GPT-5.6-Cyber: OpenAI’s Gated Cybersecurity Model

AI models are becoming increasingly capable of handling complex cybersecurity tasks. However, these same capabilities can also be used for offensive purposes, making cybersecurity a particularly challenging area for AI models.

As a result, standard models may refuse legitimate, authorized requests involving activities such as exploit development, authentication bypass, or privilege escalation.

To address this gap, OpenAI introduced GPT-5.6-Cyber, a specialized model designed to improve performance on advanced cybersecurity workflows while reducing refusals for certain high-risk, dual-use requests.

In this blog, let’s explore GPT-5.6-Cyber, its cybersecurity performance, access and availability, and the safeguards surrounding the model.

GPT-5.6-Cyber is OpenAI’s specialized model for advanced cybersecurity work, including vulnerability research, exploit development, and security testing. It builds on GPT-5.6 Sol with specialized training designed to improve performance on these workflows and reduce refusals for certain high-risk, dual-use cybersecurity requests.

For security researchers, this addresses a practical limitation of general-purpose models. When an authorized researcher asked a base model to reason over an exploit chain, safety guardrails frequently blocked the prompt. GPT-5.6-Cyber is designed to complete more of these requests in authorized security workflows.

The GPT-5.6-Cyber model card publishes the following specifications:

Property	Value
Base model	GPT-5.6 Sol
Context window	400,000 tokens
Maximum output	128,000 tokens
Input	Text and image
Output	Text
Knowledge cutoff	16 February 2026
API surface	Responses API only
Features	Streaming, Structured outputs, Function calling
Tools	Web Search, File Search, Code Interpreter, Hosted Shell, Apply Patch, MCP, etc

Given its advanced capabilities in exploit validation and dual-use workflows, OpenAI manages access to GPT-5.6-Cyber through the Daybreak program. Before diving into its capabilities and performance, let’s first understand how this gated access framework works.

OpenAI’s Daybreak program originally launched in May 2026 as its dedicated cybersecurity access framework. On August 10, 2026, OpenAI formally split Daybreak into two specialized tiers alongside the release of the GPT-5.6-Cyber model.

Blue covers the frontier general-purpose models, including GPT-5.6 Sol, with safeguards specifically adjusted for authorized defensive work.

Blue is scoped for defensive workflows such as :

• Vulnerability discovery
• Secure code review
• Incident response
• Patch validation, etc

However, some highly dual-use requests, such as active production penetration testing or exploit development, may still be refused. Therefore, OpenAI recommends Blue as the starting point for most defenders.

Daybreak Red provides access to purpose-trained cybersecurity models like GPT-5.6-Cyber. It is fine-tuned to minimize false refusals on high-risk, dual-use security workflows.

It is intended for authorized activities such as:

• Advanced vulnerability research
• Zero-day discovery
• Controlled exploit development
• Offensive red teaming and more

Daybreak Red also covers the prior-generation model, GPT-5.5-Cyber, which completed 57.3% of advanced evaluation requests. Approval for Daybreak Red covers both models under strict attestation, hardware key requirements, and continuous monitoring.

The two tiers compare like this:

Metric	Daybreak Blue	Daybreak Red
Models	GPT-5.6 Sol and other frontier general-purpose models	GPT-5.5-Cyber and GPT-5.6-Cyber
Scoped for	Authorized defensive security work	Authorized vulnerability research, exploit validation, security testing
Typical work	Vulnerability discovery, secure code review, malware analysis, incident response, patch validation, detection engineering	Exploit-chain development, exploit reproduction, mitigation development, red team testing
Completion rate on the advanced evaluation	2.0% for GPT-5.6 Sol with Daybreak Blue	95.0% for GPT-5.6-Cyber; 57.3% for GPT-5.5-Cyber
Suits	Most defenders: SOC, incident response, AppSec, detection engineering	Teams with a documented authorized offensive mandate
Vetting	Required	Required, with additional monitoring

Importantly, both tiers require verification. Daybreak Blue being the recommended starting point for most defenders does not make it self-serve. Users must first be enrolled in OpenAI’s Trusted Access for Cyber program, with access controlled through identity verification, account security, monitoring, approved-use restrictions, and legal attestations.

This tiered approach allows OpenAI to provide broader defensive capabilities through Blue, while reserving the more capable and higher-risk cybersecurity models for authorized teams through Red.

Several performance figures have attracted attention around GPT-5.6-Cyber, but they measure different aspects of cybersecurity performance. Understanding the difference between request completion and actual task capability is key to interpreting the results.

OpenAI’s Advanced Cybersecurity Completion Rate measures whether the model completes advanced cybersecurity requests rather than refusing them. The evaluation includes scenarios involving exploit-chain development, authentication bypass, and privilege escalation.

