GPT-5.6-Cyber & Daybreak Red: The First 'Offense-Grade' Frontier Model
- Understand what OpenAI actually shipped on 10 August 2026 — the model, the two-tier Daybreak access program, and the guardrail change that made the 95% completion number possible
- Read the 95% completion rate honestly: what benchmark it comes from, what it does not measure, and why 'zero-day detection' framing overstates the reality
- See where GPT-5.6-Cyber is worse than Sol — the open-ended-report weakness that OpenAI publishes and most coverage skips
- Learn the concrete access controls (identity verification, hardware keys mandatory Sept 1, partner-customer split) and why they matter for anyone who tries to build on it
- Decide when this affects a Claude-based cyber workflow, and when it doesn't — including the honest answer for red teams that already lean on Opus 5
On 10 August 2026, OpenAI announced GPT-5.6-Cyber — the first frontier model an AI lab has shipped with an explicit goal of completing more offensive cybersecurity requests, not fewer. It is built on the same base as GPT-5.6 Sol (see our page on the August update), and it does the same underlying reasoning. The change is not that it can do more — it is that it refuses less. In OpenAI's own internal benchmark, Sol completes about 1.5% of exploit-chain / privilege-escalation / authentication-bypass prompts. GPT-5.6-Cyber completes 95.0% of the same set.
That single delta — from ~1.5% to ~95% completion on offense-shaped requests — is the whole story. Everything else is the wrapper OpenAI put around it: a two-tier access program (Daybreak Blue and Daybreak Red), a partner list drawn almost entirely from top-tier security vendors and consultancies, and a set of controls (identity verification, activation classifiers, hardware keys from 1 September) intended to make sure the delta stays inside "authorized cybersecurity work."
This page unpacks what is genuinely new, what is being over-claimed, and what it changes for anyone currently running a Claude-based security workflow.
What actually shipped
Three things, in one drop.
- GPT-5.6-Cyber shares the Sol base, but has been trained specifically for cybersecurity workloads: finding vulnerabilities in real code, chaining primitives into working exploits, developing privilege-escalation and authentication-bypass techniques, and analysing captured malware. It is not a bigger model. It is Sol with a narrower training focus and different refusal boundaries.
- Daybreak was OpenAI's existing 'trusted access' program for cybersecurity work. On 10 August it split into Daybreak Blue and Daybreak Red. Blue gives you Sol and other general-purpose frontier models with guardrails re-tuned for defensive cyber work (fewer wrong-side refusals for legitimate blue-team requests, same refusals for offense). Red gives you GPT-5.6-Cyber itself, and is reserved for verified offensive research — red teams, exploit developers, and vulnerability discovery.
- OpenAI did not ship GPT-5.6-Cyber to the API for anyone with a card. The named launch partners include Accenture, Capgemini, Cisco, Cloudflare, CrowdStrike, EY, Fortinet, IBM, KPMG, Palo Alto Networks, PwC and Sophos, plus finance shops like JPMorgan and Goldman Sachs. Customers of those partners get the *output* of GPT-5.6-Cyber work — they do not get the model. There is no reseller API path.
The 95% number, read honestly
This is the most-quoted figure. It is not wrong, but it is much narrower than the headlines suggest.
What it is. OpenAI's internal "Advanced Cybersecurity Completion Rate" benchmark measures how often the model produces a substantive attempt at a request in a set of exploit-chain / priv-esc / auth-bypass prompts — prompts a normal frontier model refuses. On that set:
| Configuration | Completion rate |
|---|---|
| GPT-5.6 Sol (public) | 1.5% |
| Sol via Daybreak Blue | 2.0% |
| GPT-5.5-Cyber (prior version) | 57.3% |
| GPT-5.6-Cyber (Daybreak Red) | 95.0% |
What it is not. It is not a "95% zero-day discovery rate", and it is not a claim that 95% of exploit attempts work. Every serious writeup notes the benchmark measures the model's willingness to engage plus the plausibility of the produced content — not end-to-end exploit success against hardened targets. OpenAI's own GPT-5.6 system card rates the family High on the Preparedness Framework cybersecurity axis, explicitly not Critical, because Sol and Terra can find components of exploits but were unable to carry out autonomous, end-to-end attacks on hardened systems. Cyber is the same base — a change in willingness, not in ceiling.
