 5.6 Cyber at High for cybersecurity capability and below its Critical threshold. The company says GPT 5.6 Sol and Cyber do better at finding and fixing weaknesses than they do at fully autonomous attacks against hardened targets. That gives defenders some room to use the models for cleanup before offensive AI gets better.
I would not assume that gap lasts. Models get cheaper. Open models improve. Agent tools get better. Private models exist. Attackers do not need an official Daybreak Red account forever if similar ability spreads elsewhere. Locking one model behind approval helps now, but it is not a permanent answer to AI driven offense.
So the smart defensive use is boring again: find bugs faster, patch faster, reduce exposed services, keep software inventories current, test the fixes, and shorten the time between a report and a deployed patch. If AI cuts discovery time from weeks to hours but an organization still takes 90 days to patch an internet facing service, the model did its job and the process failed anyway.
There is a bigger industry issue too. We may be moving toward AI access based on trust level, not just subscription level. Basic model. Pro model. Enterprise model. Approved cyber model. Maybe more categories later. That gives companies a way to release sensitive capability without giving it to anonymous accounts on day one.
I am okay with that direction for advanced cyber models, with one condition: the approval process needs to be transparent enough that independent researchers have a real path in. If it becomes “large company equals trusted, unknown person equals no,” we will lose good research. Security has too many stories where one stubborn person with a laptop found the bug a giant vendor missed.
The second concern is measurement. Most of the launch numbers come from OpenAI’s own internal tests. That is useful for comparing its models under the same setup, but it is still internal testing. Exploit environments are sensitive to small setup changes. A mitigation left on or off can change a task from manageable to nasty. Give the model a hint about the vulnerable file and the problem changes again. I want to see outside researchers repeat more of this work over time.
For now, the V8 disclosure carries more weight with me than the 95 percent chart.
What I would watch next
GPT 5.6 Cyber has only been public for five days as I write this on August 15, 2026. OpenAI says a fuller system card with more Cyber specific evaluations will come later. The company is also rolling out more monitoring measures and the September 1 hardware security key rule for individual Daybreak accounts has not started yet. There is still unfinished work around this launch.
I would watch three things, well, four actually. First, how many independently confirmed bugs come from Daybreak work over the next few months. Second, whether the access process works for skilled independent researchers and smaller security shops. Third, whether auto review and sandbox rules hold up when agents are given messy real tasks instead of clean demos. Fourth, cost. A model can be very good and still be hard to use every day if a long investigation becomes too expensive.
The part I keep coming back to is the V8 case. Not because it proves AI will replace security researchers. It does not. It shows a different thing. A specialist model can sit with a researcher inside an ugly codebase and keep pushing on a bug long enough to help find something real. That is already useful.
And it makes the next question uncomfortable. What happens when this level of cyber ability no longer needs a special program, a high API bill, or approval from OpenAI?
Defenders should probably use the head start while they have it.