OpenAI has made a cyber model far less likely to refuse advanced security work. That is useful only if the environment can enforce the boundary the model no longer supplies.
GPT-5.6-Cyber is the first purpose-trained model in OpenAI’s Daybreak Red program. OpenAI says it can complete 95% of requests in an internal advanced-cybersecurity dataset, compared with 2% for Daybreak Blue and 1.5% for ordinary GPT-5.6 Sol. That number describes how often the system attempts a task without refusing. It is not a 95% exploit success rate, an independent benchmark, or permission to point the model at production.
The release changes the operating question. A security team no longer gets to treat model refusals as its primary containment layer. Identity, network access, credentials, review gates, logs, and rollback now carry more of the safety load.
Daybreak Blue and Red solve different access problems
Daybreak Blue gives approved defensive users access to general-purpose models, including GPT-5.6 Sol, with safeguards tailored to cyber work. Daybreak Red adds purpose-trained cyber models whose refusal behavior is reduced further. GPT-5.6-Cyber is available through Red.
The distinction matters because the safest default is not the most capable tier. If Sol or Blue can investigate an alert, review a patch, explain a crash, or validate a remediation, use that path. Red belongs to authorized work that genuinely fails because a general-purpose system refuses or stops early.
Reduced refusal is an access property. It is not a quality grade and it is not a substitute for authorization.
The 95% figure measures completion, not correctness
OpenAI’s Advanced Cybersecurity Completion Rate asks whether a model completes advanced requests rather than declining them. The company reports the following internal results:
| Access path | Model | Company-reported completion rate | What the number means |
|---|---|---|---|
| Standard safeguards | GPT-5.6 Sol | 1.5% | Most advanced requests are refused |
| Daybreak Blue | GPT-5.6 Sol | 2.0% | Defensive access with tailored safeguards |
| Daybreak Red | GPT-5.5-Cyber | 57.3% | Earlier purpose-trained cyber model |
| Daybreak Red | GPT-5.6-Cyber | 95.0% | Purpose-trained model with substantially fewer refusals |
The information gain is in the denominator. A model that attempts more tasks creates more consequential actions to inspect. Teams should track whether the answer was correct, whether the scope was respected, what tools were used, and whether the final report was complete. A lower refusal rate without those measures is merely a larger volume of unreviewed work.
Specialized does not mean better on every cyber task
OpenAI also published counter-results that deserve equal billing. GPT-5.6-Cyber performs worse than GPT-5.6 Sol on the company’s Vulnerability Discovery and Report Writing evaluation because its reports can be shorter. At the standard 300-turn setting on ExploitBench, Sol performs best. The difference narrows when the budget rises to 600 turns.
That creates a routing rule a benchmark headline cannot supply. Use the cyber model when refusal blocks an authorized, tightly scoped task. Compare it with Sol when report completeness, evidence quality, or a constrained turn budget matters. Store both the model choice and the budget with the result so a reviewer knows what kind of pass ran.
The Chrome finding is real; the larger discovery claims remain attributed
OpenAI says GPT-5.6-Cyber found two V8 vulnerabilities that could be chained for a heap-sandbox escape. One has a public record. Google’s Chrome stable-channel advisory credits OpenAI Codex Security researcher “amyb” for CVE-2026-15903, a high-severity V8 out-of-bounds read/write flaw fixed in Chrome 150.0.7871.128 and .129.
The US National Vulnerability Database says crafted HTML could exploit the flaw for arbitrary code execution inside the sandbox. Its record carries a CISA ADP CVSS score of 8.8, rated High, and reports no known exploitation. That independent record verifies the vulnerability and its severity. It does not validate every broader claim about the model.
OpenAI additionally says the model found at least five mobile operating-system vulnerabilities, three critical database vulnerabilities, and more than 400 kernel privilege-escalation vulnerabilities. Those figures are company-reported and not yet independently auditable through public disclosures and patches. Treat them as leads, not a public vulnerability census.
The system card is still missing
OpenAI assessed GPT-5.6-Cyber at High rather than Critical cyber capability, but says the dedicated system card will arrive later. That publication gap matters. Today, outside readers can inspect the announcement, access rules, one verified Chrome vulnerability, and selected benchmark summaries. They cannot yet audit a full capability and safeguard package.
A High classification is not a reason to relax controls. Our report on AI cyber-test incidents reaching real systems showed how prompt scope can lose to permissive infrastructure. Our AI agent security scorecard turns that lesson into questions about identity, secrets, network access, logging, and rollback.
A practical gate before requesting Daybreak Red
- Prove Blue is insufficient. Record the authorized task, the refusal or capability gap, and why a purpose-trained model is necessary.
- Build an isolated range. Default-deny outbound traffic, allow only named destinations, and keep production systems outside the test path.
- Issue temporary identities. Use per-run credentials with the smallest permissions and automatic expiry. Do not reuse tokens between runs.
- Stop external effects. Require approval before public messages, account creation, code publication, new network listeners, destructive actions, or changes outside the range.
- Log the whole route. Preserve the access tier, model, prompt, tools, destinations, approvals, artifacts, findings, and rollback result.
- Run a second pass. Compare important findings and reports with Sol, static analyzers, reproduction steps, and a human reviewer.
OpenAI says Daybreak access requires approval, identity verification, account security, monitoring, use restrictions, and legal attestations. Individual accounts must use hardware security keys beginning September 1, 2026. The company also recommends Codex auto-review for many tasks before granting broader model access. That is a sensible default: let a constrained review system prove value before opening a general interactive surface.
My verdict: request Red for a documented gap, not curiosity
GPT-5.6-Cyber is a meaningful release because it makes advanced defensive work possible where normal safeguards would stop the model. The verified Chrome finding shows that this is more than a refusal-rate demonstration. The public evidence also shows why model choice must remain task-specific: Sol can produce stronger reports and beat the specialist under a standard exploit-turn budget.
Start with Blue. Move to Red only for an authorized task that Blue cannot complete. If the environment cannot enforce destinations, credentials, approvals, and rollback without relying on the model’s cooperation, it is not ready for the model.
Read the primary sources
- Read OpenAI’s Daybreak Blue, Red, and GPT-5.6-Cyber announcement.
- Review OpenAI’s trusted-access requirements for frontier cyber models.
- Check Google’s Chrome stable-channel advisory for CVE-2026-15903.
- Inspect the NVD record for CVE-2026-15903.
Which external action would your current security-agent setup stop before the model could perform it?
Checked August 11, 2026. Product, access, benchmark, capability, and vulnerability-discovery statements are attributed to OpenAI unless independently supported by the Chrome advisory or NVD record. OpenAI’s system card was not public at the time of review.
