OpenAI just built an AI that does the work security teams refuse to automate, and made it say yes to requests the base model was trained to reject.
The Summary
- OpenAI launched GPT-5.6-Cyber, a fine-tuned version of GPT-5.6 Sol that completes 95% of advanced cybersecurity tasks versus 1.5% for the base model with safeguards intact
- The model is explicitly trained to reduce refusals on dual-use requests like exploit development and authentication bypass, tasks that could be used defensively or offensively
- It's part of OpenAI's Daybreak program, their AI cybersecurity defense initiative, and won't be broadly available to enterprises
- OpenAI researcher Eric Wallace calls it the company's "first large-scale attempt at directly improving capabilities for advanced cybersecurity tasks"
The Signal
This is OpenAI threading a needle that didn't exist six months ago. The base GPT-5.6 Sol model refuses almost every request that smells like weaponizable security research. It completes just 1.5% of tasks on OpenAI's Advanced Cybersecurity Completion Rate benchmark. That's the safety guardrails working as designed. GPT-5.6-Cyber strips those guardrails off for approved defenders, hitting 95% completion on the same benchmark.
The jump from 1.5% to 95% isn't about raw capability. It's about permission. OpenAI fine-tuned the model to understand context that the base model was trained to ignore: who's asking, why they're asking, whether the exploit chain they want is going into a red team exercise or a bug bounty or actual defense infrastructure.
"GPT-5.6-Cyber is OpenAI's first large-scale attempt at directly improving capabilities for advanced cybersecurity tasks such as exploit development."
The tasks it now completes without refusal include:
- Zero-day vulnerability discovery
- Exploit chain development
- Authentication bypass techniques
- Privilege escalation pathways
Compare this to GPT-5.5-Cyber, which hit 57.3% completion. That's a 66% jump in one model generation. The improvement isn't incremental. It's structural. OpenAI is building agentic capability for offense-shaped work, then locking it behind verification layers.
The Daybreak program expansion is the other half of this story. OpenAI is positioning this as defense against AI-led attacks, which means they're betting the threat model has already shifted. Not script kiddies using ChatGPT to write phishing emails. Autonomous agents finding zero-days at scale, faster than human teams can patch them.
The Implication
Security teams have been stuck in a bind: the best tools for finding vulnerabilities look identical to the tools for exploiting them, and most AI companies won't touch that work at scale. OpenAI just picked a side. They're building the offensive tooling and restricting access, betting they can verify intent before granting capability.
Watch who gets access to GPT-5.6-Cyber and under what terms. If OpenAI keeps this limited to vetted partners inside Daybreak, it's a research play. If they start licensing it to enterprises with compliance frameworks, it becomes the blueprint for agentic security tooling at scale. Either way, the refusal rate just became a tunable parameter. That changes what agents can be asked to do.