GPT-5.6 (Sol, Terra, and Luna) is OpenAI's most capable model family yet for cybersecurity, and the first it rates High capability in both cyber and bio. It finds real vulnerabilities and exploit primitives faster and cheaper than any prior GPT, but cannot autonomously build end-to-end exploit chains against hardened targets, and launches gated to government-approved partners.
OpenAI previewed GPT-5.6 on June 26, 2026 as three models: Sol, the flagship, Terra, a balanced everyday model, and Luna, a fast and low-cost tier. All three are rated High cybersecurity capability under OpenAI's Preparedness Framework, the strongest cyber rating any GPT family has carried at launch. So how good is it for real security work, how do you actually use it, and how does it stack up against Mythos? We pulled the announcement, the preview system card, the third-party benchmarks, and the access fine print to find out.
What can GPT-5.6 do for cybersecurity?
GPT-5.6 is built for long-horizon agentic work, the kind of multi-step tool use that offensive security testing actually requires. On OpenAI's own cyber benchmarks, Sol clears the offensive-capability tasks decisively but stalls at the hardest end-to-end bar, per the GPT-5.6 preview system card :
| Cyber benchmark | What it measures | GPT-5.6 Sol result |
|---|---|---|
| Internal CTF (hardest curated set) | Professional-level vulnerability ID and exploitation | 96.7%, saturating the eval and above GPT-5.5 |
| ExploitBench | Building exploit primitives from known JS-engine bugs | Matches Mythos Preview using ~1/3 the output tokens |
| CVE-Bench (pass@1) | Consistent real-world web-app exploitation | Slightly above prior generations |
| VulnLMP (Critical threshold) | End-to-end exploits in hardened, widely deployed software | No functional critical-severity exploit produced |
These are OpenAI's own evaluations, so read them as a vendor benchmark, but the shape is clear: GPT-5.6 saturates the offensive tasks that earlier GPTs found hard, matches Anthropic's Mythos Preview on exploit-primitive work at roughly a third of the token cost, and still cannot chain a full exploit on a hardened target. The efficiency gain is real too, with Terra matching GPT-5.5 performance at half the price, per OpenAI . It is a meaningful step over how we sized up GPT-5.5 .
Is GPT-5.6 good at finding real vulnerabilities?
Yes, and OpenAI's own framework testing shows where the gains land. Run against widely deployed hardened software using VulnLMP, OpenAI's internal end-to-end exploit framework, GPT-5.6 Sol produced credible memory safety leads, some capable of leading to disclosure, mutation, or control flow corruption, as reported by The Hacker News . OpenAI's read is that substantial parts of real-world vulnerability research are becoming automatable when models are paired with tool use, build systems, and verification infrastructure.
That last clause is the whole point. The same pattern held for prior models: XBOW documented that scaffolding GPT-5 inside an autonomous agent more than doubled its performance versus running it alone, and its miss-rate benchmark fell from 40 percent on GPT-5 to 10 percent on GPT-5.5, per XBOW . Raw model scores consistently understate what these models do once wrapped in a real pentesting agent, which is exactly the architecture MindFort is built around .
Can GPT-5.6 write zero-day exploits?
Not on its own, and OpenAI is explicit about it. In evaluations against Chromium and Firefox, GPT-5.6 Sol identified bugs and exploitation primitives, the building blocks of an exploit, but it did not autonomously produce a functional full-chain exploit under the conditions tested, according to OpenAI .
That is why it sits at High and not Critical under the Preparedness Framework . OpenAI's own summary in the GPT-5.6 preview system card is that the model is better at finding and fixing vulnerabilities than at exploiting them in real attacks. It is a strong research assistant, not an autonomous attacker, at least not yet.
Is GPT-5.6 better than Mythos?
On efficiency it has a clear edge, and on raw capability it is roughly even. On ExploitBench, OpenAI reports that Sol matches Mythos Preview while spending only about one-third of the output tokens, per the announcement . On the offensive side it also saturates OpenAI's hardest internal CTF set at 96.7 percent, above GPT-5.5, per the system card . Those are OpenAI's own numbers, and independent testing from the UK AI Security Institute earlier placed GPT-5.5 and Mythos at near-parity within the margin of error, per AISI , with neither family crossing Critical.