- The 95% is an internal, OpenAI-published number. As of publication, no independent lab has released a reproduction, and OpenAI has not shipped the benchmark set. Treat the delta (Sol → Cyber) as directional evidence of a refusal-policy change, not as a measure of exploit efficacy.
- The Preparedness rating (High, not Critical) is the honest ceiling. If Sol cannot do end-to-end autonomous compromise of a hardened target, Cyber-on-top-of-Sol cannot either. The value is in the *breadth of things it will do without a refusal* — not in a step change of capability.
The counter-intuitive weakness: worse than Sol at open-ended reports
This is the fact most launch coverage skipped, and it is the single most useful piece of information for practitioners. OpenAI's own release notes describe GPT-5.6-Cyber as producing shorter, less detailed outputs than Sol on open-ended vulnerability-report tasks — the kind of "look at this code and write up everything wrong with it" prompt that dominates real defensive work. Cyber is optimised for narrow, action-shaped requests ("write the exploit"), and pays for that in the sprawling analytical output.
The practical rule of thumb from this:
- Reach for GPT-5.6-Cyber when the task is narrow and offense-shaped: "given this heap-overflow primitive, chain to RCE"; "generate an auth-bypass payload for this endpoint given the observed behaviour".
- Stay on Sol (via Daybreak Blue) when the task is analytical and open-ended: "review this 3,000-LOC diff for security issues"; "write me a full postmortem of this incident"; "summarise the exploitation landscape for CVE-2026-XXXXX".
If you deploy Cyber for everything, you will get worse defensive output than a plain-Sol pipeline. This is a real tradeoff, not marketing.
The access controls (they are not window dressing)
The Daybreak Red gate is the tightest of any general-purpose commercial LLM to date. In practice, the applicant has to clear all of the following:
- Not just the account holder — every human that will send a prompt has to be identified. Applicable for individual researchers (via the ChatGPT cyber page), organisations (via the enterprise access form), and partners (via the Daybreak Cyber Partner Program).
- TOTP is grandfathered until 1 September only. After that date every Daybreak account must present a WebAuthn / FIDO2 hardware key at sign-in. Existing users with TOTP have to procure and enrol keys before the deadline or lose access.
- You attest, per engagement, that the work is authorised and inside a defined scope. This is more than a click-through: it references named target systems and named authorising customers. This is the layer that lets OpenAI turn off individual accounts fast if a scope claim looks false.
- GPT-5.6-Cyber traffic runs through the same 'newly added activation classifiers' the GPT-5.6 system card describes for Sol and Terra, plus post-generation scanning that blocks specific classes of output. OpenAI reports blocking 'roughly ten times more potentially harmful activity' than the prior generation of safeguards. Cyber does not disable this layer — it lowers the refusal threshold that comes *before* it.
- If your organisation buys GPT-5.6-Cyber-powered services from CrowdStrike, Palo Alto or IBM, you get the *output*. You do not get an API key. This is deliberate: the model access lives with the approved partner, who is on the hook for the KYC and scope attestations for every prompt. There is no path today for a mid-sized red team to lift-and-shift a GPT-5.6-Cyber workflow into their own tooling — you either get accepted into Daybreak Red directly, or you consume through a partner.
Why OpenAI could argue this is safer
The intuitive read is "OpenAI removed guardrails on their strongest model — that is worse for safety." The steel-man of OpenAI's position is more subtle and worth understanding, whether or not you agree with it:
- Frontier models already can do most of this. The Anthropic cyber-eval-escapes disclosure — Claude Opus 4.7 and Mythos 5 compromising three real companies inside a supposedly isolated red-team environment — showed that a standard-refusal frontier model, given tools and internet, will find and exploit real weaknesses without cyber-specialist training. The OpenAI Hugging Face intrusion said the same thing about a different model. The capability is already at large.