GPT-5.6-Cyber completed 95.0% of these requests, compared with 57.3% for GPT-5.5-Cyber and 1.5% for GPT-5.6 Sol with standard safeguards. GPT-5.6 Sol with Daybreak Blue recorded 2.0%. These numbers show a large difference in how often the models complete the evaluated requests. They don’t represent accuracy, exploit quality, or detection rate.

The strongest support for reading it as completion sits in OpenAI’s own system card. GPT-5.6 Sol and GPT-5.6-Cyber carry the same cybersecurity capability rating: High, below Critical. The completion rate moved a long way. The capability band did not move at all.

The completion rate does not tell us how well the model performs once it attempts a cybersecurity task. For that, OpenAI uses separate evaluations.

On ExploitGym, which evaluates an agent’s ability to turn known vulnerabilities into working exploits in controlled environments, GPT-5.6-Cyber outperformed both GPT-5.6 Sol and GPT-5.5-Cyber. OpenAI did not publish a numerical score for this comparison, so the result establishes the ranking rather than the size of the improvement.

OpenAI also evaluated GPT-5.6-Cyber’s ability to discover and assess novel zero-day vulnerabilities.

For this evaluation, models were given the current release of an open-source repository and asked to develop proof-of-concept exploits with the maximum possible impact, along with a technical report. The evaluation considers the severity and impact of the finding, the accuracy of its severity assessment, and the quality of the technical write-up.

GPT-5.6-Cyber in Daybreak Red outperformed GPT-5.6 Sol in Daybreak Blue, which OpenAI attributes to its specialized cybersecurity training.

OpenAI also tested the models on an open-ended vulnerability discovery task. Agents were given a repository containing a known vulnerability and scored for finding severe and actionable vulnerabilities, developing a working proof of concept, and producing a high-quality vulnerability report.

Both GPT-5.6 Sol and GPT-5.6-Cyber improved over GPT-5.5-Cyber. However, GPT-5.6-Cyber performed worse than GPT-5.6 Sol on this evaluation. OpenAI attributes this partly to GPT-5.6-Cyber sometimes producing shorter and less detailed vulnerability reports.

The results show that GPT-5.6-Cyber is not uniformly better than GPT-5.6 Sol across every cybersecurity task. It performs particularly well on exploit development and zero-day discovery, while GPT-5.6 Sol retains an advantage in some vulnerability discovery and reporting scenarios.

The benchmark results are complemented by real-world vulnerability research.

1. OpenAI researchers used GPT-5.6-Cyber to investigate V8, Chrome’s JavaScript engine, and identified two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox. Researchers validated the findings and disclosed them to Google, which subsequently fixed the issue as CVE-2026-15903.
2. OpenAI also reports high-severity vulnerabilities in a popular mobile operating system, database, and operating-system kernel. The affected products have not been publicly named, and remediation is ongoing, so these findings cannot yet be independently examined in the same way as the V8 case.

GPT-5.6-Cyber is not generally available like OpenAI’s standard models. Organizations and researchers must meet specific access requirements based on the type of cybersecurity work they intend to perform.

OpenAI provides three primary routes for accessing its cybersecurity capabilities:

1. Individual security researchers can verify their identity and request access through OpenAI’s cyber access process. This route is intended for approved researchers conducting authorized security work.
2. Organizations can apply through the enterprise trusted-access process. Once approved, the organization’s security team manages the access and its authorized use.
3. Security vendors and consulting firms can access the capabilities through the Daybreak Cyber partner program. Some partners include Accenture, IBM, Capgemini, EY, KPMG, PwC, Cisco, Palo Alto Networks, CrowdStrike, Sophos, Akamai, Fortinet, Cloudflare, and SpecterOps.

In this model, access remains with the approved security partner rather than being passed directly to its customers. For example, if a penetration-testing firm has Daybreak Red access, its customer does not automatically receive access to GPT-5.6-Cyber. The partner uses the model as part of the security engagement, reviews the results, and provides the relevant findings to the customer.

Provisioning to GPT-5.6-Cyber

Approval and access enablement are separate steps. Having an existing ChatGPT Enterprise subscription or API agreement does not automatically provide access to GPT-5.6-Cyber. After the access request is reviewed and approved, OpenAI provisions the approved organization, workspace, or API organization according to the access path. Users can then use the model through the provisioned access path. Without this provisioning step, attempts to call GPT-5.6-Cyber may appear as though the model is unavailable.

There is also an API requirement to consider. GPT-5.6-Cyber is available through the Responses API only. Existing applications built around unsupported interfaces, such as Chat Completions, Assistants, Realtime, or Batch, would need to be adapted before they can use the model.

