OpenAI Launches GPT-5.6 and ChatGPT Work With Multi-Agent Cybersecurity Capabilities

OpenAI has launched GPT-5.6 alongside ChatGPT Work, positioning its newest flagship AI system as an agentic platform capable of completing extended, multi-step work across enterprise applications, files, web services, and desktop environments.

GPT-5.6 Sol, the flagship model, is joined by Terra and Luna tiers, while ChatGPT Work uses the new model to transform high-level objectives into finished documents, spreadsheets, slides, web applications, and security-oriented workflows.

GPT-5.6 and ChatGPT Work Capabilities

ChatGPT Work represents a shift from conversational assistance toward persistent task execution. OpenAI describes it as an agent that can gather information from connected applications and organizational workflows, break complex requests into smaller steps, and continue working on projects for hours when needed.

Built-in Codex technology enables the agent to operate across web, mobile, and desktop surfaces, allowing users to monitor its progress, answer questions, redirect work, and approve sensitive actions during execution.

For cybersecurity teams, this agentic design could streamline investigative and operational processes that normally require several tools and analysts.

A security analyst could instruct ChatGPT Work to collect vulnerability intelligence, compare it against internal asset data, generate a remediation tracker, create an executive slide deck, and prepare technical documentation while retaining context throughout the workflow.

Scheduled Tasks can also support recurring operations, such as converting new Microsoft Teams or Slack messages into updated incident documents, investigation summaries, detection reports, or remediation status sheets.

GPT-5.6 Sol introduces “ultra,” a high-capability mode that coordinates four agents in parallel by default. In selected benchmark configurations, OpenAI evaluated larger agent groups of up to 16 agents.

The multi-agent architecture can divide a difficult task into independent workstreams, such as reviewing vulnerable code, examining exploit conditions, validating a patch, analyzing logs, and preparing a final security report.

This parallelized approach is relevant to SOC teams, red teams, vulnerability management programs, and application security operations where time-to-triage and time-to-remediation are critical.

OpenAI reported major improvements in offensive-security evaluations. On ExploitBench2, which measures movement from vulnerable code analysis to arbitrary code execution, GPT-5.6 Sol recorded a 73.5% score, compared with 47.9% for GPT-5.5 at a comparable output-token budget.

The company also reported a 24.9% pass rate on ExploitGym3 within a two-hour limit, increasing to 33.7% with six hours of execution time. ExploitGym3 tests whether agents can turn real-world vulnerabilities into working exploits. On SEC-Bench Pro, a benchmark focused on proof-of-concept generation against complex software, GPT-5.6 Sol scored 71.2%, compared with 45.8% for GPT-5.5.

OpenAI states that GPT-5.6 is better at finding, reproducing, and fixing vulnerabilities than it is at autonomously executing complete attacks against hardened environments.

The company is pairing these capabilities with its Daybreak Trusted Access for Cyber program, allowing qualified and verified users to access expanded functionality for authorized vulnerability validation, malware analysis, detection engineering, secure code review, and patch validation.

Its safety stack includes trained safeguards, real-time checks, reasoning-based monitoring, account-level enforcement, and restrictions for high-risk access scenarios.

GPT-5.6 Cybersecurity & Model Feature Matrix

Dimension	GPT‑5.6 Sol	GPT‑5.6 Terra	GPT‑5.6 Luna
Role in family	Flagship, max intelligence and reasoning for complex cyber and research workloads	Balanced model for everyday coding and security tasks at lower cost	Fastest, most cost‑efficient tier for high‑volume automation and SOC use
Multi‑agent modes	Supports ultra with coordinated multi‑agent execution (4 agents by default, higher in evals such as BrowseComp and SEC‑Bench Pro)	Supports multi‑agent orchestration via API, tuned for cost–latency balance	Supports multi‑agent via API for lightweight concurrent tasks and bulk automation
Cybersecurity benchmarks	ExploitBench2: 73.5% vs GPT‑5.5’s 47.9% at similar token budget; ExploitGym3: up to 33.7% pass rate under six‑hour cap; SEC‑Bench Pro: 71.2% with improved latency	Shares ExploitBench/ExploitGym gains relative to earlier GPT‑5.x at lower cost, suitable for routine exploit analysis and secure code review	Outperforms earlier mid‑tier models on exploit and terminal benchmarks at a fraction of the cost, optimized for rapid, repetitive tasks
Defensive capabilities	Advanced secure code review, patch generation and validation, threat modeling, blue teaming, vulnerability triage and validation, malware analysis, and detection engineering via Trusted Access	Enterprise-friendly secure coding assistant, supports code scanning, remediation suggestions, log- and telemetry‑driven triage, and playbook generation	Lightweight assistant for SOC runbooks, enrichment, IOC extraction, routine log sweeps, and automation glue between tools
Safety & access controls	Strongest safeguard stack, including reasoning-based monitors, real-time checks, and account-level enforcement; deeper cyber features restricted to Trusted Access with hardware-backed passkeys and high-risk entity controls	Shares layered safeguards with Sol, tuned for broad enterprise deployment while retaining stricter controls on high-risk cyber queries	Same safety stack, with conservative defaults aimed at minimizing misuse while supporting benign operational automation
Pricing (API, per 1M tokens)	Input: $5; Output: $30; cache writes billed at 1.25x input, cache reads at 10% of uncached input	Input: $2.50; Output: $15; same cache pricing model as Sol	Input: $1; Output: $6; same cache pricing model as Sol and Terra

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN