GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only handing it to firms like Accenture, IBM and CrowdStrike.
OpenAI's newest model chained together a real memory-corruption bug in Chrome's V8 engine well enough to escape its sandbox — and it did that weeks before you're reading this. GPT-5.6-Cyber, launched August 10 as the centerpiece of an expanded Daybreak program, completes 95% of tasks on OpenAI's internal 'Advanced Cybersecurity Completion Rate' benchmark: finding zero-days, building exploit chains, bypassing authentication. The safety-locked public version of the same base model completes 1.5% of the same tasks. That 93-point gap is the whole story.
The number that actually matters: 95% vs 1.5%
OpenAI's 'Advanced Cybersecurity Completion Rate' measures whether a model will actually finish requests like exploit-chain development, privilege escalation, and authentication bypass — the exact tasks a general-purpose assistant is trained to refuse. That's why GPT-5.6-Sol, the public model GPT-5.6-Cyber is built on, only completes 1.5% of them: it's supposed to say no. GPT-5.6-Cyber is the same underlying model with that refusal training deliberately stripped out for vetted use, and last generation's GPT-5.5-Cyber already showed what that unlocks — 57.3% completion. The new model more than doubles that.
Advanced Cybersecurity Completion Rate, by access tier
GPT-5.6-Cyber
Model
95%
Completion rate
Daybreak Red
GPT-5.5-Cyber (last gen)
Model
57.3%
Completion rate
Daybreak Red
Daybreak Blue (Sol + safeguards)
Model
2%
Completion rate
Daybreak Blue
GPT-5.6-Sol (general release)
Model
1.5%
Completion rate
Public
Model
Completion rate
Tier
GPT-5.6-Cyber
95%
Daybreak Red
GPT-5.5-Cyber (last gen)
57.3%
Daybreak Red
Daybreak Blue (Sol + safeguards)
2%
Daybreak Blue
GPT-5.6-Sol (general release)
1.5%
Public
What it's actually found so far
The Chrome find is the concrete one: GPT-5.6-Cyber identified two previously unknown bugs in V8, Chrome's JavaScript engine, where the optimizing compiler skipped a safety check during an integer conversion — that produced an out-of-bounds array index, and chaining the two bugs together corrupted memory badly enough to escape V8's heap sandbox entirely. Google patched it as CVE-2026-15903 in Chrome 150.0.7871.128. Beyond that single headline bug, OpenAI says the model has also surfaced at least five vulnerabilities in a major mobile operating system — including one chain that escalates a restricted app to full administrator privileges — three critical bugs in a widely used database, and more than 400 separate privilege-escalation issues in an OS kernel.
Daybreak Red access is currently limited to a short list of vetted security firms and vendors. · Unsplash
I don't think restricting GPT-5.6-Cyber to a partner list contains this capability for long — models this useful tend to get replicated or leaked on a timeline measured in months, not years. What OpenAI is really buying with Daybreak Red is a head start for defenders. Given how the last twelve months of AI-enabled attacks have gone, a head start beats nothing, even if it's an uncomfortably short-term answer.
Best for: Security teams at large enterprises with an existing OpenAI relationship
Can regular ChatGPT or API users access GPT-5.6-Cyber?
No. It's exclusive to Daybreak Red, which requires an approved partner relationship with OpenAI, identity verification, and — from September 1, 2026 — a hardware security key. The general-release GPT-5.6-Sol model has the same offensive-security behavior deliberately trained out.
Did GPT-5.6-Cyber find a real Chrome vulnerability?
Yes — two previously unknown bugs in the V8 JavaScript engine that chain into a full sandbox escape, patched by Google as CVE-2026-15903 in Chrome 150.0.7871.128.
How is this different from OpenAI's Astra model?
Astra is a separate, more general frontier model OpenAI has held back from release over its cyber-offense capability. GPT-5.6-Cyber is narrower and purpose-built for authorized security work, released to vetted partners under strict controls rather than delayed indefinitely.
Is this the same as Anthropic's Mythos?
They're competing approaches to the same problem — AI-assisted offensive and defensive security — from rival labs. Neither is publicly available to ordinary users.
Watch the September 1 hardware-key deadline as the real signal here: that's OpenAI admitting password-and-email verification wasn't enough friction for a model this capable. Expect the partner list to grow slowly and the access requirements to get stricter, not looser, as more of these models ship.
