OpenAI launches GPT-5.6-Cyber to hunt zero-day exploits
OpenAI has launched GPT-5.6-Cyber, a new artificial intelligence model made for advanced cybersecurity research. The model is being offered through Daybreak Red, a restricted access programme for approved security researchers and organisations carrying out authorised work.
The company says GPT-5.6-Cyber is based on GPT-5.6 Sol and has been trained for tasks such as finding previously unknown security flaws, testing exploits and checking whether weaknesses can be chained together. Access is controlled and requires separate approval.
please consider using our models to help defend your systems https://t.co/oqs3qfWmtN
— Sam Altman (@sama) August 10, 2026
What is GPT-5.6-Cyber?
GPT-5.6-Cyber is a specialised model aimed at security teams doing advanced vulnerability research.
OpenAI has split its Daybreak programme into two tiers. Daybreak Blue uses GPT-5.6 Sol for common defensive work such as secure code review, malware analysis, incident response and patch checking. Daybreak Red gives approved users access to GPT-5.6-Cyber for more sensitive work such as exploit testing and authorised penetration testing.
| Model access | Main use |
|---|---|
| Daybreak Blue | Code review, malware analysis, incident response, vulnerability checks |
| Daybreak Red | Advanced vulnerability research, exploit validation, security testing |
| GPT-5.6-Cyber | Zero-day research, exploit-chain testing and specialised cyber work |
One big change is how often the new model agrees to handle advanced cyber requests.
OpenAI says GPT-5.6-Cyber completed 95% of requests in its internal Advanced Cybersecurity Completion Rate test. GPT-5.6 Sol completed 1.5% under standard safeguards and 2% through Daybreak Blue. GPT-5.5-Cyber completed 57.3%.
OpenAI says the model found new Chrome V8 flaws
The more interesting part is what happened outside benchmark tests.
OpenAI says its researchers used GPT-5.6-Cyber to study V8, the JavaScript engine used in Google Chrome. The model helped uncover two previously unknown vulnerabilities that could be chained together to corrupt memory and escape V8’s heap sandbox. OpenAI says the findings were reported to Google and one of the flaws was fixed as CVE-2026-15903.
The company also says the model has helped identify security issues in a mobile operating system, a database and an operating system kernel. Some of those findings are still going through coordinated disclosure and patching.
Why OpenAI is restricting access
This kind of AI can help defenders find bugs faster. The same ability can be misused if placed in the wrong hands.
OpenAI classifies GPT-5.6-Cyber as having a High level of cybersecurity capability under its Preparedness Framework, though it says the model remains below its Critical threshold.
Daybreak Red users must pass identity and account checks, follow approved-use restrictions and accept monitoring. OpenAI says individual Daybreak accounts will also be required to use hardware security keys from September 1, 2026.