What is GPT-5.6-Cyber?

GPT-5.6-Cyber is a security-focused version of OpenAI’s GPT-5.6 Sol, trained to find software vulnerabilities and build working exploits. OpenAI announced it on August 10, 2026. Here’s the part most write-ups skip: you probably can’t use it. It ships only through Daybreak Red, a vetted-access tier for approved security teams. There is no self-serve API and no public console toggle.

Try Apidog today

So treat this as an explainer, not a setup guide. If you came for a model ID and a code sample, that doesn’t exist for general developers right now. What does exist is a clear picture of what the model does, why OpenAI is holding it back, and what you can actually build with today. It sits right next to Google’s Gemini 3.5 Flash Cyber, which took the same gated approach a few weeks earlier.

What is GPT-5.6-Cyber?

GPT-5.6-Cyber is a cybersecurity specialist built on top of GPT-5.6 Sol, OpenAI’s flagship reasoning model. The base Sol model is a broad coding and reasoning workhorse that already scores well on security tasks. Cyber is tuned for two jobs the base model won’t do freely: finding zero-day vulnerabilities and developing exploit chains.

OpenAI trained it to do two specific things differently from Sol:

• Reduce refusals on higher-risk, dual-use cyber prompts. The base model refuses most requests that involve building an exploit, bypassing authentication, or escalating privileges, even for legitimate defensive work. Cyber is trained to complete far more of them.
• Improve capability on specialized offensive-security workflows, such as turning a known bug into a working exploit or calibrating the true severity of a novel vulnerability.

OpenAI describes it in the Daybreak expansion announcement. The pitch is defensive: put a strong vulnerability finder in the hands of trusted defenders before attackers get comparable tools. Cyber is the successor to GPT-5.5-Cyber, which security researchers found refused too often to be useful.

The catch: you probably can’t use it

GPT-5.6-Cyber is available only through Daybreak Red, one of two access tiers in OpenAI’s Daybreak cybersecurity program. It is not a normal API model.

In practical terms:

• No self-serve API. You can’t add a Cyber model ID to your app and call it the way you would GPT-5.6 Sol or Terra.
• No open pricing. Because access is gated, OpenAI hasn’t published a standard per-token rate as it does for the GPT-5.6 lineup. Figures circulating in press coverage are not confirmed on OpenAI’s own pages, so treat any neat price table you find as unverified.
• No open signup. You apply to the program, get identity-verified, and agree to approved-use restrictions and legal attestations. Access stays scoped to authorized work.

If you find a tutorial with a Cyber model string and a copy-paste code sample, treat it as invented. As a general developer, you cannot call GPT-5.6-Cyber today.

Why OpenAI gated it

The reasoning is dual-use. A model that is good at finding vulnerabilities is also good at finding vulnerabilities for attackers. A defender uses that capability to patch flaws; an attacker can use it to locate flaws to exploit.

Three days before the Cyber launch, OpenAI delayed its forthcoming Astra model after it reached the “Critical” cyber threshold in safety testing. GPT-5.6-Cyber, by contrast, was assessed at “High” for cybersecurity under OpenAI’s Preparedness Framework, below the Critical line.

OpenAI also noted that GPT-5.6-Cyber was not involved in the Hugging Face incident earlier this year.

The gated release is deliberate: a narrow rollout to vetted defenders lets the model perform real defensive work while OpenAI monitors its behavior and usage. This is a common approach for security-sensitive tooling: validate it with trusted partners, then widen access only if the risk picture allows.

Blue and Red: the two access tiers

OpenAI split Daybreak into two tiers, each with different model access:

• Daybreak Blue gives you GPT-5.6 Sol with the production system-level cyber guardrails removed. It is aimed at defensive workflows: vulnerability discovery, secure code review, malware analysis, incident response, and patch validation. OpenAI recommends it as the starting point for most defenders.
• Daybreak Red gives you purpose-trained cyber models, including GPT-5.6-Cyber, for authorized vulnerability research, exploit validation, and penetration testing.

The gap between them is large. On OpenAI’s internal “Advanced Cybersecurity Completion Rate,” which measures how often a model answers prompts about exploit-chain development, authentication bypass, and privilege escalation:

Model	Completion rate
GPT-5.6-Cyber	95.0%
GPT-5.5-Cyber	57.3%
GPT-5.6 Sol	1.5%
GPT-5.6 Sol through Daybreak Blue	2.0%

For the full breakdown, see Daybreak Blue vs Red.