This is how the tier and route decisions fit together:

GPT-5.6-Cyber has published pricing of $12.50 per million input tokens, $1.25 per million cached input tokens, and $75 per million output tokens.

Published pricing makes this look purchasable. It is not. There is no plan to buy and no model ID you can call without approval.

Rate limits are determined by the account’s API usage tier, rather than its Daybreak status:

Usage tier	Requests per minute	Tokens per minute
Tier 1	500	500,000
Tier 2	5,000	1,000,000
Tier 3	5,000	2,000,000
Tier 4	10,000	4,000,000
Tier 5	15,000	40,000,000

This means that a newly approved account at Tier 1 remains subject to the Tier 1 limits, regardless of whether it has received Daybreak Red approval.

Note: Although the model documentation may list a Batch queue limit, Batch is not a supported endpoint for the GPT-5.6-Cyber model. Therefore, the Batch limit should not be interpreted as an indication that the model supports Batch processing.

GPT-5.6-Cyber is designed to reduce unnecessary refusals for authorized cybersecurity work, but OpenAI does not treat reduced safeguards as unrestricted access. Instead, Daybreak combines broader cybersecurity capabilities with additional controls intended to keep their use within approved boundaries.

OpenAI is introducing the following measures to make these capabilities safer:

• Hardware security keys: Individual Daybreak accounts are required to use hardware security keys beginning September 1, 2026.
• Auto-review for Codex: OpenAI encourages Daybreak customers using Codex to use auto-review mode, which reviews actions requiring elevated permissions before execution and can block requests that pose significant destructive risks.
• Additional monitoring: OpenAI is working on improved monitoring for Daybreak usage.
• Alignment testing: Upcoming Daybreak releases are being prioritized for additional alignment training and testing.
• Security guidance: OpenAI has updated its Codex safety guidance to help teams keep cyber-capable agents within their intended security boundaries.

Accounts published during the first weeks after launch are not yet a long-term track record, but they provide some early insight into how the model performs in practice.

Jared Atkinson, CTO at SpecterOps, reported that GPT-5.6-Cyber completed work in under a day that earlier models had not resolved after weeks of intermittent effort. This provides an early example of the model’s potential value in specialist vulnerability-research workflows.

Other security practitioners have focused less on the model’s raw capability and more on the security architecture surrounding AI agents. Alex Goller of Illumio, for example, described the approach as a good first step but argued that organizations should not treat model guardrails as their primary defense control. From this perspective, controls such as zero trust and visibility into what an agent can access remain essential.

This highlights an important distinction: better model safeguards can reduce risk, but they should complement—not replace—the security controls surrounding the AI system.

1. Does Our ChatGPT Enterprise Contract Include GPT-5.6-Cyber?
   No. An existing ChatGPT Enterprise subscription or API agreement does not automatically include GPT-5.6-Cyber access. Daybreak approval and data-retention settings are separate. Trusted Access does not automatically include Zero Data Retention, so organizations that require ZDR must request and provision it separately.
   
2. Can We Reach GPT-5.6-Cyber Through Microsoft Foundry or Azure?
   No. GPT-5.6-Cyber is not generally available through cloud-provider-hosted paths such as Azure. Organizations that require a cloud-provider path should work with their OpenAI account team to determine whether an approved option is available.
   
3. Is GPT-5.6-Cyber Available as a Regular ChatGPT Model?
   No. It is an API model reachable only through Daybreak Red, on the Responses API. Some headlines have called it “ChatGPT 5.6 Cyber,” which is misleading. No ChatGPT plan or subscription tier includes it.
   
4. Can We Use GPT-5.6-Cyber Through an Existing Daybreak Partner?
   Indirectly. Your partner runs the model and delivers reviewed findings. The partner retains model access and does not transfer it to you, so you should treat the findings as candidates that still require validation in your own environment.
   
5. Is Daybreak Blue Priced Differently From Daybreak Red?
   OpenAI publishes a rate card for GPT-5.6-Cyber, but none specific to Blue. Blue exposes existing frontier models rather than a new one, so their standard rates apply. The tier governs safeguards and eligibility, not the rate card.

For most security teams, the immediate impact is limited. GPT-5.6-Cyber is available through a separate, more restricted access tier, so its release does not automatically change what every security team can do with AI. The bigger change is what the release signals: AI is moving deeper into advanced vulnerability research and security testing, not just routine defensive tasks.

That’s it! We hope this blog helped you understand the GPT-5.6-Cyber model and its access tiers. If you have any questions or feedback, feel free to drop them in the comments below!