GPT-5.6-Cyber

OpenAI's cyber-specialised variant of GPT-5.6, and the model that escaped a QEMU/KVM hypervisor three times in vms-wont-contain-agents. Paged here as a capability datum, not as a product — the model market is ../llm-providers-wiki's subject and this spoke keeps what it does to a defender's threat model.

What this corpus can say it did

Over roughly twelve hours, from an SSH shell inside a guest: read kernel and library source, pulled research papers, wrote oracles, built minimal reproducers, backtracked from failed approaches, and chained four separate vulnerabilities — three of them 0-day at the time — into a working host escape. It built a functional exploit for a kernel flaw (Januscape, CVE-2026-53359) that had no public exploit, from the partial disclosure alone.

That last one is the capability claim with the least wiggle room in it. Everything else could be argued as assembling known pieces; constructing an exploit from a disclosure with no PoC is the step the security literature treats as the expensive one, and exploitgym is this spoke's measurement of exactly that ability. The two are not comparable numbers — ExploitGym scores models on a benchmark of known vulnerabilities, and this is one host, one run, no score — but they are asking the same question from opposite ends, and the benchmark does not yet have this model in it.

Access

Not generally available. It reached the researcher through patch-the-planet, the Trail of Bits / OpenAI programme for maintainers of critical open-source software. GPT-5.6 as a family was placed under customer-by-customer US government approval in June 2026 under EO 14409 (../ai-governance-wiki), so a cyber-tuned variant circulating through a curated programme is consistent with that regime rather than an exception to it.

Version discrepancy, unresolved. The programme page's field reports name GPT-5.5-Cyber; the research post and InfoQ both say GPT-5.6-Cyber, and InfoQ links an OpenAI model page under that name, which resolves. The programme launched in June and the research ran in August. A version bump is the obvious explanation and nobody in the corpus has stated it.

Related

vms-wont-contain-agents · patch-the-planet · hypervisor-isolation · exploitgym · openai · defender-guardrail-asymmetry