What it can actually do

OpenAI backed the launch with real findings. Using GPT-5.6-Cyber internally, its researchers uncovered two previously unknown vulnerabilities in V8, the JavaScript engine behind Chrome. The vulnerabilities could be chained to corrupt memory and escape the V8 heap sandbox. Google fixed them and assigned CVE-2026-15903.

OpenAI also reported using the model to find:

• At least five vulnerabilities in a popular mobile operating system, including a chain from an untrusted app to local privilege escalation.
• Three critical vulnerabilities in a popular database, including a remote path to code execution.
• Over 400 privilege-escalation issues in a popular operating system kernel.

On the ExploitGym benchmark, which tests whether an agent can turn a known vulnerability into working code execution, GPT-5.6-Cyber outperforms both GPT-5.6 Sol and GPT-5.5-Cyber.

One important caveat from OpenAI’s own writeup: on a vulnerability-report-writing evaluation, Cyber scored slightly below Sol because it sometimes produced shorter, less detailed reports. The model is tuned for finding and exploiting, not for prose.

What developers can use today instead

You cannot run Cyber, but you can still build a practical API security workflow today.

1. Use a public model for first-pass code review

GPT-5.6 Sol, Terra, or a comparable frontier model can review a function and flag risky patterns, missing input validation, or authorization gaps. Treat model output as a first pass, not an audit.

For example, ask a public coding model to review an endpoint implementation:

app.get("/api/users/:id", async (req, res) => {
  const user = await db.users.findById(req.params.id);
  res.json(user);
});

Useful review questions include:

• Does this endpoint verify the caller is authenticated?
• Does it enforce object-level authorization?
• Could the response expose fields that should stay private?
• What test cases would catch an IDOR vulnerability?

GPT-5.6 Sol is available through the normal GPT-5.6 API, which Cyber is not.

2. Run real security tests against your APIs

Most exploited API weaknesses are not exotic. They are missing authentication, weak transport security, and endpoints that silently break their contract after a change.

Use an API client such as Apidog to validate the checks attackers actually reach for:

• Auth checks. Send requests with a missing token, an expired token, and a valid token. Assert that each returns the expected status code. A 200 where you expected a 401 is a real finding. Apply the same discipline to agents; see what your AI agent’s API key can actually do.
• Transport security. If a service requires client certificates, verify the mTLS handshake succeeds and that plain requests are refused. Follow this guide for testing APIs with client certificates and mTLS in Apidog.
• Contract tests on a schedule. Save requests, assert status codes and JSON fields, then schedule recurring API tests so regressions appear when they land rather than in an incident report.

A minimal auth-boundary test matrix might look like this:

Scenario	Expected result
No Authorization header	401 Unauthorized
Expired token	401 Unauthorized
Valid token without required role	403 Forbidden
Valid token with required role	200 OK
Valid token accessing another user’s resource	403 Forbidden or 404 Not Found

None of these checks requires a gated security model. They require a repeatable test suite and the discipline to run it on every deploy. Download Apidog and start with auth cases; they catch the most for the least effort.

Frequently asked questions

Is GPT-5.6-Cyber available in the API?

Not through the standard API. It is restricted to Daybreak Red, OpenAI’s vetted-access tier for authorized offensive-security work. You apply, get verified, and agree to approved-use terms. There is no self-serve model ID for general accounts.

How is it different from GPT-5.6 Sol?

It is built on Sol but trained to refuse fewer dual-use cyber prompts and perform better at exploit development and zero-day discovery. On OpenAI’s internal completion-rate test, Cyber answers 95.0% of advanced cyber requests versus 1.5% for Sol.

How much does GPT-5.6-Cyber cost?

OpenAI has not published open pricing because access is gated rather than self-serve. Some press coverage lists per-token figures, but those are not confirmed on OpenAI’s own pages. Treat circulating numbers as unverified until OpenAI documents them.

Is it safe to use? What’s the Astra connection?

GPT-5.6-Cyber was assessed at “High” for cyber capability under OpenAI’s Preparedness Framework, below the “Critical” threshold. OpenAI delayed a separate model, Astra, three days earlier for reaching Critical. Cyber cleared the release bar; Astra did not.

What can I use instead if I just want to secure my APIs?

Run standard tests against your own endpoints:

1. Test authentication and authorization boundaries.
2. Verify transport security and client-certificate requirements.
3. Schedule contract tests for every critical endpoint.

An API client such as Apidog covers all three, and none of it requires a gated security model. For a fuller checklist, read API security lessons from the Vercel breach.