OpenAI Launches GPT-5.6-Cyber and Expands Daybreak Program

OpenAI shipped GPT-5.6-Cyber on August 10, 2026, alongside a restructured Daybreak program that now splits into two explicit tiers. The launch is operationally significant for security teams because it delivers a purpose-trained model with quantified refusal-rate changes and a disclosed real-world CVE — not a research preview, but a product with an application pathway at openai.com/daybreak/partners.

Two Tiers, One Gate

Daybreak Blue gives approved individuals and organizations access to GPT-5.6 Sol — OpenAI's frontier general-purpose model — with production system-level safeguards removed. That guardrail removal is meaningful: those safeguards routinely block legitimate incident response, malware analysis, and patch validation workflows. Daybreak Red goes further, substituting GPT-5.6-Cyber for GPT-5.6 Sol and targeting authorized vulnerability research, exploit validation, and red-team engagements. Access for both tiers requires identity verification, hardware security keys (mandatory for all individual Daybreak accounts beginning September 1, 2026), account monitoring, approved-use restrictions, and legal attestations. OpenAI is also moving Codex users from full-access mode to auto-review mode — a posture change that evaluates tool calls requiring elevated permissions before they execute.

The Refusal-Rate Story

The most legible signal in the launch is OpenAI's internal Advanced Cybersecurity Completion Rate benchmark, which measures how frequently models respond to prompts involving exploit-chain development, authentication bypass, and privilege escalation:

The jump from GPT-5.5-Cyber's 57.3% to GPT-5.6-Cyber's 95.0% directly addresses refusal complaints security researchers raised against the earlier model. The worked example in the announcement — a macOS Keychain bypass request producing full Swift/ObjC decryption oracle guidance from GPT-5.6-Cyber while the other three variants decline — gives that number a concrete texture. As AI systems become more capable of autonomous code execution, the refusal behavior of the underlying model becomes a first-order operational variable, not a compliance footnote.

Benchmark Performance: Specialized Gains, One Tradeoff

GPT-5.6-Cyber was evaluated across four benchmarks, and the results are not uniformly superior to the base model.

On ExploitGym, which tests whether agents can convert known vulnerabilities into working arbitrary-code-execution exploits in controlled environments, GPT-5.6-Cyber outperforms both GPT-5.6 Sol and GPT-5.5-Cyber. On an internal zero-day discovery and severity calibration benchmark — where models receive a live open-source repository and must produce a proof-of-concept exploit with maximum impact plus a technical write-up — GPT-5.6-Cyber also outperforms GPT-5.6 Sol under Daybreak Blue access. On the Vulnerability Discovery and Report Writing evaluation, however, GPT-5.6-Cyber scores below GPT-5.6 Sol; OpenAI attributes this to the model producing shorter, less detailed vulnerability reports. On ExploitBench, which tests V8 exploit development with the V8 sandbox enabled and less vulnerability information provided, GPT-5.6 Sol under Daybreak Blue is more token-efficient and performs best within the standard 300-turn limit — though the gap narrows when the turn limit is extended to 600.

The practical implication: GPT-5.6-Cyber earns its place in exploit development and zero-day discovery pipelines but may need supplementary prompting or a different model for report generation tasks. Teams building agentic security workflows should account for that tradeoff in task routing.

Real CVEs, Not Just Benchmarks

OpenAI used GPT-5.6-Cyber to investigate V8 and uncovered two chained vulnerabilities. The root cause in the disclosed issue, CVE-2026-15903: V8's optimizing compiler incorrectly skipped a bounds-safety check during integer conversion, allowing undefined values to produce unexpectedly large numbers. When that number is used as an array index, the compiler omits a bounds check, enabling out-of-bounds memory read or write — and potential arbitrary code execution inside Chrome's sandbox. A second vulnerability, also found by GPT-5.6-Cyber, enables heap sandbox escape when chained with CVE-2026-15903. Google fixed both under coordinated disclosure.

Beyond V8, OpenAI reports using the model to identify at least five vulnerabilities in a popular mobile operating system (including an untrusted-app-to-local-privilege-escalation chain), three critical vulnerabilities in a popular database including a remote code-execution path, and over 400 privilege-escalation vulnerabilities in a popular OS kernel — all currently in coordinated remediation with Daybreak partners and open-source maintainers. The risk of inadequately controlled AI agent access to privileged code paths becomes substantially more concrete when the agent in question is demonstrably capable of finding and chaining zero-days in production software.

Preparedness Rating

Under OpenAI's Preparedness Framework, GPT-5.6-Cyber was assessed as High for cybersecurity capability — the same rating as GPT-5.6 Sol — and below the Critical threshold. OpenAI explicitly notes that GPT-5.6-Cyber improved over GPT-5.6 Sol on the specific tasks it was trained for, but not sufficiently to cross into Critical territory. The 95.0% completion rate on dual-use prompts, paired with hardware key enforcement and auto-review defaults on Codex, defines the terms on which OpenAI is willing to ship a High-rated model outside the standard guardrail envelope.