OpenAI built a model it doesn’t want most people to use
The New Stack Amanda Caswell ● Covered by 7 sources
OpenAI released GPT-5.6 Cyber, a security model only approved users can touch. It beats its sibling on exploit work, but OpenAI still wants it kept on a leash.
Based on reporting by The New Stack, Amanda Caswell — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
OpenAI has drawn a sharp line between security help and security harm. On Monday, the company released GPT-5.6 Cyber, a model trained for defensive and offensive-style security work that ordinary general-purpose models tend to shut down. Access runs through Daybreak Red, a new tier inside OpenAI’s gated cybersecurity program. It is not a public free-for-all, and that is the point.
The split is deliberate. Daybreak Blue gives approved defenders access to GPT-5.6 Sol with some of its system-level restrictions removed for defensive tasks such as secure code review, malware analysis, incident response, patch validation and vulnerability discovery. Red goes further and opens GPT-5.6 Cyber, which OpenAI trained to find zero-days, build exploit chains and handle other advanced security jobs that Sol still rejects. In one internal test, Cyber answered 95% of prompts covering exploit chains, authentication bypass and privilege escalation. Sol answered 1.5% under its standard safeguards and 2% through Blue.
That does not mean Cyber is the better model across the board. OpenAI says it scored higher on ExploitGym, where agents try to turn known flaws into working sandbox exploits, but fell behind Sol when the task was to find flaws and write them up. The company said Cyber’s reports were shorter and less detailed. Sol was also more token-efficient on ExploitBench, and it did better when agent runs were capped at 300 turns. The gap narrowed at 600 turns, though Cyber’s larger reasoning budget suggests longer sessions will cost more.
The practical split is showing up fast. OpenAI says Blue is for pull request reviews and patch validation, while Red is meant for exploit development and will likely need its own CI/CD setup, credentials and approval chain. SpecterOps, SentinelOne and Palo Alto Networks already had early access. Palo Alto Networks is packaging the models in its Frontier AI Defense offering, and SentinelOne is doing the same through Wayfinder Frontier AI Services. Accenture, IBM, CrowdStrike and Cisco can also fold the models into their own products and managed services.
OpenAI is also using the model on real software. It says GPT-5.6 Cyber helped examine V8, Chrome’s JavaScript engine, and found two previously undisclosed flaws that could be chained to corrupt memory and escape the V8 heap sandbox; Google fixed that under CVE-2026-15903. The model also found three critical vulnerabilities in a popular database, at least five in a popular mobile operating system and more than 400 possible privilege-escalation flaws in a popular operating-system kernel. OpenAI has not named the software yet because disclosure is still in progress. Under its Preparedness Framework, Cyber reached “High” for cybersecurity capability but stayed below “Critical,” while a more detailed system card is still to come.
My take — AI-written commentary, not fact-checked reporting
This is OpenAI admitting the obvious: the most useful security model is often the one that can also be misused with very little imagination. The gated rollout is sensible, and the fact that Red exists at all tells you how much of modern defense now depends on controlled offense. The real industry joke is that the vendors still want applause for building the lock after handing out the key.
Read more about this at: The New Stack