GPT-5.6-Cyber is a security-focused version of OpenAI’s GPT-5.6 Sol, trained to find software vulnerabilities and build working exploits. OpenAI announced it on August 10, 2026. Here’s the part most write-ups skip: you probably can’t use it. It ships only through Daybreak Red, a vetted-access tier for approved security teams. There is no self-serve API and no public console toggle.
So treat this as an explainer, not a setup guide. If you came for a model ID and a code sample, that doesn’t exist for general developers right now. What does exist is a clear picture of what the model does, why OpenAI is holding it back, and what you can actually build with today. It sits right next to Google’s Gemini 3.5 Flash Cyber, which took the same gated approach a few weeks earlier.
What is GPT-5.6-Cyber?
GPT-5.6-Cyber is a cybersecurity specialist built on top of GPT-5.6 Sol, OpenAI’s flagship reasoning model. The base Sol model is a broad coding and reasoning workhorse that already scores well on security tasks. Cyber is tuned for two jobs the base model won’t do freely: finding zero-day vulnerabilities and developing exploit chains.
OpenAI trained it to do two specific things differently from Sol:
- Reduce refusals on higher-risk, dual-use cyber prompts. The base model refuses most requests that involve building an exploit, bypassing authentication, or escalating privileges, even for legitimate defensive work. Cyber is trained to complete far more of them.
- Improve capability on specialized offensive-security workflows, like turning a known bug into a working exploit or calibrating the true severity of a novel vulnerability.
OpenAI describes it in the Daybreak expansion announcement. The pitch is defensive: put a strong vulnerability finder in the hands of trusted defenders before attackers get comparable tools. Cyber is the successor to GPT-5.5-Cyber, which security researchers found refused too often to be useful.
The catch: you probably can’t use it
Here’s the honest status, up front. GPT-5.6-Cyber is available only through Daybreak Red, one of two access tiers in OpenAI’s Daybreak cybersecurity program. It is not a normal API model.
In practical terms:
- No self-serve API. You can’t add a Cyber model ID to your app and call it the way you would GPT-5.6 Sol or Terra.
- No open pricing. Because access is gated, OpenAI hasn’t published a standard per-token rate the way it does for the GPT-5.6 lineup. Figures circulating in press coverage are not confirmed on OpenAI’s own pages, so treat any neat price table you find as unverified.
- No open signup. You apply to the program, get identity-verified, and agree to approved-use restrictions and legal attestations. Access stays scoped to authorized work.
If you find a tutorial with a Cyber model string and a copy-paste code sample, treat it as invented. As a general developer, you cannot call GPT-5.6-Cyber today. That is the single most important fact about the model, so it’s worth stating plainly.
Why OpenAI gated it
The reasoning is dual-use. A model that’s good at finding vulnerabilities is, by definition, good at finding vulnerabilities. A defender uses that skill to patch a flaw. An attacker uses the same skill to locate one to exploit. Ship a strong exploit-builder to everyone with a credit card, and you hand that second use to anyone who wants it.
The timing tells the same story. Three days before the Cyber launch, OpenAI delayed its forthcoming Astra model after it reached the “Critical” cyber threshold in safety testing. GPT-5.6-Cyber, by contrast, was assessed at “High” for cybersecurity under OpenAI’s Preparedness Framework, below the Critical line. In other words, OpenAI shipped the model that cleared its bar and held back the one that didn’t. OpenAI also noted that GPT-5.6-Cyber was not involved in the Hugging Face incident earlier this year.
So the gate is deliberate. A narrow release to vetted defenders lets the model do real defensive work while OpenAI watches how it behaves and who’s using it. That’s the standard pattern for security-sensitive tooling: prove it out with trusted partners, widen access later if the risk picture allows.
Blue and Red: the two access tiers
OpenAI split Daybreak into two tiers alongside this launch, and they get different models:
- Daybreak Blue gives you GPT-5.6 Sol with the production system-level cyber guardrails removed. It’s aimed at defensive work: vulnerability discovery, secure code review, malware analysis, incident response, and patch validation. OpenAI recommends it as the starting point for most defenders.
- Daybreak Red gives you the purpose-trained cyber models, including GPT-5.6-Cyber, for authorized vulnerability research, exploit validation, and penetration testing.
