OpenAI's GPT-5.6, codenamed 'Sol,' is drawing two opposite complaints at once, and together they diagnose a real structural problem. On one side, users report being flagged or banned for entirely benign tasks - writing Excel formulas, or hardening the security of their own websites - because an automated safety layer treats them as cybersecurity threats. On the other, the UK AI Safety Institute (AISI) found jailbreak vulnerabilities in Sol similar to those in Fable 5. The model is, simultaneously, too strict and too leaky.
Key facts
- Users report account flags/bans for benign tasks like defensive security and spreadsheet formulas, per community reports and OpenAI's Deployment Safety Hub.
- The UK AI Safety Institute found jailbreaks in Sol comparable to those in Fable 5.
- OpenAI raised its bio bug bounty to $50,000 to incentivize finding safety gaps, per Fortune.
- The root cause is a mismatch between a powerful core reasoning model and a weaker 'guardian' model policing it.
The mechanism behind the false bans is the interesting part. Sol runs a secondary, smaller 'guardian' model whose job is to watch for patterns associated with offensive security research - requests that look like someone probing for vulnerabilities or building an attack. The trouble is that defensive and offensive security look almost identical on the surface. 'Help me find and fix the vulnerabilities in my site' and 'help me find the vulnerabilities in this site' differ only in intent, and intent is exactly what a small pattern-matching model is worst at reading. So the guardian flags the defender.
There is a second, subtler failure that the community reports surface: because Sol's core reasoning is so strong, it produces a security hardening guide that is genuinely excellent - complete, precise, professional-grade. And the guardian model, seeing output that good, flags it as too high-quality to be benign. The very competence of the model trips its own alarm. This is the paradox in miniature: the better the model gets at helping, the more its help looks like a threat to the dumber system watching it. For related failure modes where systems optimize the wrong signal, see our lesson on reward hacking.
The analogy: imagine a bank hires a brilliant financial advisor but assigns a nervous junior guard to watch him, with instructions to stop anything that 'looks like fraud.' The advisor is so skilled that his perfectly legitimate, sophisticated advice looks, to the guard, indistinguishable from a con - so the guard keeps tackling clients in the lobby. Meanwhile an actual con artist who talks slowly and dresses plainly walks right past. That is the capability-safety mismatch: the guard is both too aggressive with the competent-and-honest and too soft on the patient-and-malicious.
The AISI jailbreak finding is the other half. The same guardrails that over-trigger on benign defensive-security requests can still be bypassed by adversarial framing - the classic jailbreak problem, where wrapping a harmful request in the right story slips it past the filter. Finding jailbreaks 'similar to Fable 5' means the newer, more capable model did not close the gaps that plagued the previous generation; it may even have widened the distance between what the model can do and what its guardrails can reliably police. OpenAI's response - raising the bio bug bounty to $50,000 - is an admission that it needs the crowd's help finding these gaps, which is a reasonable move but also a signal that the internal red-teaming did not catch everything.
Why it matters: this is the concrete, present-day face of the alignment problem that usually gets discussed in the abstract. As core models get more capable, the smaller, cheaper systems used to police them fall further behind, and you get exactly this two-sided failure - guardrails that annoy legitimate users while failing against determined attackers. It connects to the broader industry theme captured in our coverage of Sol's PR-security benchmark: a model can top a security benchmark and still misjudge who is a threat in production. The caveat is that the ban reports are community-sourced and individual cases are hard to verify one by one; the AISI findings and the bounty increase, however, are on the record via OpenAI's own safety disclosures and Fortune.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)