GPT-5.6 (Sol, Terra, and Luna) is OpenAI's most capable model family yet for cybersecurity, and the first it rates High capability in both cyber and bio. It finds real vulnerabilities and exploit primitives faster and cheaper than any prior GPT, but cannot autonomously build end-to-end exploit chains against hardened targets, and launches gated to government-approved partners.
OpenAI previewed GPT-5.6 on June 26, 2026 as three models: Sol, the flagship, Terra, a balanced everyday model, and Luna, a fast and low-cost tier. All three are rated High cybersecurity capability under OpenAI's Preparedness Framework, the strongest cyber rating any GPT family has carried at launch. So how good is it for real security work, how do you actually use it, and how does it stack up against Mythos? We pulled the announcement, the preview system card, our own NexBench evaluation, and the access fine print to find out.
What can GPT-5.6 do for cybersecurity?
GPT-5.6 is built for long-horizon agentic work, the kind of multi-step tool use that offensive security testing actually requires. On OpenAI's own cyber benchmarks, Sol clears the offensive-capability tasks decisively but stalls at the hardest end-to-end bar, per the GPT-5.6 preview system card :
| Cyber benchmark | What it measures | GPT-5.6 Sol result |
|---|---|---|
| Internal CTF (hardest curated set) | Professional-level vulnerability ID and exploitation | 96.7%, saturating the eval and above GPT-5.5 |
| ExploitBench | Building exploit primitives from known JS-engine bugs | Matches Mythos Preview using ~1/3 the output tokens |
| CVE-Bench (pass@1) | Consistent real-world web-app exploitation | Slightly above prior generations |
| VulnLMP (Critical threshold) | End-to-end exploits in hardened, widely deployed software | No functional critical-severity exploit produced |
These are OpenAI's own evaluations, so read them as a vendor benchmark, but the shape is clear: GPT-5.6 saturates the offensive tasks that earlier GPTs found hard, matches Anthropic's Mythos Preview on exploit-primitive work at roughly a third of the token cost, and still cannot chain a full exploit on a hardened target. The efficiency gain is real too, with Terra matching GPT-5.5 performance at half the price, per OpenAI . It is a meaningful step over how we sized up GPT-5.5.
Where does GPT-5.6 land on MindFort's NexBench?
Those are OpenAI's own scores. To see how the family holds up against a real application, we ran all three variants through NexBench, MindFort's internal evaluation. Each model runs an authorized full-breadth web-app pentest against a controlled target, and an independent GPT-5.5 validator reproduces every finding before it counts. Scores sum only the accepted findings, weighted by severity.
Read these as harness scores, not model scores. Every variant runs inside a portable version of MindFort's production agent system, which provides the browser, the isolated container, and a manager that plans the engagement and hands work to subagents. None of these models does a full-breadth pentest from a bare prompt and a URL. The harness supplies the machinery; the model supplies the judgment about what to probe next, when to dig deeper, and when to stop and report. So the score is really a measure of decision-making in two roles, executor and manager, plus how efficiently the model spends tokens inside a fixed time budget.
GPT-5.6 Sol topped the field. At its highest reasoning effort it scored 61, the best of any model we tested, and 87 of its findings survived validation, again the most of the eleven models. Luna landed at 43 and Terra at 36, so even the cheaper tiers hold their own against pricier frontier models.
Best NexBench score, all eleven models
Highest validator-accepted score each model reached at any reasoning effort. GPT-5.6 Sol leads; the other two GPT-5.6 tiers are highlighted alongside it.
Sol's lead is not a rounding error. Grok 4.5 came in second at 52 and Claude Opus 4.8 third at 45, so the jump to Sol's 61 is a full tier. Here is the full board with the GPT-5.6 family called out across every metric we tracked.
NexBench leaderboard
Sort by any column. The three GPT-5.6 tiers are highlighted. Sol leads on both raw score and total accepted findings.
