GPT-5.6-Cyber completes 95% of advanced cyber requests — but OpenAI's own charts show it losing to plain GPT-5.6 Sol on two evals
OpenAI shipped GPT-5.6-Cyber on August 10, 2026 behind Daybreak Red, and put Daybreak on Amazon Bedrock a day later. The headline number is a refusal-rate number, not a capability number: on ExploitBench at 300 turns and on OpenAI's Vulnerability Discovery eval, GPT-5.6 Sol through Daybreak Blue scores higher. Here is what actually changed, and what it takes to get access.
OpenAI released GPT-5.6-Cyber on August 10, 2026 and split its Daybreak program into two access tiers. (Source: OpenAI, “Expanding Daybreak as the Cyber Defense Window Narrows”, 2026-08-10)
Key facts:
- GPT-5.6-Cyber completes 95.0% of requests on OpenAI’s internal Advanced Cybersecurity Completion Rate eval. GPT-5.5-Cyber completes 57.3%. GPT-5.6 Sol completes 1.5% with standard safeguards and 2.0% through Daybreak Blue.
- GPT-5.6-Cyber is built on GPT-5.6 Sol and is available only through Daybreak Red.
- Daybreak Blue gives approved defenders GPT-5.6 Sol with the system-level cyber guardrails removed. Daybreak Red gives access to the purpose-trained cyber models.
- Daybreak Blue and Red both landed on Amazon Bedrock on August 11, 2026, reachable via the Bedrock console or the Responses API on the
bedrock-mantleendpoint. (Source: OpenAI, “Daybreak models are now available on AWS”, 2026-08-11) - All individual Daybreak accounts must adopt hardware security keys beginning September 1, 2026.
- Under OpenAI’s Preparedness Framework, GPT-5.6-Cyber was assessed High for cyber capability and below the Critical threshold — the same band as GPT-5.6 Sol. A system card is promised “at a later date.”
The 95% is a refusal number, not a capability number
Read OpenAI’s own description of the eval carefully. Advanced Cybersecurity Completion Rate “measures how often models will respond to requests involving exploit-chain development, authentication bypass, privilege escalation, and other advanced cybersecurity scenarios.” That is a compliance metric. The jump from 2.0% to 95.0% is the sound of a refusal filter being removed, not a model getting smarter.
Where OpenAI does measure capability, GPT-5.6-Cyber does not sweep. On ExploitBench — turning a V8 vulnerability into a working exploit with the V8 sandbox still enabled — OpenAI writes that in the standard 300-turn setting, GPT-5.6 Sol through Daybreak Blue “solves tasks more token-efficiently and performs best,” and that the gap only narrows when the limit is raised to 600 turns.
OpenAI is equally direct about a second eval: on its internal Vulnerability Discovery and Report Writing benchmark, “GPT-5.6-Cyber performs worse than GPT-5.6 Sol,” which OpenAI attributes to Cyber “sometimes producing shorter, less detailed vulnerability reports.” GPT-5.6-Cyber does win on ExploitGym and on the internal zero-day severity eval.
There is also a cost footnote worth reading: GPT-5.6-Cyber “tends to be more extensive and comprehensive than GPT-5.6 Sol in its reasoning budget, leading to higher token usage.” You pay more tokens for the tier that loses two of four capability evals.
What this means if you’re building security tooling
Start at Blue, not Red. OpenAI says so itself — “We recommend Daybreak Blue as the starting point for most defenders.” If your blocker is a production model refusing legitimate malware analysis, incident response, or secure code review, Blue removes that blocker and, on two of the four published evals, is the stronger model. Red is for the narrow residue of tasks Sol still refuses even unguarded: pentesting production systems, exploit validation, red teaming.
Neither tier is an API key you can just buy. Access runs through Daybreak Access enrollment with identity verification, approved-use restrictions, monitoring, and legal attestations. In the partner program, access “remains with the approved partner and is not transferred directly to the customer.” Budget for procurement time, not a signup form.
The Bedrock route is the interesting delivery change. If your security stack already lives in AWS, bedrock-mantle through the Responses API means the governance story — IAM, logging, existing security review — is one you already have answers for. Enrollment approval is still required first.
If you run Codex against your own repos, act on the default change now. OpenAI is “strongly encouraging Daybreak customers using Codex to switch from full-access mode to auto-review mode,” which evaluates elevated-permission actions before execution. That advice is not Daybreak-specific — it is the correct default for any cyber-capable agent with shell access. Our Codex security guide covers scoped permission profiles and sandbox boundaries; the same reasoning applies whether or not you ever get Daybreak approval. If you are hardening agents more broadly, reducing Claude Code token overhead touches the same permission-surface questions.
The V8 finding is the real proof point
The benchmark argument is arguable. The disclosure is not. OpenAI used GPT-5.6-Cyber on V8, Chrome’s JavaScript engine, and found two previously unknown vulnerabilities that chain together to corrupt memory and escape the V8 heap sandbox. Google fixed it and assigned CVE-2026-15903, a high-severity bug where V8’s optimizing compiler skipped a safety check converting values to integers, letting an undefined value produce an unexpectedly large number that defeats the array bounds check.
OpenAI also claims, without naming the targets, at least five vulnerabilities in “a popular mobile operating system” including an untrusted-app-to-privilege-escalation chain, three critical vulnerabilities in “a popular database,” and over 400 privilege-escalation vulnerabilities in a popular operating system kernel, all still in coordinated disclosure. Those numbers are unverifiable from the outside until disclosure completes — treat them as vendor claims, not confirmed findings, unlike the V8 chain which has a CVE attached.
Sources
Source: OpenAI