GPT-5.6-Cyber ships behind hardware keys

Most AI capability launches are a pricing page and a rate limit. GPT-5.6-Cyber, which OpenAI released on August 10, is not. The model will help you write an exploit chain — and to reach it you have to prove who you are, sign a legal declaration, accept monitoring, and carry a hardware security key by September 1. That gate is the more useful part of the announcement for anyone running a small company.

What actually happened

OpenAI expanded Daybreak, its access program for security practitioners, into two tiers. Daybreak Blue gives approved defenders GPT-5.6 Sol without the system-level cyber guardrails, for malware analysis, vulnerability detection and incident response. Daybreak Red adds GPT-5.6-Cyber itself, for vulnerability research, exploit validation and penetration testing.

The refusal numbers are the story. On OpenAI's own evaluation set of advanced offensive-security requests — exploit-chain development, authentication bypass, privilege escalation — GPT-5.6-Cyber completes 95.0%. Stock GPT-5.6 Sol completes 1.5%, and 2.0% with Blue-tier access. That is not a nudge to the safety training; it is a different product.

It works. OpenAI researchers pointed the model at V8, the JavaScript engine inside Chrome, and it surfaced two previously unknown bugs that chain to corrupt memory and escape the V8 heap sandbox. Google shipped the fix as CVE-2026-15903. OpenAI rates both GPT-5.6 Sol and GPT-5.6-Cyber at High cybersecurity capability under its Preparedness Framework — below the Critical threshold, and a level above where this conversation was a year ago. VentureBeat and CNBC covered the launch the same day.

Why hardware keys matter for your business

You are not applying to Daybreak Red. The transferable thing is the control stack OpenAI wrapped around a dangerous capability: identity verification, a named accountable human, logged and monitored usage, a signed statement of authorized purpose, and phishing-resistant MFA with a deadline attached.

Now look at your own AI tooling. Most small companies have an agent somewhere with a broad API key, shared through a password manager, running under a service account nobody owns, with no log of what it did. The capability is smaller than GPT-5.6-Cyber's. The gate is a lot smaller too.

Three things worth doing this quarter, in order of payoff per hour:

• Hardware keys on every account that can reach a model API or a deploy pipeline. OpenAI is mandating them for Daybreak individual accounts from September 1. TOTP and push MFA lose to a good phishing page; a FIDO2 key does not.
• One named owner per agent and per key. "The marketing automation" is not an owner. If you cannot say who revokes it at 2am, it is unowned.
• Logs you would actually read. Prompt in, tool call out, timestamped, retained. If your agent misbehaves, the log is the entire investigation.

None of that is exotic. It is the same access hygiene you would apply to a payroll system — applied to the tool that can now write working exploit code.

Sources: OpenAI, VentureBeat, CNBC.