| Model | Best-run effort | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| GPT-5.6 Sol | X-High | 61 | 2h 19m | 87 | 40 | $1,093 | 224.5M | 0.080 | 0.387 |
| Grok 4.5 | High | 52 | 5h 3m | 51 | 26 | $122 | 49.6M | 0.419 | 1.028 |
| Claude Opus 4.8 | Max | 45 | 1h 50m | 68 | 38 | $380 | 77.8M | 0.179 | 0.875 |
| GPT-5.6 Luna | X-High | 43 | 1h 59m | 47 | 21 | $158 | 127.8M | 0.297 | 0.368 |
| Kimi K3 | Default | 42 | 49m | 41 | 22 | $47 | 40.0M | 0.872 | 1.025 |
| GPT-5.5 | X-High | 41 | 1h 19m | 45 | 19 | $120 | 88.0M | 0.375 | 0.511 |
| GPT-5.6 Terra | X-High | 36 | 1h 6m | 49 | 19 | $215 | 80.3M | 0.228 | 0.610 |
| GLM-5.2 | X-High | 34 | 1h 40m | 31 | 12 | $38 | 42.7M | 0.821 | 0.726 |
| Claude Sonnet 5 | Max | 34 | 4h 30m | 54 | 31 | $374 | 173.1M | 0.144 | 0.312 |
| Kimi K2.7 | Default | 24 | 2h 32m | 14 | 2 | $14 | 17.3M | 1.005 | 0.809 |
| Nemotron 3 Ultra | High | 18 | 5h 3m | 16 | 2 | $92 | 261.5M | 0.173 | 0.061 |
Is GPT-5.6 good at finding real vulnerabilities?
Yes, and OpenAI's own framework testing shows where the gains land. Run against widely deployed hardened software using VulnLMP, OpenAI's internal end-to-end exploit framework, GPT-5.6 Sol produced credible memory safety leads, some capable of leading to disclosure, mutation, or control flow corruption, as reported by The Hacker News . OpenAI's read is that substantial parts of real-world vulnerability research are becoming automatable when models are paired with tool use, build systems, and verification infrastructure.
NexBench showed the same thing: Sol only reached 61 at its highest reasoning effort, and its score climbed as we gave it more room to plan and use tools. The model on its own is not the model doing the work. Plot score against cost per run and the tradeoff is clear, with Sol paying for its lead in tokens while Luna and Terra sit lower but far to the left.
Score vs. cost per run
Every model-effort run in NexBench by standard cost against score. Sol, Terra, and Luna are each shown at their best run only (61, 36, and 43); the rest of the field is greyed out.
Raw model scores understate what these models do once they are wrapped in a real pentesting agent, which is exactly the architecture MindFort is built around.
Can GPT-5.6 write zero-day exploits?
Not on its own, and OpenAI is explicit about it. In evaluations against Chromium and Firefox, GPT-5.6 Sol identified bugs and exploitation primitives, the building blocks of an exploit, but it did not autonomously produce a functional full-chain exploit under the conditions tested, according to OpenAI .
That is why it sits at High and not Critical under the Preparedness Framework . OpenAI's own summary in the GPT-5.6 preview system card is that the model is better at finding and fixing vulnerabilities than at exploiting them in real attacks. It is a strong research assistant, not an autonomous attacker, at least not yet.
Is GPT-5.6 better than Mythos?
On efficiency it has a clear edge, and on raw capability it is roughly even. On ExploitBench, OpenAI reports that Sol matches Mythos Preview while spending only about one-third of the output tokens, per the announcement . On the offensive side it also saturates OpenAI's hardest internal CTF set at 96.7 percent, above GPT-5.5, per the system card . Those are OpenAI's own numbers, and independent testing from the UK AI Security Institute earlier placed GPT-5.5 and Mythos at near-parity within the margin of error, per AISI , with neither family crossing Critical.
The bigger difference is access, not capability. The U.S. government recently restored Mythos to roughly 100 critical-infrastructure organizations after a suspension, reported by CNBC , while GPT-5.6 is in a similar government-gated preview. For a side-by-side on how a harnessed platform compares to a frontier model, see MindFort vs Mythos.
Why is GPT-5.6 restricted to government-approved partners?
This is the first GPT launch gated by the U.S. government. OpenAI is starting with a limited preview for a small group of trusted partners whose participation was shared with the government, citing the model's step change in capability, as covered by The Hacker News . The trigger is a June 2026 executive order directing a framework to designate "covered frontier models" with advanced cyber capabilities.
OpenAI says it does not want government pre-clearance to become the default and expects broad availability in the coming weeks. The practical takeaway is the same as it was with GPT-5.5: the most capable cyber model you can use is the one your organization gets approved for.
What safeguards did OpenAI add to GPT-5.6?
GPT-5.6 ships with OpenAI's most layered safety stack to date: model-level refusals, real-time misuse classifiers that can pause generation for a larger model to review, account-level review across conversations, and differentiated access. OpenAI says it dedicated over 700,000 A100-equivalent GPU hours to automated red teaming aimed at finding universal jailbreaks, per the announcement .
For legitimate defenders, this creates friction. OpenAI warns that during the preview, requests may be blocked, refused, or paused for review, especially in dual-use areas where defensive and offensive work look similar early on. Exploit reproduction, payload crafting for sanctioned engagements, and adversary emulation are exactly the workflows most likely to hit that wall.
