OpenAI's cyber model completes 95% of exploit requests. Removing the safeguards got 2%

What OpenAI actually announced

Two access tiers, and a model.

Daybreak Blue gives approved defenders GPT-5.6 Sol with the system-level safeguards removed. Daybreak Red adds GPT-5.6-Cyber, a model built on GPT-5.6 Sol and trained, in OpenAI's own words, "to reduce refusals for certain higher-risk, dual-use cyber tasks".

The announcement is dated 10 August 2026. Access is gated by identity verification, approved-use restrictions and legal attestations, and from 1 September 2026 every individual Daybreak account must use a hardware security key.

Most coverage will lead with the model. The number worth reading is in the refusal table.

The guardrail is not where you think it is

OpenAI published an internal benchmark called the Advanced Cybersecurity Completion Rate, measuring how often a model responds to requests involving exploit-chain development, authentication bypass and privilege escalation.

Look at the first two bars rather than the last one.

Removing the system-level guardrails, which is the entire proposition of Daybreak Blue, moved the completion rate from 1.5% to 2.0%. Half a percentage point. The tier that markets itself as unlocking the model for defenders barely changes what the model will do.

The jump to 95.0% needed a different model, trained differently. That is the finding hiding in a promotional page: the refusal is not a filter sitting in front of the weights, it is in the weights. Every organisation that has assured itself its AI usage policy is enforced by provider-side safety filtering has the layering backwards.

The specialised model is worse at the defender's half

Buried in the same page are three results that do not point the same way.

OpenAI states the reason plainly: GPT-5.6-Cyber "performs worse than GPT-5.6 Sol on this evaluation, which we believe is due to the model sometimes producing shorter, less detailed vulnerability reports".

That asymmetry is the practitioner's takeaway. The specialised training bought willingness and exploitation. It cost report quality. The half that got cheaper is the half an attacker needs, and the half that got worse is the half a defender needs, because a finding nobody can act on is not a finding. Anyone budgeting for AI-assisted vulnerability research on the assumption that the write-up comes free should read that row twice.

CVE-2026-15903, and why one bug was not enough

OpenAI used GPT-5.6-Cyber against V8, the JavaScript engine in Chrome. It found two previously unknown vulnerabilities, chained. Google fixed the first and assigned CVE-2026-15903.

Value converted to an integerundefined enters the conversionThat number is used as an array indexThe bounds check is omitted as redundantRead or write to memory belonging to other objects

The second vulnerability is the part worth dwelling on. Arbitrary read and write inside V8 is not enough on its own, because the V8 heap sandbox is designed to contain exactly that. Escaping it needs a separate flaw, and OpenAI says GPT-5.6-Cyber found that one too.

It is worth reproducing because it is more specific than the announcement it sits in. The prose says only that a second vulnerability was needed to escape the sandbox. The diagram names it: a JSPI stack escape against a fixed-argument assumption in WasmResume, where too few arguments leave a gap on the stack and too many overflow it. The diagram also shows the chain terminating in a V8CTF flag capture, which places this work inside Google’s own bounty programme rather than in a private lab.

None of that is in the text. A reader who takes the announcement at its word learns that a second bug existed. A reader who looks at the picture learns which subsystem it was in.

n Chrome's exploit mitigations assume an attacker has to find several independent flaws and combine them, and that this is slow and expensive human work. That assumption is what the announcement quietly tests. The defence still worked, in the sense that one bug was not enough. It cost an agent one investigation rather than a research team a quarter.

The number nobody is repeating

Three lines near the end of the announcement list what else GPT-5.6-Cyber found:

• At least five vulnerabilities in a popular mobile operating system, including a chain from an untrusted app to local privilege escalation
• Three critical vulnerabilities in a popular database, including a remote path to code execution
• Over 400 vulnerabilities that can lead to privilege escalation in a popular operating system kernel

Four hundred. Unnamed product, undisclosed, described as being worked through with partners and the open-source community.

This is the second time in two days that the same shape has appeared. Yesterday it was 84 flaws found by one academic system in 5G core software, 23 of which still have no fix. The instrument differs. The bottleneck does not.

Coordinated disclosure was built on the assumption that finding is the expensive step. Four hundred kernel privilege-escalation findings from one model, arriving at one maintainer, is not a ninety-day conversation. Nobody has published a process for that volume, and the honest position today is that one does not exist.

What to do with this in the next fortnight

The position

The framing of the announcement is a race: attackers will use AI at scale, so defenders need the same capability first. That is a reasonable argument and it is probably correct.

It is worth being precise about what has been demonstrated, though. What the evidence on this page shows is that exploit generation got materially better and vulnerability reporting got slightly worse. Those are not symmetric gains. The defender's workflow ends with a report somebody acts on; the attacker's ends with working code. One of those two things is what the specialised training improved.

The access controls are real and thoughtful. Identity verification, legal attestations and mandatory hardware keys are more than most capability releases carry. But the control that matters most is the one OpenAI has now published a number for, and that number says the guardrail lives in the weights rather than in a policy anyone else can configure.