OpenAI has introduced the specialized model GPT-5.6-Cyber, designed for zero-day vulnerability discovery, exploit chain development, and incident response. The model is available through a new access tier, Daybreak Red, to a limited group of partners — Accenture, Cisco, CrowdStrike, Palo Alto Networks, and other major cybersecurity companies. Its key feature is a radical reduction in refusals for requests related to offensive tasks: according to OpenAI’s internal benchmark, the model completes 95% of such requests, whereas the base GPT-5.6 Sol completes only 1.5%. This is the first attempt by a major AI developer to deliberately create a “permissive” model for offensive security, which raises serious questions about the balance between defense and potential abuse.
Access architecture and technical metrics
GPT-5.6-Cyber is built on GPT-5.6 Sol and is an evolution of the GPT-5.5-Cyber model, which, according to OpenAI, was released in June 2026. The model is distributed through the Daybreak program, launched in May 2026 and including two access levels:
- Daybreak Blue — access to general-purpose models (including GPT-5.6 Sol) with safety constraints tuned for defensive tasks: incident detection, investigations, and vulnerability management
- Daybreak Red — access to specialized models with minimal restrictions for authorized penetration testing, exploit validation, and vulnerability research
To assess the “permissiveness” of the model, OpenAI developed an internal benchmark called the Advanced Cybersecurity Completion Rate, which measures the share of completed requests across scenarios such as exploit chain development, authentication bypass, and privilege escalation. OpenAI reports the following results:
- GPT-5.6-Cyber (Daybreak Red): 95.0%
- GPT-5.5-Cyber: 57.3%
- GPT-5.6 Sol (Daybreak Blue): 2.0%
- GPT-5.6 Sol (without Daybreak): 1.5%
According to OpenAI, on the ExploitGym benchmark the model also outperformed both GPT-5.6 Sol and GPT-5.5-Cyber. However, it is important to keep in mind that both benchmarks are OpenAI’s internal developments, and their methodology has not undergone independent validation.
Discovered vulnerabilities: what is confirmed
OpenAI claims that GPT-5.6-Cyber has discovered several real-world vulnerabilities. The only one that can be verified against primary sources is CVE-2026-15903 (CVSS 8.8). This is an out-of-bounds read/write vulnerability in the V8 JavaScript engine, allowing a remote attacker to potentially execute arbitrary code within the sandbox via a specially crafted HTML page. The vulnerability was patched by Google in mid-July 2026.
At the same time, attributing the discovery of CVE-2026-15903 specifically to the GPT-5.6-Cyber model is based solely on OpenAI’s statements — this information is not confirmed in Google’s bulletin. Claims about hundreds of other discovered vulnerabilities (in mobile OSs, databases, and operating system kernels) are likewise not backed by independent sources, specific CVEs, or the names of affected products.
A critical paradox: finding does not mean fixing
It is noteworthy that OpenAI itself acknowledges that GPT-5.6-Cyber is inferior to the base GPT-5.6 Sol in end-to-end tasks — discovering vulnerabilities in a repository, developing a working proof of concept, and producing a high-quality report. The reason is that the model generates shorter and less detailed vulnerability reports.
This paradox is reinforced by an independent 1Password study, which showed that modern language models are extremely unreliable at fixing detected vulnerabilities:
- Only 26.0% of generated patches fully eliminated the vulnerability without changing application behavior
- 20.1% of patches eliminated the vulnerability but broke application functionality
- 53.9% of patches either did not fix the vulnerability, or introduced a new one, or both
This means that more than half of automatically generated fixes potentially expand the attack surface. Models optimized to detect a wide spectrum of vulnerabilities effectively fix only a narrow subset of them.
Risk assessment and strategic implications
The release of GPT-5.6-Cyber defines a new category of tools — “permissive” models for offensive security. This creates several levels of risk:
- Access asymmetry. The model is available to a limited group of large companies. This widens the gap between organizations that can afford a partnership with OpenAI and the rest of the market
- Dual-use problem. OpenAI explicitly acknowledges: “Models with reduced safeguards carry risks that go beyond standard usage — both from abuse and from behavioral misalignment”
- Acceleration of the arms race. According to OpenAI, AI is already shortening the time from vulnerability disclosure to exploit creation. The emergence of specialized models for exploit development may accelerate this process on both sides
Recommendations
For organizations that have gained access to GPT-5.6-Cyber through Daybreak Red:
- Do not rely on automatically generated patches without manual verification — given 1Password’s data, more than half of such fixes are potentially dangerous
- Use the model as a tool for discovery and prioritization, not as a substitute for expertise in developing fixes
- Implement access control procedures for the model and audit of requests, taking into account its high level of “permissiveness” (95% completion rate for offensive requests)
For all other organizations:
- Expect the window between vulnerability disclosure and the appearance of a working exploit to shrink — tighten your patching SLAs accordingly
- Ensure that Chrome and Chromium-based browsers are updated with the fix for CVE-2026-15903
The arrival of GPT-5.6-Cyber is not just the launch of a new product but a signal of a paradigm shift: the largest AI developer is deliberately creating tools for offensive security with minimal restrictions. Organizations should focus on two concrete actions: accelerating the patching cycle (especially for browser engines and components with high CVSS scores) and critically evaluating any AI-generated fixes before deploying them in production environments.