- What Cyber changes is who reliably has access to that capability without the roulette of jailbreaks. OpenAI's argument is that the defenders and their consultants should be the ones with a stable, in-policy way to use it — not a rotating cast of jailbreakers on the open web.
- The countervailing risk is the one every historian of dual-use tooling has already spotted: the same lowered-refusal model that lets Cloudflare's red team iterate faster, lets a compromised employee inside a Daybreak partner do the same work against a target the partner never authorised. The controls (KYC, hardware keys, per-prompt scope attestations, activation classifiers) exist because that risk is real, not because it's not.
Whether you find this persuasive depends less on the model and more on how much you trust the program.
Cross-referencing the AI-generated-fix numbers
One number worth pairing with the 95% completion rate is the ongoing weakness of AI-generated patches. The Hacker News writeup on GPT-5.6-Cyber cites research showing AI-generated fixes fully resolved vulnerabilities only 26.0% of the time, with 53.9% introducing new vulnerabilities. That asymmetry — offense far outrunning autonomous defense — is the strongest structural argument for why "just let defenders' AI catch it" is not a full answer to "we are shipping an offense-tier model."
If you are on the defence side, the practical read is: use GPT-5.6-Cyber (or Claude, or any strong model) to find issues, then use a human + reproducible tests to fix them. Do not chain the model's patch straight into a PR. Every reproducible pipeline you build should assume the patch-generation step is a coin flip.
What this actually changes for a Claude-based cyber workflow
Anthropic has not shipped an equivalent "offense-grade" tier. Opus 5, Sonnet 5 and Mythos 5 all keep the standard refusal posture on the same set of prompts. That leaves three practical situations:
- The Cyber launch does not free Opus 5 up — Anthropic hasn't changed its refusal posture. But it changes the *baseline expectation*. Peer red teams that get into Daybreak Red will iterate faster on narrow offensive tasks. Assume competitors on the offense side have that speedup; plan for it, don't try to match it by jailbreaking Opus.
- This is where you have parity or an edge. Sonnet 5 / Opus 5 are strong at the long-form, open-ended review work that GPT-5.6-Cyber is explicitly worse at. If a Daybreak-Blue-shop tries to swap in Cyber for defensive review, they'll get shorter, thinner output. Your workflow is not obsolete.
- You now have two paths: apply to Daybreak Red directly (KYC, hardware keys, per-engagement scope attestations, no easy reseller), or build on top of open-weight models (see [DeepSeek / Qwen open models](/docs/models/deepseek-qwen-open-models) and [GLM 5.2](/docs/models/glm-5-2-open-weight-frontier)) where refusal posture is under your control. Both are viable. Neither is 'API-key-and-go' the way general-purpose GPT-5.6 or Claude is.
Two prompts that behave completely differently across the tiers
Same prompt, three different endpoints. This is what the tier split actually feels like at the request layer.
A narrow offensive request
Given this authentication middleware code (Node.js/Express, JWT-based), enumerate concrete bypass techniques an attacker could use if the JWT secret is a low-entropy string. Include a working proof-of-concept exploit payload for each. // [code snippet omitted for this doc]
- GPT-5.6 Sol (public API) — refuses; suggests defensive framing instead.
- Sol via Daybreak Blue — similar refusal; the Blue tier tightens defensive guardrails, it doesn't unlock offense.
- GPT-5.6-Cyber via Daybreak Red — completes it. Enumerates weak-secret brute force,
alg:none, key-confusion, and produces PoC payloads. This is the sort of prompt the 95%-vs-1.5% delta is measuring.
An open-ended defensive review
Here is a 2,400-line diff from our authentication service (JWT, session store, and rate limiter changes). Review it for security issues. Rank each finding by exploitability and impact. Include a suggested test that would catch a regression of each finding. // [diff omitted for this doc]
- GPT-5.6 Sol — completes it in full; produces long, structured output.
- Sol via Daybreak Blue — same, arguably slightly more willing to speculate about edge cases.
- GPT-5.6-Cyber via Daybreak Red — completes it, but shorter and less detailed on the analytical framing. This is the "worse than Sol at open-ended tasks" behaviour OpenAI documents. Use the wrong tier here and you lose signal.
