1.5% to 95%: OpenAI Shipped a Model That Stops Refusing Exploits

TL;DR

On August 10, OpenAI expanded Daybreak, its cybersecurity program, into two access tiers and shipped GPT-5.6-Cyber, a purpose-trained model for authorized offensive security work. The headline metric is not a capability score. It is a compliance score: on OpenAI's Advanced Cybersecurity Completion Rate, GPT-5.6-Cyber answers 95.0% of requests involving exploit chains, authentication bypass and privilege escalation. The consumer model answers 1.5%. The model is rated High, not Critical, on OpenAI's Preparedness Framework, and it is gated behind identity verification, legal attestations and, from September 1, mandatory hardware security keys.

The number they are actually bragging about

Read the eval name again. Advanced Cybersecurity Completion Rate. It does not measure whether the model can build an exploit. It measures how often it agrees to try.

That is a strange thing for a frontier lab to publish, and it is the whole story. The safeguards OpenAI runs on GPT-5.6 Sol screen cybersecurity requests before the model ever gets to reason about them. Those screens work. They also fire on the toxicologist who needs the poison to build the antidote, which is roughly what a vulnerability researcher looks like to a keyword filter.

The interesting row is the third one. Daybreak Blue, the tier where OpenAI removes its system-level cyber screens for vetted defenders, scores 2.0% on this eval. Half a point above the consumer default.

That is not a rounding error, it is a finding. On advanced offensive work, the refusals are not coming from a filter bolted on top. They are baked into the model itself, and no amount of account vetting shakes them loose. If you have ever handed a frontier model a legitimate pentest scope and watched it apologize at you for four turns, you now have the number that explains why.

Blue and Red, and who gets which

Daybreak now has two doors. Blue is the general-purpose tier: frontier models such as GPT-5.6 Sol with the cyber screens relaxed, aimed at everyday defensive work like malware analysis, detection engineering and incident response. Red is the narrow one: GPT-5.6-Cyber, behind tighter vetting, for vulnerability research, exploit validation and authorized security testing.

Both tiers require identity verification, account security controls, approved-use restrictions and legal attestations. From September 1, 2026, every individual Daybreak account has to authenticate with a hardware security key. Vetted organizations including CrowdStrike, Palo Alto Networks, IBM, Cisco and Accenture can embed the models into products and managed services rather than hitting a public endpoint.

Note what that structure means for you specifically: this is not an API you can sign up for tonight. It is a partner program with a background check.

It already found something real

The strongest part of the announcement is not a benchmark. OpenAI pointed GPT-5.6-Cyber at V8, the JavaScript engine inside Chrome, and it surfaced two previously unknown vulnerabilities that could be chained together to corrupt memory and break out of the V8 heap sandbox. Google patched it as CVE-2026-15903, a high-severity out-of-bounds read and write, fixed in Chrome 150.0.7871.128.

V8 is not a soft target. It is continuously fuzzed by Google, by Project Zero, and by every exploit broker with a budget. Finding two fresh bugs there and chaining them is the kind of result that used to be a conference talk.

OpenAI also reported findings across mobile operating systems, databases and kernel software, all still moving through coordinated disclosure, so the affected products are unnamed. Treat those as unverifiable for now. The V8 chain is the one with a CVE number attached to it.

The honest caveat

It is not uniformly better. Unite.AI's read of the release flags that on OpenAI's own vulnerability discovery evaluation, GPT-5.6-Cyber produced shorter and less detailed reports than plain GPT-5.6 Sol. A model trained to stop hedging will also stop explaining. If you plug this into a triage pipeline, budget for a second pass that writes the writeup.

Sitting one rung under Astra

Days ago OpenAI said it could not rule out that Astra, an unreleased model, hits the Critical cyber threshold in its Preparedness Framework, and paused internal work on it. GPT-5.6-Cyber assesses at High, the rung below, which is where every shipped frontier model has lived.

So the same company, in the same week, held one cyber model back and pushed another one out with the refusals deliberately trained off. That is not a contradiction, it is the framework doing exactly what it says: Critical is a capability ceiling that stops a release, High is a capability level that gets access controls instead. Whether "access controls" and "a model that says yes 95% of the time" are the same amount of safety is a question the framework does not answer, because it grades capability, not distribution.

What this means if you build with agents

• Refusals are a model property, not a filter. The 1.5% to 2.0% gap between the public API and Daybreak Blue is the clearest public evidence yet that lifting policy screens does very little. If your security tooling keeps hitting walls, no amount of enterprise paperwork fixes it. You need a different model.
• The defensive-tooling gap just got wider. Vetted partners can now build products on capability you cannot rent. Expect the next wave of pentest and triage agents to be vendor-shaped, not open-source-shaped.
• Attack-side parity is the actual argument. OpenAI's framing is that the defense window is narrowing, so put frontier capability with defenders first. That only works if the vetting holds. Nobody outside OpenAI can currently audit who passes Red.
• Hardware keys are now table stakes. September 1 for every individual Daybreak account. If your org is in the program, that procurement starts now, not on August 31.

Key Takeaways

• OpenAI released GPT-5.6-Cyber on August 10 and split Daybreak into Blue (general models, cyber screens relaxed) and Red (GPT-5.6-Cyber, tighter vetting).
• On the Advanced Cybersecurity Completion Rate, GPT-5.6-Cyber answers 95.0% of advanced offensive requests, versus 57.3% for GPT-5.5-Cyber, 2.0% for Sol under Blue, and 1.5% for standard Sol.
• Removing system-level guardrails alone barely moves the number, which means the refusals live in the weights.
• The model helped chain two previously unknown Chrome V8 bugs into a heap sandbox escape, patched as CVE-2026-15903 in Chrome 150.0.7871.128.
• It is rated High, not Critical, under the Preparedness Framework, one rung below the level that got Astra paused.
• Access requires identity verification and legal attestations, with hardware security keys mandatory for all Daybreak accounts from September 1, 2026.

Sources: OpenAI: Expanding Daybreak as the Cyber Defense Window Narrows, The Decoder, The Next Web, Unite.AI, CNBC, CVE-2026-15903 record, OpenAI Preparedness Framework