On 7 May 2026, OpenAI announced GPT-5.5-Cyber. The release separated ordinary GPT-5.5 access from a more capable cyber configuration available through identity and organisational verification.
This release brief was checked against first-party material on 10 August 2026. The date above is the public announcement date, not the date a repository was created or a third-party provider added the model. Where access or weights arrived later, that distinction is recorded below.
Release record
| Field | Verified detail |
|---|---|
| Announcement | 7 May 2026 |
| Availability or weight release | 7 May 2026 through OpenAI Daybreak Trusted Access |
| Release type | restricted cybersecurity model and access programme expansion |
| Access | verified individuals and approved organisations; not general open weights |
| Architecture | a cyber-specialised GPT-5.5 deployment with stronger safeguards and monitoring |
| Maximum stated context | the GPT-5.5 family context limit stated in OpenAI platform documentation |
What changed
The announcement treated access control as part of the model release rather than an afterthought. OpenAI reported a substantial rise in end-to-end vulnerability exploitation capability and paired that gain with stronger account security, monitoring and jurisdictional restrictions. For defenders, the relevant product is therefore the model-plus-access-system: evaluation must include whether legitimate security work reaches the stronger path and whether high-risk activity is detected without turning routine defensive tasks into dead ends.
The practical comparison is therefore not simply whether GPT-5.5-Cyber has the largest headline score. Teams need to ask whether its architecture, access terms, latency, tool behaviour and evaluation setup match the workload they actually intend to run. A model can lead one harness while losing on cost, refusal behaviour, multilingual quality or repeatability in another.
Benchmarks worth retaining
| Evaluation | Reported result | How to read it |
|---|---|---|
| ExploitBench | 47.9% for GPT-5.5 at the comparison budget | Release-time end-to-end exploit baseline later used for GPT-5.6 comparison |
| ExploitGym | 15.1% peak pass rate for GPT-5.5 | Real-world vulnerability exploitation under a two-hour cap |
| Trusted-access gate | identity or organisation verification required | An operational control, not a capability score |
These are release-time results, not independently reproduced guarantees. OpenAI’s cyber evaluations use controlled vulnerable targets and programme-specific access conditions, so they do not measure autonomous compromise of hardened production systems. Scores should remain attached to the disclosed effort setting, agent harness, tool access, timeout, context-management policy and judge model. Moving a number into a procurement sheet without those conditions creates false comparability.
Architecture and access
GPT-5.5-Cyber is described as a cyber-specialised GPT-5.5 deployment with stronger safeguards and monitoring with the GPT-5.5 family context limit stated in OpenAI platform documentation of stated context. Its access position at verification time is verified individuals and approved organisations; not general open weights. That wording matters: open weights, source-available weights, an API, a product preview and a research demonstration give adopters very different rights and different levels of reproducibility.
Before deployment, record the exact model identifier or checkpoint, inference stack, quantisation, reasoning setting, region, price schedule and supplier terms. If the release uses a custom licence, read the licence itself rather than relying on the word “open” in launch copy. If it is API-only, preserve the dated documentation and change-notice route because the served snapshot can change without a downloadable artefact.
What an evaluation should test next
For GPT-5.5-Cyber, a credible internal gate should include:
- a frozen set of representative tasks with pass, fail and abstain criteria;
- a matched baseline using the same tools, timeout, prompt budget and reviewer rubric;
- repeated runs to expose variance rather than reporting a single best attempt;
- latency, token use and total task cost alongside task success;
- adversarial, multilingual and long-context cases relevant to the real deployment; and
- rollback evidence showing the previous model can be restored safely.
The wider model change-control guide explains how to keep model, prompt, tool and corpus changes reconstructable. The AI dependency inventory guide covers the release and supplier records needed after deployment.
AIEngine verdict
This was a major capability-and-governance release even though it was not a new downloadable checkpoint. Security teams should test it as a restricted operational service, with explicit authorization boundaries and evidence that sensitive outputs remain inside the approved workflow.
This is a launch assessment, not a certification. Benchmark leadership is useful evidence of where to test; it is not authorization to place the model in a high-impact workflow without domain evaluation, security review and an accountable owner.
Primary sources
Image provenance
Hero image: OpenAI official release artwork. The locally served WebP is a crop of the first-party release or model-card asset recorded in the repository provenance manifest.
