GPT‑5.6‑Cyber: The AI OpenAI trained to stop saying "no" to exploiting flaws

OpenAI just launched a model that complies 95% of the time when you ask it to build an exploit chain, escalate privileges, or bypass authentication. The previous model complied only 1.5% of the time. The difference isn't a performance upgrade — it's that OpenAI deliberately trained an AI to stop refusing.

It's called GPT‑5.6‑Cyber, it lives inside a program called Daybreak, and according to OpenAI it exists so "trusted defenders" can get ahead of attackers. The announcement comes with a line that sums it all up: "the cyber defense window is narrowing." We've been saying the same thing for years — just without needing to launch a less-restrained model to prove it.

What the model already did, in the real world

This didn't stay in the benchmark. Using GPT‑5.6‑Cyber, OpenAI's researchers found two previously unknown vulnerabilities in V8 — Chrome's JavaScript engine — that could corrupt memory and escape the sandbox. Google already patched them (CVE-2026-15903). They also reported over 400 privilege-escalation vulnerabilities in a popular operating system kernel, three critical flaws in a widely-used database, and a full exploit chain in a popular mobile operating system.

This is Chrome. This is a kernel running on billions of devices. World-class security teams, unlimited budget, mature bug bounty programs — and a specialized AI still found critical flaws nobody had seen before.

If it happened to that kind of infrastructure, the question isn't "could this happen to us?" It's "how long would it take us to notice?"‍

What OpenAI ended up Confirming, without meaning to

Finding isn't the same as validating. OpenAI measures its own model not just on the severity of what it finds, but on the quality and calibration of the technical write-up that comes with it — and they admit it sometimes falls short there, producing reports that are "shorter and less detailed." That's the exact same distinction that separates an automated scan from real validation: finding a possible flaw is the starting point, not the result.

Not even OpenAI trusts it to run alone. All access to Daybreak Red is conditioned on identity verification, active monitoring, and human review before any high-risk action executes. The most aggressive offensive model on the market still needs a human validating every step before anything runs. That's not a minor product detail — it's confirmation that AI alone, without human oversight, isn't a security strategy. It's a risk wearing a different name.

Attacker speed is no longer hypothetical. OpenAI says it plainly: malicious actors will use these same capabilities to attack "at unprecedented speed and scale, in fully autonomous ways." Meanwhile, most companies are still measuring their exposure with a once-a-year snapshot. Against an attacker running 24/7, that snapshot isn't a disadvantage — it's an open window with a sign that says "come in."

The question you need to ask your security vendor

Models like GPT‑5.6‑Cyber are going to be available — controlled or not — to whoever wants to use them. That changes what you need to ask whoever is protecting you: Is your vendor already testing your exposure against this kind of capability, or are they still testing you against threats from two years ago? Is what they report validated by a human, or is it a list of unconfirmed possible flaws? Does it run all year, or once and then nothing until the next cycle?

Because access to this AI is going to reach everyone — attackers included. The difference between a vendor that protects you from that and one that hasn't noticed the game changed yet is going to come down to those three answers.

At Strike, we built the answer to those three questions before they were even being asked: AI that scales the search, Strikers who validate every finding, running continuously — not a once-a-year snapshot. The defense window is narrowing for everyone. The question is which side of that shift you're going to be on.

‍