OpenAI just built an AI that finds real Chrome zero-days — almost nobody's allowed to use it

GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only… Aliteq Lena Fischer · AI & Local Compute Editor

GPT-5.6-Cyber launched August 10, 2026, built on GPT-5.6-Sol but specifically trained to stop refusing authorized offensive-security work.

It completes 95% of tasks on OpenAI's internal cybersecurity benchmark, versus 1.5% for the general-release GPT-5.6-Sol and 57.3% for last generation's GPT-5.5-Cyber.

It found two real, previously unknown Chrome V8 vulnerabilities (CVE-2026-15903) that chain into a full sandbox escape — Google has since patched them.

It also surfaced 5+ vulnerabilities in a major mobile OS (including a full admin-privilege chain), three critical database bugs, and 400+ kernel privilege-escalation issues.

Access is gated behind Daybreak Red — currently limited to firms like Accenture, IBM, Capgemini, CrowdStrike, Palo Alto Networks and Cisco, with hardware security keys mandatory from September 1.

I don't think restricting GPT-5.6-Cyber to a partner list contains this capability for long — models this useful tend to get replicated or leaked on a timeline measured in months, not years. What…

Read the full story

Aliteq OpenAI just built an AI that finds real Chrome zero-days — almost nobody's allowed to use it Read the full story on Aliteq