How can I use GPT-5.6 for cybersecurity?
Right now, access is the gating factor. During the preview, GPT-5.6 is available only through the API and Codex to a select group of government-approved partners, with broad ChatGPT and API availability planned for the coming weeks, per OpenAI . Once you have access, OpenAI explicitly supports code review, vulnerability research, patch development, debugging, security education, and defensive testing, while blocking offensive use.
Use it as a research assistant, not an autonomous operator, and keep scope tight. Agentic coding evaluations found GPT-5.6 has a greater tendency than GPT-5.5 to go beyond the user's intent, including taking actions the user did not request, per the preview system card . That is manageable for ad hoc analysis, but for anything pointed at production you need exploit validation, scope enforcement, and human-reviewable change control wrapped around the model, which is the harness MindFort provides.
What does this mean for your application security program?
The threat side is not waiting. The 2026 IBM X-Force Threat Intelligence Index reported a 44 percent year-over-year rise in attacks on public-facing applications tied to AI-enabled vulnerability discovery, and CrowdStrike cited an 89 percent jump in attacks by AI-enabled adversaries. Each release narrows the gap between model-assisted testing and skilled human pentesters, and GPT-5.6 is the closest yet at the cheapest token cost yet. But the model you can call from an API is not the model doing the most capable offensive work, because on its own GPT-5.6 finds bugs and primitives but cannot chain them into a working exploit against a hardened target.
That is the gap MindFort was built to close. MindFort runs on MF-1, a custom LLM purpose-built for offensive security reasoning inside our own autonomous agent harness, handling reconnaissance, exploit development, runtime validation, and patching as one continuous loop. Our agents probe your apps, APIs, and infrastructure the way an attacker would, validate every exploit in an isolated environment before reporting it, and deliver each finding as a merge-ready GitHub PR with a threat model attached. We call the category AXR (Autonomous Exploitation and Remediation), and unlike GPT-5.6, it is available to deploy against your stack today, not gated behind a government preview. For the full picture, see our 2026 AI Pentesting Buyer's Guide.
FAQ
What can GPT-5.6 do for cybersecurity?
GPT-5.6 is built for long-horizon agentic work, the multi-step tool use that offensive testing requires. On OpenAI's own benchmarks, Sol saturates the hardest internal CTF set at 96.7%, matches Anthropic's Mythos Preview on exploit-primitive work at roughly a third of the token cost, and posts modest gains on real-world web-app exploitation, but still cannot chain a full exploit on a hardened target.
Is GPT-5.6 good at finding real vulnerabilities?
Yes. Against widely deployed hardened software, GPT-5.6 Sol produced credible memory safety leads, some capable of leading to disclosure, mutation, or control flow corruption. OpenAI's read is that substantial parts of real-world vulnerability research are becoming automatable when models are paired with tool use, build systems, and verification infrastructure, which is exactly what a pentesting agent harness provides.
Can GPT-5.6 write zero-day exploits?
Not on its own. In evaluations against Chromium and Firefox, GPT-5.6 Sol identified bugs and exploitation primitives but did not autonomously produce a functional full-chain exploit under the conditions tested. That is why it sits at High and not Critical under OpenAI's Preparedness Framework: it is a strong research assistant, not an autonomous attacker, at least not yet.
Is GPT-5.6 better than Mythos?
On efficiency it has a clear edge, and on raw capability it is roughly even. OpenAI reports Sol matches Mythos Preview on ExploitBench while spending about one-third of the output tokens, and earlier independent testing from the UK AI Security Institute placed GPT-5.5 and Mythos at near-parity. The bigger difference is access: both are in government-gated previews.
Why is GPT-5.6 restricted to government-approved partners?
This is the first GPT launch gated by the U.S. government. OpenAI started with a limited preview for trusted partners whose participation was shared with the government, citing the model's step change in capability. The trigger is a June 2026 executive order directing a framework to designate covered frontier models with advanced cyber capabilities. OpenAI expects broad availability in the coming weeks.
How can I use GPT-5.6 for cybersecurity?
During the preview, access is the gating factor: GPT-5.6 is available only through the API and Codex to government-approved partners, with broad availability planned soon. OpenAI supports code review, vulnerability research, patch development, debugging, security education, and defensive testing, while blocking offensive use. Use it as a research assistant, not an autonomous operator, and keep scope tight.
About the author
Brandon Veiseh
Co-Founder & CEO · MindFort
Founded his first startup building NLP models for network packet inspection. Led product at ProjectDiscovery, built their enterprise platform from scratch. At NetSPI, led development of AI tools for offensive security.