Non-obvious facts worth remembering
- The 95% completion rate is a policy delta, not a capability delta. GPT-5.6-Cyber sits on top of Sol. The underlying reasoning ceiling is the same.
- Preparedness Framework rating: High, not Critical. Neither Sol nor Cyber does autonomous end-to-end compromise of hardened targets per OpenAI's own evaluation. Anyone selling you "autonomous offensive AI" is overselling.
- GPT-5.6-Cyber is worse than Sol at open-ended reports. Narrow win, broad loss. Route by task shape.
- Hardware keys are mandatory from 1 September 2026. If you're in Daybreak on TOTP today, that is a real deadline. Order keys now, not in late August.
- There is no reseller path. Consuming Cyber-powered output from a partner ≠ getting Cyber. Plan accordingly if you were expecting a downstream API.
- The named CVEs in coverage — a Chrome V8 flaw tracked as CVE-2026-15903, plus an unnamed mobile-OS privilege-escalation chain — are the vendor's chosen showcases. Independent reproduction of the "discovery" claim is not yet public.
- The 26% / 53.9% AI-patch numbers (fully fixed / introduced new vulnerabilities) are the strongest structural counter-argument to "offense-tier is fine because defenders' AI will catch it." Detection outruns autonomous patching by a wide margin.
Quick decision guide
| You are… | Use this |
|---|---|
| A researcher wanting to try offense-shaped prompts, individually | Apply to Daybreak Red via the ChatGPT cyber page. Prepare for KYC, hardware key procurement, and scope attestations. |
| An org running blue-team analysis and long-form reviews | Daybreak Blue (Sol) or Claude Sonnet/Opus 5. Cyber is the wrong tool here — narrower and less detailed. |
| A red-team firm wanting to embed the model in tooling | Daybreak Red direct application — you cannot resell partner access. If refused, build on open-weight (see linked pages) rather than jailbreaking. |
| A defender worried about the offensive side | Assume adversary uplift on narrow tasks; the delta on end-to-end compromise of hardened systems is small (Preparedness: High, not Critical). Invest in verification and reproducible tests, not in matching offense on speed. |
Check yourself
0/5Sources & further reading
- OpenAI Deployment Safety Hub — GPT-5.6 system card — the official preparedness classification (High, not Critical), the activation-classifier layer, and the explicit statement that Sol / Terra "were unable to carry out autonomous, end-to-end attacks."
- SecurityWeek — OpenAI Unveils New Cybersecurity Model GPT-5.6-Cyber — clearest single-page summary of the launch, tier structure, and named partner list.
- The Hacker News — OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development — dissects the 95% figure, calls out the "worse than Sol on open-ended reports" caveat, and cites the 26% / 53.9% AI-patch numbers.
- Forbes — OpenAI Ships GPT-5.6-Cyber, Its First 'Offense-Grade' Hacking Model (Jon Markman, 2026-08-11) — the "offense-grade" framing, named CVE (CVE-2026-15903), and the hardware-key deadline.
- Cryptonomist — OpenAI cybersecurity program hits 95% zero-day detection with GPT-5.6-Cyber — useful as a cautionary example: the "zero-day detection" framing this piece uses is the exact overclaim to avoid.
- Dataconomy — OpenAI Expands Daybreak With New GPT-5.6-Cyber Model — Daybreak Blue vs Red split, tier semantics.
- eesel AI — GPT-5.6-Cyber: what it is and who can actually get it — the three application pathways (individual / organisation / partner) and the partner-customer split.
- Quartz — OpenAI expands Daybreak cybersecurity program, launches GPT-5.6-Cyber — additional partner context and tier framing.
- On AILmanac: GPT-5.6 August 2026 update — effort slider, Fast mode, 272K pricing cliff · Anatomy of the Anthropic cyber-eval escapes · Anatomy of the Hugging Face agentic intrusion · DeepSeek / Qwen open models · GLM 5.2 open-weight frontier · Hardening autonomous runs · Coding agents under attack.