OpenAI launches GPT-5.6-Cyber for vetted exploit research

TL;DR: OpenAI has released GPT-5.6-Cyber, a restricted-access model tuned for exploit development and advanced security research. The headline number: it completed 95% of high-risk cyber requests in OpenAI's internal evals, versus 1.5% for standard GPT-5.6 with normal guardrails. Two previously undocumented Chrome V8 vulnerabilities found by the model were patched and assigned CVE-2026-15903. The model is available only through Daybreak Red, the higher tier of OpenAI's vetted access program.

Product scope

This is not a general release. GPT-5.6-Cyber is available only through Daybreak Red, the higher tier of OpenAI's vetted access program for cybersecurity professionals. That matters more than the model name.

OpenAI's pitch is straightforward: some legitimate security workflows require model behavior that consumer and enterprise chat products are designed to refuse. If you are testing exploit chains, probing auth bypass, or evaluating privilege escalation paths, a refusal-first model is often the wrong tool. GPT-5.6-Cyber is meant to be the opposite: more willing to engage on dual-use requests when the user has been screened.

The company says the model is built on GPT-5.6 Sol and specifically trained to improve exploit development and advanced security research workflows. Daybreak itself has been split into two tiers — Daybreak Blue for defensive teams and Daybreak Red for vetted offensive security work — to reflect that the access model has bifurcated.

Capability delta

The clearest signal is OpenAI's internal benchmark for risky cyber tasks. On prompts involving exploit chains, authentication bypass, and privilege escalation, GPT-5.6-Cyber completed 95% of requests. Standard GPT-5.6, with its default guardrails, completed 1.5%.

That is not a subtle improvement. It is a policy and product split made visible in one number.

OpenAI also says GPT-5.6-Cyber beats both GPT-5.6 Sol and GPT-5.5 Cyber on ExploitGym, an evaluation focused on whether agents can convert known vulnerabilities into working exploits that achieve arbitrary code execution in controlled environments. That benchmark matters because it measures more than recall of public CVEs. It tests whether a model can execute the full chain from vulnerability understanding to exploit construction. There is a caveat here: the source material is thin on exact benchmark scores beyond the 95% versus 1.5% completion rate. We know directionally that the model is stronger, but not by how much on ExploitGym.

Evidence from internal research

OpenAI is also using bug-finding results as proof of utility. Its researchers say GPT-5.6-Cyber helped identify previously undocumented flaws, including two bugs in Chrome's V8 JavaScript engine that could be chained to corrupt memory and escape the browser sandbox. Google fixed the issue and assigned CVE-2026-15903.

That claim is significant for two reasons. First, it moves the conversation beyond "better at CTF-style tasks" into real software vulnerability research. Second, a V8-to-sandbox-escape chain is the kind of work that security teams take seriously because it combines low-level debugging, exploit reasoning, and multi-step chaining.

OpenAI says it also found high-severity issues in a popular mobile operating system, a widely used database, and an operating system kernel, but those targets were not named because disclosure and remediation are still in progress. That is reasonable disclosure practice, but it also means outsiders cannot yet verify the breadth of those results.

Risk framing

The timing here matters. This launch comes only days after the White House unveiled its voluntary AI security review framework focused on closed models from OpenAI and Anthropic, and a day after Meta disclosed a third-party testing flaw in its own frontier model. The pattern is consistent: agent capabilities are outrunning defensive infrastructure, and the labs are now selling the capability they can't always safely contain.

Daybreak Red is OpenAI's response to that reality. Whether the vetting is sufficient will be the question regulators, security researchers, and policy teams ask next.

What builders should take from this

For defenders and red teamers inside vetted organizations: GPT-5.6-Cyber is now a real option for exploit-chain research that legacy tools could not complete in a reasonable time. Two real CVEs in production software were found with the model's help, and the lab is publishing its evaluation methodology as part of the rollout. That is a credible signal, not just marketing.

For everyone else: the 95%-versus-1.5% number is the one to remember. It tells you exactly how much policy-shaped behavior, not capability, separates consumer models from research-grade cyber tools. The frontier model is already capable of doing the work. The bottleneck is access, and OpenAI is now pricing access as a separate product line.

The disclosure pattern is also worth watching. OpenAI named the patched Chrome V8 bug but withheld names for the mobile OS, database, and kernel targets until coordinated disclosure completes. Expect the next two to four weeks to bring more CVEs attributed to GPT-5.6-Cyber. If those land across a broad range of vendors, the case that agent-augmented security research is now a normal part of the disclosure pipeline will be made.