In August 2026, OpenAI did something it had spent years refusing to do: it released a model that willingly writes working attack code. OpenAI’s hacking AI is called GPT-5.6-Cyber, and it can build exploit chains, bypass authentication and escalate privileges on request — tasks that regular ChatGPT flatly refuses. The headlines were alarming. The reality is more specific, and more interesting, than “OpenAI armed the hackers.”
Here is what the model actually does, who is allowed near it, and whether any of this changes your personal risk of being hacked.
What is GPT-5.6-Cyber?
GPT-5.6-Cyber is a version of OpenAI’s GPT-5.6 Sol model with its cybersecurity refusals deliberately removed. It is built for offensive security work: writing proof-of-concept exploits, validating exploit chains, penetration testing and red teaming. It is not a new “evil AI” — it is the same model with a different permission slip.
The numbers make the shift obvious. On OpenAI’s internal Advanced Cybersecurity Completion Rate evaluation, GPT-5.6-Cyber completed 95% of advanced exploit-development prompts. Standard GPT-5.6 Sol completed just 1.5% of the same prompts, and the earlier GPT-5.5-Cyber managed 57.3%. In other words, the guardrail was never a capability limit — it was a policy choice, and OpenAI has now created a lane where that policy is relaxed.
The company launched it alongside a restructured access programme called Daybreak, split into two tiers: Daybreak Blue for defensive work using ordinary guardrailed models, and Daybreak Red, the only route to GPT-5.6-Cyber.
OpenAI also published results to justify it. According to The Hacker News, the model found two previously unknown flaws in Google Chrome’s V8 JavaScript engine — disclosed as CVE-2026-15903, rated 8.8 on the CVSS severity scale — plus more than 400 privilege-escalation weaknesses in an operating system kernel and three critical database vulnerabilities with remote code execution paths.
Who can actually use OpenAI’s hacking AI?
Almost nobody. GPT-5.6-Cyber is not available to ChatGPT subscribers or ordinary API developers at any price. Access runs only through Daybreak Red, which requires identity verification, legal attestations, an approved use case and a defined testing scope. You cannot sign up for it; your organisation has to be accepted into it.
The initial approved list is a roll call of large security firms and consultancies: Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group and SpecterOps, alongside security vendors including Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet and Cloudflare.
There is one more control that matters and that most coverage skipped: the model access stays with the approved partner. Even a company that hires CrowdStrike or PwC does not get a GPT-5.6-Cyber login. The partner runs it, reviews the output, and hands over findings. Every session is logged, monitored and subject to human oversight.
The one-line version: OpenAI’s hacking AI is gated behind corporate identity checks, not a paywall — which means the barrier is who you are, not what you can afford.
Does OpenAI’s hacking AI make you more likely to be hacked?
Not directly, and probably not soon. Criminals cannot buy access, and the organisations that can are the same firms already employing thousands of human exploit developers. For an individual or a small business, the day-to-day threat picture on the day of launch looked identical to the day before.
The honest answer is that the risk is second-order. Three things could change the picture over the next year:
- Leaked outputs. A proof-of-concept exploit written inside a legitimate engagement is still a working exploit if it escapes.
- Competitive pressure. Once one lab ships a cyber-specialist model, rivals — including open-weight models with no gatekeeper at all — have a commercial reason to follow.
- Faster discovery, slower patching. If AI finds bugs faster than vendors ship fixes, the window in which a known flaw sits unpatched on your device gets more crowded, not less.
That last one is the real story, and we will come back to it.
What criminals are already doing without it
It is worth keeping the panic proportionate. Attackers have been using general-purpose AI for two years, and the data suggests it is not primarily for writing exotic exploits.
Anthropic mapped a year of AI-enabled cyber threats by examining 832 accounts banned for malicious cyber activity between March 2025 and March 2026. Its finding was counterintuitive: AI-assisted phishing actually fell 8.6% over the year, while AI use for account discovery — finding and profiling targets — rose 8.9%. Attackers are pushing AI deeper into reconnaissance, not into exploit-writing.
That matches what actually hits people. Phishing and spoofing were the most-reported crime category to the FBI’s Internet Crime Complaint Center in 2024, with 193,407 complaints — more than double the next category. None of those required a model that can chain a kernel privilege escalation.
The uncomfortable truth: the AI that is most likely to be used against you writes a convincing email, not an exploit chain.
The real risk is the patch gap
The interesting consequence of GPT-5.6-Cyber is not new attacks — it is volume. If a handful of large firms can now surface hundreds of kernel vulnerabilities in a single research push, software vendors face a discovery rate their patching pipelines were never built for.
Responsible disclosure gives a vendor a window, typically 90 days, to ship a fix before details go public. That system assumes a human-paced trickle of findings. Four hundred privilege-escalation flaws from one exercise is not a trickle.
For you, the practical effect is that the security update sitting in your notifications matters more than it did last year, because the gap between “flaw discovered” and “flaw publicly known” is compressing. This is the same governance question we looked at in our piece on whether governments review AI models before release — capability is arriving faster than the processes meant to absorb it.
What should you actually do about it?
Nothing dramatic, but the boring advice now has better reasons behind it. If you do only four things:
- Turn on automatic updates for your phone, browser and operating system. The V8 flaw OpenAI found lives in Chrome — a browser restart applies that class of fix.
- Use passkeys or an authenticator app rather than SMS codes. Authentication bypass is exactly the category GPT-5.6-Cyber is tuned for, and phishing-resistant login is the defence that does not depend on you spotting a fake.
- Assume the message is the attack. The AI threat that reaches consumers is a fluent, personalised email or voice call, not a zero-day.
- If you run a business, ask your security vendor whether they are in Daybreak Blue or Red, and what that changes about your testing. It is now a fair procurement question.
The bigger picture is that AI safety has quietly moved from “should the model be able to do this?” to “who is verified enough to ask?” — a shift we also saw in the UK’s rogue AI agent safety tests. Gated capability is likely to become the industry’s default answer for dangerous domains, and GPT-5.6-Cyber is the clearest example yet of what that looks like in practice.
Frequently Asked Questions
Can I use GPT-5.6-Cyber with a ChatGPT Plus or Pro subscription?
No. GPT-5.6-Cyber is not available on any consumer ChatGPT plan or through the standard API. It is reachable only via OpenAI’s Daybreak Red tier, which requires organisational approval, identity verification and a defined testing scope.
What is the difference between Daybreak Blue and Daybreak Red?
Daybreak Blue gives approved security teams access to normal guardrailed models for defensive work such as incident response and threat analysis. Daybreak Red is the restricted tier that unlocks GPT-5.6-Cyber for offensive tasks like exploit-chain validation, penetration testing and red teaming.
Is OpenAI’s hacking AI legal to use?
Yes, within its terms. Approved partners may only use it against systems they are authorised to test, under a documented scope. Using it — or any tool — against systems you do not own or have written permission to test remains a criminal offence in most countries.
Did GPT-5.6-Cyber find any real vulnerabilities?
Yes. OpenAI reported that the model identified two previously unknown flaws in Chrome’s V8 engine, disclosed to Google as CVE-2026-15903 with a CVSS score of 8.8, plus over 400 privilege-escalation weaknesses in an OS kernel and three critical database vulnerabilities.
Should ordinary users change anything because of this launch?
Only your update habits. Enable automatic security updates, switch to passkeys or an authenticator app instead of SMS codes, and stay sceptical of unexpected messages. Criminals cannot access this model, so the practical threat to consumers is unchanged.
