OpenAI built an AI that's more willing to hack, and locked it to defenders

TL;DR

On 10 August 2026, OpenAI released GPT-5.6-Cyber, a model deliberately trained to refuse fewer high-risk "dual-use" cybersecurity requests (finding vulnerabilities, building exploit chains) than its general models. It is not open to the public: access is gated behind a vetted tier ("Daybreak Red") of security firms like CrowdStrike, Cloudflare and Palo Alto Networks. OpenAI's argument is that attackers are already using AI offensively, so defenders need frontier tools too. The headline stat, 95% versus 1.5%, is widely misread: it measures how often the model responds rather than refuses, not how often it succeeds at hacking. It is a serious, careful, and genuinely debatable move.

"OpenAI built an AI that helps hack things" is the kind of sentence designed to set off alarms, and it is also, stripped of nuance, roughly true. The company just released a model that is deliberately more willing to do offensive-security work than a normal chatbot, which refuses such requests. But the details, who can use it, what the scary statistic actually measures, and why OpenAI says it did this, change the story completely. Here is the careful version of one of the more consequential AI releases of the year.

What did OpenAI actually release?

On 10 August 2026, OpenAI announced GPT-5.6-Cyber, a cybersecurity-specialised model built on its GPT-5.6-Sol base. Its distinguishing feature is stated plainly: it is "trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to reduce refusals for certain higher-risk, dual-use cyber tasks," as The Hacker News reported. In plain English: where a general model would say "I can't help with that," this one is built to engage.

The safeguard is who gets it. GPT-5.6-Cyber is not available to the public or to ordinary ChatGPT and API users. It is gated behind "Daybreak Red," a vetted tier requiring identity verification, legal attestations and approved use cases, and offered only to trusted security partners, a roster reported to include Accenture, IBM, CrowdStrike, Cloudflare and Palo Alto Networks, among others. As one security outlet summarised the model: your security vendor gets the frontier cyber tool, and you get the findings. The model itself stays behind the gate.

The statistic everyone will misread

You will see a striking number attached to this release: GPT-5.6-Cyber responds to 95% of advanced cybersecurity prompts, versus 1.5% for the base model. Read carefully, because this is the single most misleading figure in the story.

That 95% is OpenAI's own internal "Advanced Cybersecurity Completion Rate," and it measures how often the model responds to a request rather than refusing it, not how often it succeeds at hacking. The base model's 1.5% is not a measure of skill; it is how rarely it engages with such prompts at all. So the honest translation is "this model declines far less often," not "this model can hack 95% of targets." Anyone reporting the 95% as a success or capability score is getting it wrong, and it is exactly the kind of number that fuels panic.

Did it really find a Chrome bug?

Yes, and here too the framing matters. GPT-5.6-Cyber is credited with helping find genuine, high-severity flaws in Chrome's V8 JavaScript engine, one of them tracked as CVE-2026-15903 (rated 8.8, "high"). But this was not a surprise zero-day dropped on the world at launch. The flaw was found earlier, responsibly disclosed to Google, and patched back in mid-July 2026, then cited at the August announcement as proof of capability. OpenAI's researchers validated the finding before disclosure, a human-in-the-loop process, not an AI unleashed on Chrome by itself. Real capability, handled responsibly, is the accurate reading.

Why would OpenAI do this?

The rationale is a specific argument OpenAI calls the narrowing defensive window: attackers are already turning AI to offence, so keeping powerful cyber tools out of defenders' hands does not make anyone safer, it just leaves defenders outgunned.

This is not hypothetical. In late 2025, Anthropic disclosed what it called the first largely AI-run cyber-espionage campaign, attributed to a state-linked group, in which an AI executed most of the operation's steps against dozens of targets. (Tellingly, that same AI also hallucinated data and overstated its successes, needing human correction, a useful reminder that "AI hacks autonomously" is still an exaggeration.) OpenAI's bet is that this trend accelerates, and that giving vetted defenders a frontier tool, under heavy controls, is the lesser risk. It pairs the pitch with an unusually candid admission: "models running with reduced safeguards carry risks beyond standard model usage."

Is this a good idea?

Genuinely debatable, and worth presenting honestly rather than as a scandal or a triumph.

The case for: security firms can now bring frontier-grade offensive testing to organisations that could never build it themselves, finding and fixing flaws before attackers exploit them, and the gated, vetted access is a real control, not a fig leaf. Sophos, one of the launch partners, framed the broader OpenAI cyber partnership as bringing "frontier-grade defense at scale to organizations unable to deploy these models on their own."

The case for caution: gating a model is not the same as securing the world. As Illumio's Alex Goller put it, the two-tier access is "a good first step," but "AI model guardrails were never the control plane for defense," which "lives in your infrastructure, not in the model." The deeper worry is normalisation: once a frontier lab ships a model tuned to help build exploits, even carefully, it moves the industry's line on what is acceptable, and access programmes are not unbreachable. Notably, in the first days after launch, the loudest "this arms attackers" condemnation was mostly absent; the sharpest voice on the risks was OpenAI itself. The honest verdict is that this is a serious, defensible attempt to keep defenders ahead in an AI arms race that is already underway, and that whether it helps more than it normalises is a real question, not a settled one. For more, see the AI section and our look at AI agents with root access, the other frontier where capability is outrunning control.

GPT-5.6-Cyber, at a glance


What it is	OpenAI cyber model (on GPT-5.6-Sol), announced 10 Aug 2026
Key change	Reduced refusals on dual-use tasks (zero-days, exploit chains)
The 95% stat	Response/non-refusal rate, NOT a hacking-success score
Access	Gated to vetted "Daybreak Red" partners; not public
Proof cited	A Chrome V8 flaw (CVE-2026-15903), found earlier and patched July 2026
Rationale	Defenders need frontier tools as attackers adopt AI ("narrowing window")

Key takeaways

On 10 August 2026 OpenAI released GPT-5.6-Cyber (built on GPT-5.6-Sol), deliberately trained to refuse fewer high-risk dual-use cybersecurity requests such as finding zero-days and building exploit chains.
It is not public: access is gated behind a vetted "Daybreak Red" tier of security firms (CrowdStrike, Cloudflare, Palo Alto Networks and others) with identity checks and approved use cases. The model stays with the vendor; customers get the findings.
The "95% vs 1.5%" figure is OpenAI's Advanced Cybersecurity Completion Rate, a measure of how often the model responds rather than refuses, NOT a hacking-success rate. Do not read it as capability.
It is credited with finding a real high-severity Chrome V8 bug (CVE-2026-15903), but that flaw was responsibly disclosed and patched in July 2026, then cited as proof, not a live zero-day, and OpenAI researchers validated it (human-in-the-loop).
OpenAI's rationale is that attackers already use AI offensively (Anthropic disclosed a largely AI-run espionage campaign in 2025), so vetted defenders need frontier tools. Whether that helps more than it normalises AI weaponisation is a genuine, unsettled debate.