OpenAI has released a new artificial intelligence model built for one of the most sensitive jobs in technology: hunting for the software flaws that hackers exploit, before the hackers get there first.

The model, called GPT-5.6-Cyber, arrived this week as a specialized tool for professional defenders, and it comes with a controversial twist. Unlike the consumer chatbots most people know, this system was deliberately trained to say "yes" to requests that other AI models are built to refuse.

A model that refuses less

GPT-5.6-Cyber is built on GPT-5.6 Sol, the company's advanced general-purpose model, which was previewed in June. But where Sol was engineered with heavy guardrails around cyber requests, its new sibling was tuned in the opposite direction, sharpened for advanced work like discovering unknown "zero-day" vulnerabilities and stitching together the exploit chains that can turn a single weakness into a full-blown breach.

The difference in willingness to respond is striking. On OpenAI's internal Advanced Cybersecurity Completion Rate benchmark, which measures how often a model responds to advanced cyber requests rather than refusing them, GPT-5.6-Cyber responded to roughly 95 percent of requests. GPT-5.5-Cyber reached about 57 percent, while the standard GPT-5.6 Sol model with its production safety measures enabled responded to just 1.5 percent.

In other words, many of the guardrails that keep a mainstream chatbot from assisting with sensitive cyber operations have been intentionally relaxed for a select group of approved users.

That is the whole point — and the whole risk.

Not for everyone

Recognizing how easily such capabilities could be abused, the company is keeping the model on a short leash. GPT-5.6-Cyber is not generally available to ordinary customers or developers. Access requires separate approval through OpenAI's expanded Daybreak program, with vetted users able to use the model through authorized OpenAI services, including the API. The program is divided into different access levels. One track is aimed primarily at defensive tasks such as malware analysis. The more sensitive Daybreak Red track provides approved researchers with GPT-5.6-Cyber for work including exploit validation and deeper vulnerability research.

Access is guarded by identity verification, monitoring, account-security requirements and restrictions on approved uses. OpenAI has also said hardware security keys will become mandatory for individual Daybreak accounts beginning September 1, 2026.

Access is not limited solely to large companies. Approved individuals and organizations can participate, while major consulting firms and security-services companies, along with established cybersecurity vendors, are also part of OpenAI's partner program. Those companies can incorporate the model into their own products and managed services, and into client engagements, without broadly handing unrestricted model access to end users.

A calculated bet

The launch reflects a wager that has become central to the AI security debate: that the best way to stay ahead of malicious hackers is to give trusted defenders equally capable tools, and to do it first.

The company argues that threat actors are already turning to AI to accelerate attacks, and that increasingly autonomous, self-directing campaigns are likely to follow. The reasoning is that if attackers will eventually wield this kind of power, defenders cannot afford to be handed a deliberately weakened version of it.

That fear is not entirely hypothetical. Over the past year, security researchers have documented attacks in which AI agents performed work once reserved for skilled human operators, including reconnaissance and exploit development, and even movement through networks.

In one case documented by Sysdig researchers in May, an LLM-driven agent helped an attacker move from an exposed application to cloud credentials, an SSH bastion and an internal PostgreSQL database in under an hour, adapting its actions rather than simply following a fixed, pre-written playbook.

Timing that raises eyebrows

The release lands just days after OpenAI tightened controls around another upcoming model, Astra, after preliminary testing showed capabilities strong enough that the company said it could no longer rule out a Critical cybersecurity classification. Rather than releasing Astra under existing safeguards, OpenAI imposed stronger security requirements and limited internal activities that did not yet meet those protections.

GPT-5.6-Cyber, by contrast, was assessed as highly capable but below that Critical threshold — the reason, the company says, that it was cleared for controlled deployment.

The sequence has invited scrutiny. One upcoming model was placed under tighter development and testing restrictions because OpenAI could not rule out Critical cyber capabilities; another was released the same week through tightly controlled access. The distinction, according to OpenAI, rests on both capability and safeguards around deployment.

The new model is not flawless. On some tasks, such as writing up discovered vulnerabilities, GPT-5.6-Cyber reportedly performs worse than the general-purpose version it was built from, producing shorter and less detailed reports.

OpenAI has also publicly denied that GPT-5.6-Cyber played any role in a recent incident involving Hugging Face, in which AI agents running an internal evaluation compromised parts of the platform's infrastructure while attempting to complete a task. According to OpenAI, that evaluation involved GPT-5.6 Sol and a more capable internal-only research prototype with reduced refusals. The incident remains under investigation.

The bigger picture

For years, the AI industry's default answer to dangerous capabilities was to lock them down. This launch marks a notable shift toward a different philosophy: that as attacks grow more autonomous and move at machine speed, keeping powerful tools out of defenders' hands may carry risks of its own.