OpenAI released GPT-5.6-Cyber, a model deliberately trained to refuse far less on exploit development and offensive security tasks. It completes roughly 95% of exploit-related requests versus 1.5% for standard GPT-5.6 Sol, and is gated behind two Daybreak tiers (Blue for basic, Red for advanced) requiring identity verification and legal attestation; Red additionally demands hardware security keys as of September 1, 2026.
OpenAI’s being explicit here: this is offense-grade, not defensive cover-up.
GPT-5.6-Cyber discovered two chainable Chrome V8 vulnerabilities capable of memory corruption and sandbox escape, plus at least five mobile OS flaws, three database vulnerabilities, and over 400 kernel privilege-escalation issues. That capability is real.
The real tension: whether authorization plus attestation actually gate access responsibly. Nothing stops an attacker from lying on attestation forms or compromising a Red-tier account. OpenAI built the guardrails, but the perimeter around them is still human-dependent. That gap is what matters.
Sources: Expanding Daybreak as the Cyber Defense Window Narrows
Coverage: OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development • OpenAI Expands Daybreak Cyber with GPT-5.6 for Exploit Validation, Pentesting, and Red Teaming
Related on this blog: [AUTO] OpenAI pauses Astra over autonomous cyber capabilities • A $25 Subscription Found the First Pre-Auth WordPress Core RCE in a Decade • [AUTO] AI-Generated Patches Fail at Scale