Two Models From the Same Base Scored 1.5% and 95% on the Same Test | Edition 310

On 10 August, OpenAI shipped a model whose headline feature is that it says no less often.

It is called GPT-5.6-Cyber. On OpenAI’s internal Advanced Cybersecurity Completion Rate benchmark, it completes 95.0% of the tasks put to it. The standard GPT-5.6 Sol that everyone else can reach completes 1.5% of the same tasks.

Both are built on the same base model. That is the part worth sitting with, and it is not really a story about hacking.

What actually shipped

Daybreak was already OpenAI’s cybersecurity program. What changed on 10 August is that it now has two doors, and they lead to different models.

Daybreak Blue is the entry point, and OpenAI recommends it for most defenders. You get its general-purpose frontier model, GPT-5.6 Sol, with the safety guardrails loosened specifically for defensive work. In practice that means it stops bailing out on the things security teams do all day: analysing a malware sample, reviewing code you already know is vulnerable, working an incident, managing a vulnerability queue, validating that a patch actually closed the hole.

Daybreak Red is the serious tier, and it is the only way to reach GPT-5.6-Cyber. That model was trained specifically for offensive work: finding zero-days — vulnerabilities nobody has discovered or patched yet — building the exploit chains that turn a bug into real access, and validating that an attack lands.

Under OpenAI’s own Preparedness Framework, GPT-5.6-Cyber is rated High for cybersecurity capability. That is one step below the Critical threshold, and it is the highest rating OpenAI has publicly assigned to a model it then shipped to outside users.

The number that is not a capability score

Here is the ladder, in OpenAI’s own benchmark, on the same set of advanced cybersecurity tasks:

• Standard GPT-5.6 Sol: 1.5%
• The Daybreak Blue variant: 2.0%
• Last year’s GPT-5.5-Cyber: 57.3%
• GPT-5.6-Cyber: 95.0%

Look at the first two lines. Loosening the guardrails on Sol for defensive work moved it half a percentage point. That is not a capability change and was never meant to be — Blue is Sol with permission to discuss the defensive half of the job.

The jump to 95.0% is a genuinely different thing, and it would be sloppy to call it purely a policy dial. OpenAI says GPT-5.6-Cyber was specifically trained to improve performance on these tasks, so real capability work went into it.

But look at what the metric is. A completion rate counts whether the model produced an answer at all. A model that refuses scores zero no matter how much it knows. So a 1.5% does not mean Sol cannot do this work — it means Sol almost never agrees to. The distance between 1.5% and 95.0% is part skill and, unavoidably, part permission.

One caveat that belongs right here rather than in a footnote: this is OpenAI’s own internal benchmark. No third party has audited it. Take the ordering seriously and the decimal places less so.

The Chrome proof

Benchmarks are arguable. A patched CVE is not.

Before the launch announcement went out, OpenAI pointed GPT-5.6-Cyber at V8, the JavaScript engine inside Google Chrome and one of the most heavily audited pieces of software on earth. It found two previously unknown vulnerabilities that could be chained together to corrupt memory and escape V8’s heap sandbox — the barrier that is supposed to stop a malicious web page from reaching the rest of your machine.

The findings went to Google through coordinated disclosure. Google shipped the fix in mid-July. One of the pair is now CVE-2026-15903, rated 8.8 on the CVSS severity scale: V8’s optimising compiler was skipping a safety check during an integer conversion, which produced an out-of-bounds array index an attacker could read or write memory through.

That is not a demo. That is a bug class real attackers hunt for, in a target that thousands of professional researchers already comb over, found by a model.

OpenAI credits the same model with more. At least five vulnerabilities in a popular mobile operating system it declines to name, including one chain that escalates from restricted app access all the way to full administrator control. Three critical flaws in a widely used database. And more than 400 privilege-escalation issues in a widely used operating-system kernel.

That last figure deserves a beat. Four hundred is not a research finding. Four hundred is an inventory.

Who actually gets in

Red is applied for, not bought. OpenAI vets applicants before granting access and keeps watching afterwards: identity verification, account security requirements, ongoing monitoring, and legal declarations about what the access will be used for. It also recommends running the model inside isolated sandbox environments rather than against anything live.

The trusted-partner roster reported around the launch includes IBM, CrowdStrike, Cloudflare, Palo Alto Networks, Accenture, Akamai, Fortinet, PwC and Sophos. Coverage disagrees on the total number of organisations involved — different outlets have printed different counts — so treat that list as representative rather than complete.

OpenAI’s own framing of the risk is notably unhedged for a launch post. It says outright that models running with reduced safeguards carry risks beyond ordinary model use, and names two sources for that risk: deliberate misuse, and the model itself being misaligned with what its operator intended.

Why this matters if you will never touch either tier

You are not applying for Daybreak Red. Almost nobody is. But OpenAI just published, in one table, something the rest of us usually only guess at.

1. A refusal is a setting, not a verdict. When an assistant tells you it cannot help with something, the accurate translation is almost never this is beyond me. It is this is not permitted on this account, at this tier, in this context. Most people quietly read a refusal as a statement about the technology’s limits. It is usually a statement about the vendor’s risk appetite. The gap between 1.5% and 95% is the size of that misunderstanding.

2. Capability is being unbundled from access. The interesting product here is not the model — it is the vetting. Same underlying system, four different behaviours, and what decides which one you get is paperwork. Expect that pattern well outside security. Legal, medical and financial tools are heading the same way: a uniform model underneath, and a credential check deciding how much of it you are allowed to use.

3. The window is the whole argument. OpenAI’s case for shipping this is that defenders need to find the bugs before attackers do, and that the time between a vulnerability existing and being exploited keeps shrinking. That case is reasonable. It also rests entirely on the vetting, because a tool that inventories 400 kernel escalation bugs is equally useful to whoever runs it. Vetting is a process, and processes fail differently than software does.

The practical version, for anyone running a business on these tools: stop treating an AI refusal as a judgement about difficulty. It is a judgement about permission. Sometimes the fix is a different tool, sometimes a different tier or plan, and very often it is just supplying the legitimate context the model was missing. Knowing which of the three you have hit is the actual skill — and it is worth about ninety-three and a half points.

What we do not know

Four things this edition deliberately does not assert.

• The benchmark is OpenAI’s own. Both the 95.0% and the 1.5% come from an internal evaluation. Nobody outside the company has reproduced them.
• Completion is not correctness. The metric counts whether the model produced an attempt at the task, not whether the attempt was any good.
• The partner count is unsettled. Different outlets have printed different totals for how many organisations are in the program. We have named only firms that appear on more than one list, and given no total.
• The other targets are anonymous. The mobile operating system, the database and the kernel are all unnamed, so the mobile, database and 400-plus kernel figures cannot be independently checked the way the Chrome CVE can.

The takeaway

The headline everyone will run is that OpenAI built a hacking model. The more useful reading is that OpenAI published, in a single table, how much of what you experience as a model’s limits is a dial someone is choosing to leave where it is — and then showed everyone what happens when that dial gets turned.

The Chrome bugs are real and patched. The benchmark is a company grading its own homework. Both of those can be true, and the second one does not make the first one less interesting.

Sources: SecurityWeek · The Hacker News · The Decoder · VentureBeat · OpenAI