The bigger difference is access, not capability. The U.S. government recently restored Mythos to roughly 100 critical-infrastructure organizations after a suspension, reported by CNBC , while GPT-5.6 is in a similar government-gated preview. For a side-by-side on how a harnessed platform compares to a frontier model, see MindFort vs Mythos .
Why is GPT-5.6 restricted to government-approved partners?
This is the first GPT launch gated by the U.S. government. OpenAI is starting with a limited preview for a small group of trusted partners whose participation was shared with the government, citing the model's step change in capability, as covered by The Hacker News . The trigger is a June 2026 executive order directing a framework to designate "covered frontier models" with advanced cyber capabilities.
OpenAI says it does not want government pre-clearance to become the default and expects broad availability in the coming weeks. The practical takeaway is the same as it was with GPT-5.5 : the most capable cyber model you can use is the one your organization gets approved for.
What safeguards did OpenAI add to GPT-5.6?
GPT-5.6 ships with OpenAI's most layered safety stack to date: model-level refusals, real-time misuse classifiers that can pause generation for a larger model to review, account-level review across conversations, and differentiated access. OpenAI says it dedicated over 700,000 A100-equivalent GPU hours to automated red teaming aimed at finding universal jailbreaks, per the announcement .
For legitimate defenders, this creates friction. OpenAI warns that during the preview, requests may be blocked, refused, or paused for review, especially in dual-use areas where defensive and offensive work look similar early on. Exploit reproduction, payload crafting for sanctioned engagements, and adversary emulation are exactly the workflows most likely to hit that wall.
How can I use GPT-5.6 for cybersecurity?
Right now, access is the gating factor. During the preview, GPT-5.6 is available only through the API and Codex to a select group of government-approved partners, with broad ChatGPT and API availability planned for the coming weeks, per OpenAI . Once you have access, OpenAI explicitly supports code review, vulnerability research, patch development, debugging, security education, and defensive testing, while blocking offensive use.
Use it as a research assistant, not an autonomous operator, and keep scope tight. Agentic coding evaluations found GPT-5.6 has a greater tendency than GPT-5.5 to go beyond the user's intent, including taking actions the user did not request, per the preview system card . That is manageable for ad hoc analysis, but for anything pointed at production you need exploit validation, scope enforcement, and human-reviewable change control wrapped around the model, which is the harness MindFort provides .
What does this mean for your application security program?
The threat side is not waiting. The 2026 IBM X-Force Threat Intelligence Index reported a 44 percent year-over-year rise in attacks on public-facing applications tied to AI-enabled vulnerability discovery, and CrowdStrike cited an 89 percent jump in attacks by AI-enabled adversaries. Each release narrows the gap between model-assisted testing and skilled human pentesters, and GPT-5.6 is the closest yet at the cheapest token cost yet. But the model you can call from an API is not the model doing the most capable offensive work, because on its own GPT-5.6 finds bugs and primitives but cannot chain them into a working exploit against a hardened target.
That is the gap MindFort was built to close. MindFort runs on MF-1, a custom LLM purpose-built for offensive security reasoning inside our own autonomous agent harness, handling reconnaissance, exploit development, runtime validation, and patching as one continuous loop. Our agents probe your apps, APIs, and infrastructure the way an attacker would, validate every exploit in an isolated environment before reporting it, and deliver each finding as a merge-ready GitHub PR with a threat model attached. We call the category AXR (Autonomous Exploitation and Remediation), and unlike GPT-5.6, it is available to deploy against your stack today , not gated behind a government preview. For the full landscape, see our 2026 AI Pentesting Buyer's Guide .
About the author
Brandon Veiseh
Co-Founder & CEO Founded his first startup building NLP models for network packet inspection. Led product at ProjectDiscovery, built their enterprise platform from scratch. At NetSPI, led development of AI tools for offensive security.