OpenAI launched GPT-5.6-Cyber on August 10, 2026, through its expanded Daybreak cybersecurity program and published the announcement on August 11. The model is a fine-tuned version of GPT-5.6 Sol, specifically trained to improve performance on advanced cybersecurity tasks including zero-day vulnerability discovery, exploit chain development, authentication bypass research, and privilege escalation. Access requires identity verification, hardware security key enrollment from September 1, 2026, legal attestations about intended use, and placement in the Daybreak Red tier of the program. Daybreak Blue, the lower tier, gives approved defenders access to standard models with defensive-focused safety adjustments for tasks including secure code review, malware analysis, and incident response. OpenAI built an internal benchmark measuring model agreement rates on higher-risk dual-use security requests. GPT-5.6-Cyber completed 95 percent of those requests. The standard, fully guardrailed GPT-5.6 Sol completed 1.5 percent. Its predecessor GPT-5.5-Cyber completed 57 percent. In its announcement, OpenAI disclosed two real-world findings produced by the model. The first is CVE-2026-15903, a high-severity vulnerability in Chrome's V8 JavaScript engine where the optimizing compiler incorrectly skipped a safety check during integer-to-value conversion, allowing an array index to be treated as in-bounds when it is not, enabling out-of-bounds memory access inside Chrome's sandbox. GPT-5.6-Cyber found this flaw and also found the second vulnerability necessary to escape the V8 heap sandbox, completing a full two-step code execution chain. Both were disclosed to Google through coordinated disclosure and are now patched. OpenAI also disclosed the model identified five vulnerabilities in a major mobile operating system including a privilege escalation chain from untrusted applications, three critical remote code execution issues in a widely used database, and over 400 privilege-escalation flaws in a popular OS kernel. OpenAI rated GPT-5.6-Cyber as High under its Preparedness Framework, below the Critical threshold, and confirmed the model was not involved in the prior Hugging Face security incident.

Gareth Heyes of PortSwigger Web Security Academy presented three webmail injection attack chains at Black Hat USA 2026, each targeting a different combination of webmail providers and browser environments. All three steal live authentication tokens from active user sessions without installing any software on the victim's machine. The first chain targets Outlook Web Access combined with the Firefox browser. It exploits a CSS mutation bug in how Firefox parses and normalizes certain CSS syntax to spoof a convincing Microsoft sign-in screen inside the victim's browser, capturing the password the user types into what appears to be a legitimate prompt. The second chain targets Yahoo Mail and AOL Mail and uses a paste race technique: the attacker crafts a payload that activates when a user pastes content into a message compose window, racing a malicious clipboard write against the paste event to inject attacker-controlled content into the email body. This chain can expose a Medium email-login token and allow the attacker to sign in as the victim. The third chain targets Gmail combined with Claude Code, referred to by Heyes as Cowork in the presentation. It uses prompt injection delivered through content the victim's browser renders to steal a Slack authentication token from the active session, requiring some user interaction but no installed software. All three chains were part of a coordinated disclosure process. Fastmail fixed two of the CSS mutation bugs before the presentation. The Proton Mail proxy bypass that Heyes documented stopped working before re-testing. Public proofs of concept for the remaining chains were available as of August 8. The researcher described the work as proof-of-concept research with no confirmed malicious exploitation at the time of the Black Hat presentation.