GPT-5.6-Cyber refuses security researchers’ requests far less often

OpenAI has unveiled its latest model, GPT-5.6-Cyber, which is designed specifically for cybersecurity tasks such as identifying zero-day vulnerabilities and constructing exploit chains. This model is notable for its significantly reduced rate of refusals when handling requests related to high-risk, dual-use cybersecurity work. Available exclusively through Daybreak Red, the premium tier of OpenAI’s vetted access program for cybersecurity professionals, GPT-5.6-Cyber represents a strategic advancement in AI's application within the cybersecurity domain.

The company has stated that GPT-5.6-Cyber is trained to enhance performance in specific cybersecurity workflows, particularly those that involve exploit development and advanced security research. This focus on cybersecurity is underscored by OpenAI's development of an internal benchmark designed to measure how frequently each model agrees to process requests related to exploit chains, authentication bypass, and privilege escalation. Impressively, GPT-5.6-Cyber completed 95% of these requests, a stark contrast to the standard, guardrail-enabled version of GPT-5.6, which completed only 1.5%.

In testing scenarios such as ExploitGym, which assesses the ability of agents to transform known vulnerabilities into functional exploits capable of achieving arbitrary code execution in controlled environments, GPT-5.6-Cyber has outperformed both its predecessor, GPT-5.6 Sol, and the previous cybersecurity-focused model, GPT-5.5 Cyber. This performance indicates a significant leap in the model's capabilities, making it a powerful tool for cybersecurity professionals.

OpenAI's own researchers have utilized GPT-5.6-Cyber to uncover previously undocumented bugs, including two vulnerabilities in V8, the JavaScript engine that powers Chrome. These vulnerabilities could potentially be exploited to corrupt memory and escape the browser’s sandbox, a critical security feature. Google has since addressed these issues and assigned them the identifier CVE-2026-15903. Furthermore, the model has identified high-severity vulnerabilities in a popular mobile operating system, a widely used database, and an operating system kernel. However, OpenAI has withheld the names of these affected projects, indicating that it is collaborating with partners and the open-source community to ensure proper disclosure and remediation of the vulnerabilities.

In assessing the capabilities of its models, OpenAI has categorized the GPT-5.6 Sol model as having a High cybersecurity capability, though it falls below the Critical threshold. Prior to the launch of GPT-5.6-Cyber, OpenAI evaluated its frontier cyber capabilities and determined that it also meets the High threshold but does not reach the Critical level. This careful assessment highlights the company’s commitment to maintaining security standards while advancing the functionality of its AI models.

The introduction of GPT-5.6-Cyber comes shortly after OpenAI announced that it would be postponing the release of its upcoming model, Astra. Preliminary testing suggested that Astra could potentially reach the highest tier of hacking capability as defined by the company's own risk framework, prompting the decision to hold back its launch. This cautious approach reflects OpenAI's awareness of the ethical implications and potential risks associated with deploying advanced AI models in sensitive areas such as cybersecurity.

Implications for Creators and Technologists

The launch of GPT-5.6-Cyber signifies a pivotal moment in the intersection of artificial intelligence and cybersecurity. For creators and technologists, this model opens up new avenues for enhancing security measures and developing innovative solutions to combat emerging threats. The high success rate of the model in handling complex requests suggests that AI can play a crucial role in identifying vulnerabilities that may otherwise go unnoticed, thereby bolstering the overall security landscape.

Moreover, the availability of such advanced tools through a vetted access program indicates a shift towards more responsible AI deployment in sensitive fields. By limiting access to qualified cybersecurity professionals, OpenAI is taking steps to mitigate potential misuse of its technology. This approach not only emphasizes the importance of ethical considerations in AI development but also encourages collaboration between AI developers and cybersecurity experts to address vulnerabilities effectively.

As AI continues to evolve, the implications of models like GPT-5.6-Cyber extend beyond mere technical enhancements. They challenge creators and technologists to think critically about the balance between innovation and security, urging them to prioritize ethical frameworks in their work. The ongoing dialogue about the responsible use of AI in cybersecurity will be essential as the industry navigates the complexities of emerging technologies and their potential impact on society.