The gap between them is large. On OpenAI’s internal “Advanced Cybersecurity Completion Rate,” which measures how often a model will answer prompts about exploit-chain development, authentication bypass, and privilege escalation, GPT-5.6-Cyber completes 95.0% of requests. GPT-5.6 Sol completes 1.5%, and Sol through Daybreak Blue completes 2.0%. The old GPT-5.5-Cyber sat at 57.3%. If you want the full breakdown of who gets what, see Daybreak Blue vs Red.
What it can actually do
Benchmarks aside, OpenAI backed the launch with real findings. Using GPT-5.6-Cyber internally, its researchers uncovered two previously unknown vulnerabilities in V8, the JavaScript engine behind Chrome, that could be chained to corrupt memory and escape the V8 heap sandbox. Google fixed them and assigned CVE-2026-15903.
OpenAI also reported using the model to find:
- At least five vulnerabilities in a popular mobile operating system, including a chain from an untrusted app to local privilege escalation.
- Three critical vulnerabilities in a popular database, including a remote path to code execution.
- Over 400 privilege-escalation issues in a popular operating system kernel.
On the ExploitGym benchmark, which tests whether an agent can turn a known vulnerability into working code execution, GPT-5.6-Cyber outperforms both GPT-5.6 Sol and GPT-5.5-Cyber. It’s worth noting one honest wrinkle from OpenAI’s own writeup: on a vulnerability-report-writing evaluation, Cyber actually scored slightly below Sol, because it sometimes produced shorter, less detailed reports. The model is tuned for finding and exploiting, not for prose.
What developers can use today instead
You can’t run Cyber, but you’re not stuck. Two practical moves cover most of what people wanted it for.
For general coding and security-review prompts, use a public model. GPT-5.6 Sol, Terra, or a comparable frontier model can review a function and flag risky patterns, missing input validation, or auth gaps. Treat the output as a first pass, not an audit. It’s available now through the normal GPT-5.6 API, which Cyber is not.
For hardening your own APIs, run real security tests against them. Most exploited API weaknesses aren’t exotic. They’re missing authentication, weak transport security, and endpoints that quietly break their own contract after a change. You can test all three without any special model.
This is where an API client like Apidog fits. You point it at your endpoints and check the things attackers actually reach for:
- Auth checks. Send requests with a missing token, an expired token, and a valid token, then assert each gets the status code it should. A
200where you expected a401is a real finding. The same discipline applies to your agents; see what your AI agent’s API key can actually do. - Transport security. If a service requires client certificates, verify the handshake works and that plain requests are refused. Here’s a walkthrough on testing APIs with client certificates and mTLS in Apidog.
- Contract tests on a schedule. Save the requests, add assertions on status and JSON fields, and schedule them as recurring API tests so a regression shows up the day it lands, not in an incident report.
None of that needs a gated model. It needs the discipline to run the checks on every deploy. Want to follow along? Download Apidog and start with the auth cases; they catch the most for the least effort.
Frequently asked questions
Is GPT-5.6-Cyber available in the API? Not through the standard API. It’s restricted to Daybreak Red, OpenAI’s vetted-access tier for authorized offensive-security work. You apply, get verified, and agree to approved-use terms. There’s no self-serve model ID for general accounts.
How is it different from GPT-5.6 Sol? It’s built on Sol but trained to refuse fewer dual-use cyber prompts and to perform better at exploit development and zero-day discovery. On OpenAI’s internal completion-rate test, Cyber answers 95.0% of advanced cyber requests versus 1.5% for Sol.
How much does GPT-5.6-Cyber cost? OpenAI hasn’t published open pricing, because access is gated rather than self-serve. Some press coverage lists per-token figures, but those are not confirmed on OpenAI’s own pages. If pricing matters to your planning, treat circulating numbers as unverified until OpenAI documents them.
Is it safe to use? What’s the Astra connection? GPT-5.6-Cyber was assessed at “High” for cyber capability under OpenAI’s Preparedness Framework, below the “Critical” threshold. OpenAI delayed a separate model, Astra, three days earlier for reaching Critical. The Cyber launch shipped the model that cleared the bar; Astra did not.
What can I use instead if I just want to secure my APIs? Run standard security tests against your own endpoints: auth boundary checks, transport-security verification, and scheduled contract tests. An API client like Apidog covers all three, and none of it requires a gated security model. For a fuller checklist, read our API security lessons from the Vercel breach.
