OpenAI Unveils New Cybersecurity Model GPT-5.6-Cyber

Summary

OpenAI has introduced GPT-5.6-Cyber, a new AI model specifically trained for advanced cybersecurity tasks like finding zero-days and developing exploit chains. This model boasts a significantly lower refusal rate for dual-use prompts compared to its predecessor, GPT-5.6-Sol, aiming to assist security professionals more effectively. To mitigate potential misuse, GPT-5.6-Cyber will be accessible only through OpenAI's expanded Daybreak Cyber Partner program, offering tiered access to trusted organizations.

Full text

OpenAI on Monday announced a new cybersecurity-focused AI model named GPT-5.6-Cyber, as well as the expansion of its Daybreak Cyber Partner program. The AI giant says GPT-5.6-Cyber is designed for “advanced, authorized cybersecurity work”. Built on GPT-5.6-Sol, the new model has been trained for specialized tasks such as finding zero-days and creating exploit chains. It’s also configured with a lower refusal rate for risky dual-use tasks. According to OpenAI, while GPT-5.6-Sol is highly advanced, its refusal rate is high for penetration testing against production systems and other dual-use cyber prompts that could be used for both good and evil. GPT-5.6-Cyber should address these issues, and testing conducted by the vendor showed a 95% completion rate for prompts involving exploit chain development, privilege escalation, and authentication bypass, compared with 1.5% for GPT‑5.6 Sol. “It also completes more requests than GPT‑5.5‑Cyber, which completes only 57.3% of requests, addressing feedback from security researchers who encountered persistent refusals with the earlier model,” OpenAI noted. GPT-5.6-Cyber has superior performance in areas such as developing arbitrary code execution exploits and finding and assessing known vulnerabilities and new zero-days, according to OpenAI.Advertisement. Scroll to continue reading. The company says the model has discovered a high-severity vulnerability in the V8 JavaScript engine used by Chrome. It has also reportedly found security flaws in an unnamed mobile operating system, database, and operating system kernel. To prevent abuse of the new GPT-5.6-Cyber model, OpenAI will offer it only to trusted partners through an expansion of its Daybreak program, which enables organizations to build, co-sell, and deliver cybersecurity solutions with AI developed by OpenAI. The company announced on Monday that Daybreak is being expanded with two access tiers: Daybreak Blue, which provides access to Sol and other general-purpose frontier models with guardrails customized for defensive cybersecurity work, and Daybreak Red, which provides access to cybersecurity models such as the new GPT-5.6-Cyber. Daybreak has been continuously expanded. The list of partners includes major tech and services companies such as Accenture, Capgemini, EY, IBM, KPMG, and PwC, and cybersecurity giants such as Palo Alto Networks, Sophos, CrowdStrike, Fortinet, Akamai, and Cloudflare. The latest announcements come just days after OpenAI flagged its upcoming AI model Astra for potentially reaching a ‘critical’ cybersecurity risk threshold. GPT-5.6-Sol has peaked at the ‘high’ risk threshold, but Astra could reach ‘critical’, which means it could autonomously build zero-day exploits and could independently design and execute end-to-end cyberattacks based only on a high-level goal. Recent incidents in which models made by OpenAI, Anthropic and Meta hacked real organizations during cybersecurity testing have raised serious concerns about the potential risks of autonomous AI capabilities. Related: OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery Related: Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy FacilityCritical Flaws Discovered in Belgian eID Software Used by 2 Million PeopleCritical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise DataTruck Brake Controller’s Safety Recall Doubled as Hidden Security FixSnowflake Hacker Pleads Guilty in US CourtZero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X PostsMeta AI Hacked External Systems During Cybersecurity TestingHow a $50,000 Exploit Chain Turned Bixby Against Samsung Phones Latest News Hacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to RedemptionMozilla Issues New Firefox GPG Key Following ExposureOpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack ConcernsStealthium Targets Security Blind Spots in AI Accelerators and Neo-CloudsCisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents BadNew Jersey, Alabama Join States Targeted in Water CyberattacksMetabase Patches Vulnerability Exploited as Zero-Day Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move1Kosmos has named Frank Cohen Chief Revenue Officer.ServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — GPT-5.6-Cyber
• malware — GPT-5.6-Sol

Entities