OpenAI uncages GPT-5.6-Cyber for authorized security researchers

If you have ever tried using an AI chatbot for authorized penetration testing, you know the headache: the model suddenly starts lecturing you on ethics and refuses to write the exploit proof-of-concept you need to patch a system.

OpenAI is finally giving vetted security professionals the keys to the armory. The company announced an expansion of its Daybreak cybersecurity access program, anchored by a new specialized model dubbed GPT-5.6-Cyber.

Dropping the refusals for legitimate hackers

Built on top of GPT-5.6 Sol, the new cyber-specific model solves the biggest bottleneck experienced defenders face: constant refusals.

OpenAI split the program into two distinct tiers. Daybreak Blue opens access to general frontier models for standard defensive tasks like malware analysis and patch review. Daybreak Red is the high-clearance tier that unlocks GPT-5.6-Cyber for authorized vulnerability research and exploit validation.

On internal tests evaluating responses to advanced offensive tasks like auth bypass and exploit chaining, standard GPT-5.6 Sol completed just 1.5% of requests. GPT-5.6-Cyber pushed that completion rate to 95.0%, up from the previous generation's 57.3%.

On the ExploitGym benchmark, which tests whether an agent can turn known vulnerabilities into working exploits in controlled settings, the specialized model handily outpaced both GPT-5.6 Sol and GPT-5.5-Cyber.

Real 0-days found in the wild

OpenAI demonstrated that this model is already working on live targets rather than synthetic tests.

Researchers turned GPT-5.6-Cyber loose on Chrome's V8 JavaScript engine. The model spotted a flaw where the optimizing compiler skipped a safety check during integer conversion, causing an array bounds omission. It then uncovered a second vulnerability and chained them together to escape the V8 heap sandbox, resulting in the high-severity CVE-2026-15903 disclosed to Google.

That was not an isolated win. OpenAI revealed the model identified at least five vulnerabilities in a popular mobile OS, three remote code execution flaws in a widely used database, and over 400 privilege escalation vulnerabilities in an operating system kernel.

Early enterprise partners with access include SpecterOps, SentinelOne, and Palo Alto Networks. OpenAI also clarified that GPT-5.6-Cyber was not involved in the recent Hugging Face security incident.

Why it matters

We think this release signals a major tactical shift: frontier labs are acknowledging that safety guardrails designed for the general public actively cripple defensive cyber operations.

For security teams at companies like SentinelOne or internal red teams, getting a 95% completion rate instead of constant refusals turns AI into a genuine automated exploit validation engine. Discovering over 400 kernel privilege escalation bugs in one sweep proves the model's depth in real codebases.

However, dual-use technology always comes with an obvious danger. The exact capability that writes a working PoC to verify a fix can be weaponized into an automated attack script. While OpenAI requires identity verification, tight auditing, and legal attestations, the blast radius of a credential leak grows exponentially with a model this capable.

It also sets off a brutal operational bottleneck for defenders. Finding 400 kernel flaws in hours is impressive, but human maintainers cannot triage, patch, and test at that velocity. Until defensive remediation becomes as automated as discovery, the window to protect infrastructure will feel uncomfortably narrow.