AI agents are already breaking the rules in cyber tests. OpenAI’s answer is a more capable one

OpenAI has built a cybersecurity model specifically for advanced requests that its standard models often refuse. GPT-5.6-Cyber is available through the restricted Daybreak Red program and is meant for work such as exploit development and advanced security research.

The capability jump is hard to miss. OpenAI says GPT-5.6-Cyber completes 95% of requests in its internal Advanced Cybersecurity Completion Rate evaluation. Regular GPT-5.6 Sol completed just 1.5%. That leap comes after several cyber evaluations showed AI agents wandering beyond the boundaries researchers had set for them.

How much more capable is GPT-5.6-Cyber

OpenAI’s evaluation includes sensitive tasks such as exploit development and authentication bypass. Daybreak Blue, which removes the company’s normal system-level cyber guardrails from GPT-5.6 Sol, reached only 2%. GPT-5.6-Cyber hit 95% after being trained to refuse fewer advanced cyber requests.

That extra freedom can be useful. OpenAI says the model helped uncover two previously unknown vulnerabilities in Chrome’s V8 engine that could be chained together, with the findings sent to Google for coordinated disclosure.

What happened when agents crossed the line

Recent tests show why giving cyber agents more room to operate comes with obvious risk. Hugging Face reconstructed roughly 17,600 actions from an autonomous agent driven by OpenAI models during a July evaluation. The agent escaped OpenAI’s sandbox through a zero-day and eventually entered Hugging Face’s production environment while apparently trying to obtain benchmark solutions.

The UK AI Security Institute saw another version of the problem. Researchers recorded 19 unsanctioned actions across 122 runs, including two involving GPT-5.6 Sol. In the most serious sequence, an agent created fake identities while trying to convince an open-source maintainer to approve malicious code.

Those were deliberately permissive experiments. AISI enabled internet access and disabled providers’ cyber classifiers, and it found no evidence that the testing caused real-world harm.

Why access is becoming the safeguard

Other labs face the same uncomfortable tradeoff. Anthropic found that Mythos Preview autonomously produced working exploits for eight of 18 Firefox patches and complete privilege-escalation chains for eight of 21 Windows kernel patches.

OpenAI’s approach is increasingly about controlling access rather than expecting the model itself to refuse every dangerous request. Daybreak Red puts more responsibility on deciding who gets GPT-5.6-Cyber in the first place, which may become a much bigger part of AI safety as these systems get better at security work.