SAN FRANCISCO, 14 AUG 2026 — OpenAI has released a model trained to find zero-days and build exploit chains. On the tasks that matter, GPT-5.6-Cyber completes 95 per cent of prompts. The general-purpose model it is built on completes 1.5 per cent.

Those two numbers describe a change in policy rather than a change in what the model can do.

What was released

95% vs 1.5%Completion on exploit-chain, privilege-escalation and authentication-bypass prompts, against GPT-5.6-Sol.
57.3%What GPT-5.5-Cyber managed in June. The jump in two months is the trend line.
Up to 98.5%Of security queries that would otherwise be refused, now answered.
Real findingsA high-severity flaw in Chrome's V8 engine, plus bugs in an unnamed mobile OS, database and kernel.

The model is built on GPT-5.6-Sol and released on 11 August. It is trained for vulnerability research, penetration testing and incident response, with what OpenAI describes as a lower refusal rate on dual-use tasks.

The safety layer was the only difference

Read the first two figures again. Same base model, 1.5 per cent versus 95 per cent.

The capability did not arrive this month. It was present in GPT-5.6-Sol, and the refusal behaviour was what stood between a general-purpose assistant and a tool that develops working exploits. Remove the refusals, and the assistant is the tool.

The public argument about AI in offensive security usually asks when models will be capable enough to do this work. They already are. What OpenAI adjusted this week was its own willingness to let the model answer.

In engineering terms the gap between a frontier model and an offensive one is thin, which shows how much weight the alignment layer carries. That holds for every lab shipping a frontier model.

The gate is commercial, not technical

OpenAI is not selling this openly. Access runs through an expanded Daybreak programme with two tiers: Daybreak Blue for general models with defensive guardrails, and Daybreak Red for the cyber models themselves.

The named partners are Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group, SpecterOps, Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet and Cloudflare.

That list deserves a second look. (Correction, 14 August 2026: this article first said twelve partners, four of them professional-services firms, following one outlet's partial list. The full roster is sixteen — Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group, SpecterOps, Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet and Cloudflare — of which seven are professional-services firms. Corrected throughout.) Seven of the sixteen are large professional-services firms, which between them employ well over a million people and serve essentially every large organisation on earth. "Trusted partner" is doing considerable work in a sentence that includes the Big Four.

The firms themselves run substantial, competent security practices. The observation is about the nature of the control. A commercial gate restricts who holds the contract. It does nothing about who sits at the keyboard, and a very large number of people inside those organisations can reach an API.

What it actually found

The concrete results are the strongest argument for doing this at all.

Finding a high-severity flaw in Chrome's V8 JavaScript engine is a significant result by any measure. V8 is among the most heavily audited code on the internet, targeted continuously by well-funded researchers on both sides.

The other findings — in an unnamed mobile operating system, a database and an OS kernel — are unverifiable from the outside. This is normal for undisclosed vulnerabilities, but a necessary caveat.

Against that, the defensive case is real: if this class of model finds bugs, it is better that defenders run it first. The argument for release is not weak. The question is whether the gate holds.

Authorised by whom, checked how

The model is trained for authorised security work. That word is carrying the same load it failed to carry last month.

In the Taiwan campaign, the operators defeated a frontier model's safeguards by describing the entire intrusion as an authorised penetration test. Nothing more elaborate was needed, because authorisation is a fact about the world outside the model's context window. It cannot be verified from inside a conversation; it can only be asserted.

Daybreak Red addresses this by moving the check outside the model to the commercial relationship: a contract with a named partner. This is a sounder architecture than trusting a prompt.

The weakness moves rather than disappearing. The check becomes an ordinary governance problem: is every engagement by every team inside these sixteen large firms properly scoped, authorised and supervised? Governance sometimes fails. Penetration testing firms have run out-of-scope before. The difference now is what the tooling can reach when they do.

Three stories that arrived in one week

This release lands alongside two other stories we have covered recently. All three are parts of the same shift.

A Zoom zero-click was found and weaponised in under 24 hours with fewer than 20 prompts to publicly available models, driven through a disassembler and a live tracer. Up to eight agents ran for four days against Taiwanese government systems, assembled from open-source frameworks, with the safeguards bypassed by describing the intrusion as authorised.

Zoomsday showed what general models plus tooling could already do. Taiwan showed somebody doing it at scale without permission. This is the same capability, productised, with a customer list.

The uncomfortable part is the sequencing: somebody was already running this capability without permission before anyone sold it with a contract attached.

The absence that has not been fixed

One more thread connects. Last week more than 120 organisations proposed SAFE, a common taxonomy and clock for reporting AI agent security incidents, with NVIDIA, Cisco, CrowdStrike, Microsoft and Amazon among them.

OpenAI is not a member.

A company shipping an offence-grade model to sixteen partners, while sitting outside the industry's proposed incident-reporting framework, is a specific and awkward combination. It is not hypocrisy — OpenAI runs its own disclosure processes and publishes incident research, and non-membership during a comment period is not refusal.

But the practical effect is that if something goes wrong inside Daybreak Red, there is no agreed channel through which the rest of the industry would learn about it on a clock.

How to read the numbers

Every figure in this article comes from OpenAI's own testing, and the framing follows.

"Up to 98.5 per cent" is a ceiling, not an average, and up-to figures are chosen. The 95 per cent completion rate just means the model answered a prompt in a benchmark suite. It does not mean the resulting exploit worked against a hardened target. The comparison against Sol is the most defensible number of the three, because both sides were measured the same way.

The finding that most deserves independent confirmation is the V8 bug, and that one will eventually be verifiable through Chrome's own disclosure process.

What to watch

Whether the Daybreak Red list grows, and how fast. Sixteen partners can be vetted. Two hundred would make Daybreak Red a distribution channel with paperwork attached.

Whether any of the findings get independently credited. A CVE with OpenAI in the acknowledgements would move this from vendor claim to public record.

And whether other labs follow with their own offence-tier products. Anthropic and Google have models of comparable capability and the same 1.5-to-95 gap sitting inside them. If the market rewards this, what matters next is how many such models exist and who decides access to them.