Two Models From the Same Base Scored 1.5% and 95% on the Same Test | Edition 310

In partnership with

Wispr Flow turns your voice into clean, ready-to-send writing — speak naturally, it strips the filler and fixes the punctuation. I've used it daily since February 2026 to build this newsletter. Read the full review →

On 10 August, OpenAI shipped a model whose headline feature is that it says no less often. It is called GPT-5.6-Cyber.

On OpenAI's internal Advanced Cybersecurity Completion Rate benchmark it completes 95.0% of the tasks put to it. The standard GPT-5.6 Sol that everyone else can reach completes 1.5% of the same tasks. Both are built on the same base model — and that is the part worth sitting with. This is not really a story about hacking.

Daybreak was already OpenAI's cybersecurity program. What changed is that it now has two tiers, and they lead to different models.

Daybreak Blue is the entry point, and OpenAI recommends it for most defenders. You get GPT-5.6 Sol with its guardrails loosened for defensive work, so it stops bailing out on the things security teams do all day: analysing malware, reviewing code you already know is vulnerable, working an incident, validating that a patch actually closed the hole.

Daybreak Red is the serious tier, and the only route to GPT-5.6-Cyber. That model was trained for offensive work: finding zero-days — vulnerabilities nobody has discovered or patched yet — building the exploit chains that turn a bug into real access, and validating that an attack lands. Under OpenAI's own Preparedness Framework it is rated High for cybersecurity capability, one step below the Critical threshold. Red is applied for, not bought: identity verification, ongoing monitoring, and legal declarations about what the access is for.

Get revenue agents, workflows, and automations across every stage of your motion. Access customer data in real time through Attio's web app, MCP, API, and SDK.

Then Ask Attio anything about your business and get instant answers.

It's the CRM that runs the work behind every win.

Try Attio Now

Same benchmark, same tasks, four models:

Look at the first two lines. Loosening Sol's guardrails for defensive work moved it half a percentage point. The jump to 95.0% is a genuinely different thing, and it would be sloppy to call it purely a policy dial — OpenAI says GPT-5.6-Cyber was specifically trained for these tasks, so real capability work went into it.

But look at what the metric is. A completion rate counts whether the model produced an answer at all. A model that refuses scores zero no matter how much it knows. So 1.5% does not mean Sol cannot do this work. It means Sol almost never agrees to.

One caveat that belongs here rather than in a footnote: this is OpenAI's own internal benchmark, unaudited by anyone outside the company. Take the ordering seriously and the decimal places less so.

Benchmarks are arguable. A patched CVE is not.

Before the announcement, OpenAI pointed GPT-5.6-Cyber at V8, the JavaScript engine inside Google Chrome and one of the most heavily audited pieces of software on earth. It found two previously unknown vulnerabilities that chain together to corrupt memory and escape V8's heap sandbox — the barrier meant to stop a malicious web page reaching the rest of your machine.

Google shipped the fix in mid-July. One of the pair is now CVE-2026-15903, rated 8.8 on the CVSS severity scale: V8's optimising compiler skipped a safety check during an integer conversion, producing an out-of-bounds array index an attacker could read or write memory through.

OpenAI credits the same model with at least five vulnerabilities in an unnamed mobile operating system, three critical flaws in a widely used database, and more than 400 privilege-escalation issues in a widely used OS kernel. Four hundred is not a research finding. Four hundred is an inventory.

You are not applying for Daybreak Red. Almost nobody is. But OpenAI just published something the rest of us normally only guess at.

A refusal is a setting, not a verdict. When an assistant says it cannot help, the accurate translation is almost never this is beyond me. It is this is not permitted on this account, at this tier, in this context. Most people read a refusal as a statement about the technology's limits. It is usually a statement about the vendor's risk appetite, and the gap between 1.5% and 95% is the size of that misunderstanding.

Capability is being unbundled from access. The interesting product here is not the model, it is the vetting. Same system underneath, four different behaviours, and paperwork decides which one you get. Expect that pattern well outside security — legal, medical and financial tools are heading the same way.

The practical version: stop treating an AI refusal as a judgement about difficulty. It is a judgement about permission. Sometimes the fix is a different tool, sometimes a different plan, and very often it is just supplying the legitimate context the model was missing. Knowing which of the three you hit is the actual skill.

The site version adds the full access-and-vetting breakdown, a proof table of all four benchmark figures, an interactive that lets you compare the models yourself, and this edition's copy-paste prompt — The Refusal Decoder, which interviews you about a refusal you actually hit and tells you which of the three it was. OpenAI's own write-up is here if you want the primary source.