OpenAI GPT-5.6-Cyber Launches with 95% Exploit Completion Rate

OpenAI released GPT-5.6-Cyber on August 10, 2026, alongside a restructured Daybreak program split into two access tiers. Built on GPT-5.6 Sol and fine-tuned to reduce refusals and sharpen performance on exploit development, zero-day discovery, and authentication bypass tasks, it is the first purpose-trained cybersecurity model OpenAI has shipped through a gated access program.

Two Access Tiers

Daybreak Blue removes system-level guardrails from GPT-5.6 Sol for approved individuals and organizations, supporting incident response, secure code review, malware analysis, and vulnerability management. Daybreak Red adds access to GPT-5.6-Cyber for authorized vulnerability research, exploit validation, and red teaming.

Completion Rate Comparison

To quantify refusal behaviour, OpenAI built an internal evaluation — Advanced Cybersecurity Completion Rate — measuring how often a model responds to prompts covering exploit-chain development, authentication bypass, and privilege escalation.

Removing system-level guardrails via Daybreak Blue moves completion from 1.5% to 2.0% — a 0.5-point gain. The jump to 95.0% requires the purpose-trained model, not merely an unlocked tier, confirming that guardrail removal alone is insufficient for serious offensive research workflows.

Benchmark Performance

On ExploitGym, which tests whether an agent can convert a known vulnerability into a working arbitrary-code-execution exploit in a controlled environment, GPT-5.6-Cyber outperforms both GPT-5.6 Sol and GPT-5.5-Cyber.

On ExploitBench — a harder evaluation targeting V8 vulnerabilities with sandbox protections active and less vulnerability context supplied — GPT-5.6 Sol with Daybreak Blue access performs best within the standard 300-turn budget due to token efficiency. At 600 turns the gap between the two models narrows. GPT-5.6-Cyber uses a larger reasoning budget per task, which is a real operational consideration given AI token costs.

On Vulnerability Discovery and Report Writing — which scores finding real vulnerabilities, producing working proof-of-concept exploits, and writing high-quality reports — GPT-5.6-Cyber underperforms GPT-5.6 Sol. OpenAI attributes this to the fine-tuned model producing shorter, less detailed reports. Both GPT-5.6 models improve over GPT-5.5-Cyber on this benchmark.

Real-World Findings

GPT-5.6-Cyber identified two previously unknown V8 vulnerabilities that can be chained to corrupt memory and escape the V8 heap sandbox. V8's optimizing compiler incorrectly skips a safety check when converting values to integers, allowing undefined values to produce an unexpectedly large integer; if that integer is used as an array index, the omitted bounds check permits reads or overwrites of adjacent heap objects. Google fixed the issue and assigned it CVE-2026-15903.

Beyond V8, OpenAI reports using the model to surface at least five vulnerabilities in a popular mobile OS — including an untrusted-app-to-local-privilege-escalation chain — three critical remote-code-execution paths in a popular database, and over 400 privilege escalation vulnerabilities in a popular OS kernel. Coordinated disclosure is ongoing, a pattern AI-assisted bug hunters are already establishing across security mailing lists.

Preparedness Assessment and Access Controls

Under OpenAI's Preparedness Framework, both GPT-5.6 Sol and GPT-5.6-Cyber were assessed as reaching the High cybersecurity capability threshold but not the Critical threshold. GPT-5.6-Cyber improved over GPT-5.6 Sol on tasks directly trained for, but not sufficiently to reach Critical.

Access controls include identity verification, legal attestations, and account security requirements. Starting September 1, 2026, all individual Daybreak accounts must use hardware security keys. OpenAI is pushing Codex users toward auto-review mode — which evaluates tool calls requiring elevated permissions before execution — rather than full-access mode. Scoped permission profiles and sandbox isolation are recommended for any agentic workflow. Teams can apply at openai.com/daybreak/partners.

The 95.0% completion rate on adversarial cybersecurity prompts, deployed inside a gated and monitored program, is OpenAI's clearest statement that domain-specific fine-tuning — not guardrail removal — is the mechanism for closing the asymmetry between attacker and defender AI tooling. Whether the access controls hold at scale is what this program will answer in production.