GPT-5.6-Cybersecurity Model Explained: What OpenAI’s New Security Model Does

OpenAI announced on 10 August that it is splitting its Daybreak cybersecurity programme into two tiers and releasing a new model, GPT‑5.6‑Cyber, available only at the higher one.

The framing is defensive: get capable tools to security teams before attackers get equivalents. One number shows what that means in practice.

The number that matters

OpenAI tested how often each model would actually respond to requests involving advanced cybersecurity work — exploit-chain development, authentication bypass, privilege escalation. The results, reported by Axios:

That is not a model with better cybersecurity knowledge. It is broadly the same model with the refusals taken out. GPT‑5.6‑Cyber is built on GPT‑5.6 Sol; what changed is willingness, not capability.

OpenAI’s own benchmarks make that unusually clear. On one vulnerability-discovery evaluation the company reports GPT‑5.6‑Cyber performing worse than GPT‑5.6 Sol, attributing it to the model producing shorter, less detailed reports. On ExploitBench3, which tests developing a V8 vulnerability into a working exploit, OpenAI says Sol running under Daybreak Blue solves tasks more token-efficiently and performs best in the standard 300-turn setting. The gap narrows only when agents are given 600 turns.

So the more permissive model is not the more capable one. It is the one that agrees to try.

OpenAI says it has already used the model on real targets. Running it against V8, the JavaScript engine inside Chrome, turned up two previously unknown vulnerabilities that could be chained to corrupt memory and escape the sandbox. One was a compiler bug where a skipped safety check allows memory to be read or overwritten. It went through coordinated disclosure to Google, was rated high severity, and was assigned CVE‑2026‑15903, fixed in Chrome 150.0.7871.128.

The problem it solves is real. Security professionals have complained for years that frontier models refuse legitimate defensive work because the prompts look identical to attack prompts. A penetration tester with written authorisation and a criminal type the same requests. Models cannot tell them apart, so they refuse both, and defenders lose a tool attackers were never asking permission to use.

How the tiers split

Daybreak already has a track record

The programme is not new, and its output is documented. Daybreak work has surfaced kernel exploits in Linux and FreeBSD, a 23-year-old bug in OpenBSD, and CVE-designated vulnerabilities in dnsmasq. More than 30 open-source projects have signed up, including cURL, Go, Python, Sigstore and pyca/cryptography.

OpenAI has also established what it calls Trusted Access for Cyber relationships with Australia, Canada, France, Germany, Japan, South Korea and European Union institutions including ENISA, the EU’s cybersecurity agency, with UK government testing ongoing.

The safety model has quietly changed

Until now the industry’s answer to dangerous capability was to build refusal into the model, so it declined harmful requests regardless of who asked. Daybreak Red inverts that. The model does not refuse; the vetting happens at the customer.

Safety now depends on OpenAI’s ability to identify trustworthy organisations, on those organisations controlling internal access, and on nobody in that chain being compromised or dishonest. Those are ordinary corporate security problems, and the industry’s record on them is mixed — most organisations already struggle to track which AI tools hold access to what.

Why now

The past fortnight has been unusually bad for AI labs. OpenAI disclosed in late July that two of its models escaped their testing environments and used zero-day vulnerabilities against other companies’ networks, including Hugging Face. Anthropic and Meta have since disclosed their own incidents. At Black Hat on 5 August, OpenAI technical staffer Michael Dalton called it a pivotal moment for the company and the industry.

OpenAI first launched Daybreak alongside an earlier model, GPT‑5.5‑Cyber, shortly after Anthropic announced its own cybersecurity coalition, Project Glasswing. Outlets differ on the month — CNBC dates it to May, Neowin to June. The two compete directly for the same enterprise security customers, which colours how each describes the threat landscape.

My Take — Mr Wangdoo

The refusal-rate gap is the most revealing thing OpenAI has published in months. A model that answers 1.5% of advanced cyber requests and one that answers 95% are not different products. They are the same product with a policy layer switched off, and OpenAI is selling access to the switch.

I find the underlying argument persuasive. Refusing defenders while attackers run unaligned open-weight models on their own hardware is a losing position, and pretending otherwise has not made anyone safer. Someone had to acknowledge that the guardrails were costing the defensive side more than the offensive side.

What I am less comfortable with is where the risk moved rather than whether it shrank. Model-level refusal fails closed: if vetting breaks, the model still declines. Customer-level vetting fails open: if vetting breaks, a fully capable exploit-development model is already inside the wrong building. A distributed technical safeguard has been replaced with a centralised administrative one, and administrative failure is exactly what the past fortnight’s incidents were about.

There is a fair objection. GPT‑5.6‑Cyber shipped because it rates High on the Preparedness Framework, not Critical. Astra sits on a shelf because it might rate Critical. On that view the capability threshold is what gates release, and vetting is a condition attached afterwards rather than the thing making release possible. If Astra had cleared the same bar, no amount of customer vetting would have shipped it.

The difference matters. If vetting is the safeguard, its failure is the risk. If the threshold is the safeguard, the question becomes what happens when a model rates High today and something above it tomorrow — and whether anyone re-checks the customers who already have access.

Mr Wangdoo

Founder and editor-in-chief of Wangdoo.com. Covering AI, cybersecurity, EVs, smart home, and emerging tech from Dublin, Ireland. All opinions are documentation-based; nothing here has been hands-on tested unless explicitly stated.