GPT-5.6-Cyber pricing, plans and limits

OpenAI measures this with an internal evaluation called the Advanced Cybersecurity Completion Rate, and on it this model completed the large majority of advanced cyber requests it was tested against, including exploit-chain development, privilege escalation, and authentication bypass, a sharp jump over both its immediate predecessor and standard GPT-5.6 Sol running with its default safeguards (see the benchmark FAQ below for the exact figures). It also posted the best result in the GPT-5.6 line on ExploitGym, the evaluation that tests turning a known vulnerability into a working, arbitrary-code-execution exploit. The gains are not uniform: OpenAI's own system card describes the improvement on CVE-Bench, a benchmark the Sol backbone already scores 97.06% on, as comparatively modest. OpenAI also reports using the model to find two chained V8 vulnerabilities in Chrome, one of which Google fixed as CVE-2026-15903.

The model carries a 400,000-token context window and a 128,000-token maximum output, with standard-rate pricing up to 272,000 input tokens, after which a higher rate applies to the whole request (see the pricing FAQ). That is enough headroom to hold a full application codebase, a long CVE writeup, or a multi-stage exploit transcript in a single session without truncation.

Input modalities are text and image; output is text only. It supports function calling, structured outputs, streaming, and prompt caching, plus a tool roster built for agentic security work: web search, file search, a code interpreter, a hosted shell, patch application, computer use, and MCP integration. Only the Responses API (v1/responses) exposes it; Chat Completions, Realtime, Assistants, Batch, and fine-tuning endpoints are all unavailable for this model, so teams integrating against those APIs elsewhere in the GPT-5.6 family need a separate integration path here.

Pricing sits well above general-purpose GPT-5.6 Sol, reflecting both the output rate and the model's narrow, gated distribution; exact per-token rates and the overage structure are detailed in the pricing FAQ below. A vulnerability triage pass reading 50,000 tokens and writing a 10,000-token report costs roughly $1.38. A full exploit-chain session that fills the standard input allowance with a 60,000-token output runs about $7.90. A day of authorized pentest work spanning 1 million input tokens and 200,000 output tokens comes to roughly $27.50.

Access runs only through OpenAI's Daybreak program, specifically the new Daybreak Red tier introduced alongside this model; the companion Daybreak Blue tier grants vetted defenders access to Sol without its default cyber guardrails, rather than to Cyber itself. Rate limits scale across five standard tiers, from 500 requests and 500,000 tokens per minute at the entry tier up to 15,000 requests and 40 million tokens per minute at the top tier. OpenAI's launch announcement names SpecterOps, SentinelOne, and Palo Alto Networks as early-access customers and does not publish a full roster. Since September 1, 2026, OpenAI requires hardware security keys for individual Daybreak accounts. Since August 11, 2026 the model is also offered through Amazon Bedrock (from Amazon Web Services) to customers already enrolled in Daybreak Access, with AWS pricing that includes a 10% fee over OpenAI's rates.

OpenAI classifies the model as High capability in cybersecurity under its Preparedness Framework, one tier below Critical; the system card states GPT-5.6 Sol and Terra "can find vulnerabilities and pieces of exploits" but were "unable to carry out autonomous, end-to-end attacks against hardened targets" in testing. The release is backed by more than 700,000 A100e GPU-hours of automated jailbreak search, an automated red-teaming model called GPT-Red, and third-party cyber capability evaluations from UK AISI and Irregular. Deployment monitoring blocks roughly ten times more activity than prior models, and Daybreak Red access itself requires identity verification, account security checks, and legal attestations before any credential is issued.

The model fits a narrow case: penetration testers, vulnerability researchers, and red teams inside vetted Daybreak Red partner organizations doing exploit validation and responsible-disclosure work under contract. It is the wrong choice for general-purpose coding or chat, where GPT-5.6 Sol or Terra cost far less and need no approval process, and it is simply unreachable for anyone outside the partner list, however legitimate the use case. It is not the best Daybreak pick for every security task either: on OpenAI's own Vulnerability Discovery and Report Writing evaluation it scored below plain GPT-5.6 Sol, which OpenAI attributes to shorter, less detailed reports, and on ExploitBench in the standard 300-turn setting Sol through Daybreak Blue solved tasks more token-efficiently and performed best. Teams doing defensive discovery work should start with Daybreak Blue.

Knowledge cutoff is February 16, 2026. The model inherits Sol's training pipeline plus additional activation classifiers focused on sensitive domains, layered under a reduced-refusal configuration reserved for vetted Daybreak Red use. OpenAI's instruction hierarchy still enforces platform- and developer-level policy checks, and API deployments can set developer-configurable confirmation policies for high-risk actions rather than relying on one fixed refusal boundary.

GPT-5.6-Cyber succeeds the previous generation of OpenAI's Cyber line and launched alongside the Daybreak Blue and Red tier split that same day, roughly a month after GPT-5.6 Sol's own general availability. How much the completion rate jumped in one model generation is why OpenAI chose to gate this variant behind a vetting program instead of shipping it broadly alongside Sol, Terra, and Luna.