GPT‑5.6 launched — but kind of didn't
- OpenAI began a limited preview of the GPT‑5.6 series on June 26, 2026, launching three models at once: flagship Sol, balanced Terra, and budget Luna.
- New naming scheme: the number marks "which generation," while Sol/Terra/Luna mark "capability tier." Terra performs close to the previous generation GPT‑5.5, at half the price.
- Capability gains concentrate in coding, biology, and cybersecurity, setting new records on benchmarks like Terminal‑Bench 2.1 — but all figures are OpenAI's own self-reported evaluations; the full evaluation suite will be published at broad launch.
- Paired with what OpenAI calls its strongest-ever safety stack: multiple layers of protection working together, backed by over 700,000 A100-equivalent GPU hours of automated red-teaming to hunt for universal jailbreaks.
- At the request of the US government, it's limited to a small set of trusted partners first (list already shared), with broader access weeks away; pricing per million tokens: Sol $5/$30, Terra $2.5/$15, Luna $1/$6.
GPT‑5.6 arrives — three at once
OpenAI opened a limited preview of the GPT‑5.6 series on June 26, 2026, launching three models at once: flagship Sol, balanced Terra, and budget Luna.
This isn't an ordinary version bump. OpenAI has bundled "a jump in model capability" together with "a government preview process": before launch, it showed its capabilities and release plan to the US government, and at the government's request, opened access first only to a small batch of trusted partners — broader rollout comes weeks later.
Why it matters: This is the first time OpenAI has tied a jump in model capability to a government preview process. Cybersecurity is this generation's key focus area; the partner list has already been shared with the government, and OpenAI has put in over 700,000 A100-equivalent GPU hours of automated red-teaming. At the same time, OpenAI states plainly that it doesn't want this kind of government-gated access to become the long-term default.
Three models, one family — how do you choose?
Three tiers within the same generation, differing in "how strong, how fast, how expensive." Click any tier below to see what it's suited for.
↓ Click a tier to see its use cases
How to Read the New Naming
In the old system, a single number covered everything — capability tier and generation were all tangled up in that one number. This time it's split into two dimensions: the number handles "generation," the name handles "capability tier," and each upgrades on its own schedule.
Where This Generation Actually Gets Stronger
The capability gains OpenAI has revealed concentrate on three areas: coding, biology, and cybersecurity. Each comes with a benchmark score.
Two New Modes: max and ultra
max is having one person think longer; ultra is pulling together a small team on the fly to work side by side.
Will It Help Build Cyberweapons? Did It Cross the Line?
With this generation's cybersecurity capability up, it's natural to worry: could it directly help someone build a cyberweapon? OpenAI's answer: it can build the "parts," but in testing, it didn't assemble a "finished product" on its own.
Exploitation primitives (vulnerability "parts") are the attack-building blocks — say, a memory out-of-bounds bug. A full‑chain exploit is those parts assembled into a ready-to-fire finished weapon. The model can build the parts, but in testing it never assembled the "gun" that's ready to pull the trigger.
In evaluations involving Chromium and Firefox, GPT‑5.6 Sol was able to find bugs and exploitation primitives, but under test conditions did not autonomously produce a usable full-chain exploit. Under OpenAI's Preparedness Framework (its own risk-preparedness framework), it was assessed as not crossing the Cyber Critical red line — that is, not reaching the threshold of "possessing critical attack capability that must trigger stronger controls."
Assessed Position
Still, a benchmark red line can't cover every real-world use once the model is combined with other tools. That uncertainty, together with the overall jump in capability, is exactly why this generation ships with stronger protections and a staged rollout.
Six Checkpoints Block Bad Requests
The so-called "strongest safety stack yet" isn't one taller wall — it's six layers of protection working together. OpenAI puts it bluntly: against a determined abuser who adapts on the fly, no single layer of protection is enough.
What's most distinctive about this generation isn't the model itself, but that "making the model stronger" and "making abuse harder" are being ramped up together: bump capability up a tier, and protection gets more layers, with the configuration tuned separately for each model's capability.
Tracing a Dangerous Request Through the System
Taking layer two, "real-time checks," from the previous section and walking through it on its own: how does "pause mid-generation, hand off to a larger model for review, block if non-compliant" actually happen for an incoming high-risk request?
The key is that the check happens "while generating": the cyber and biology classifiers watch the model's output in real time as it streams out. The moment a suspected violation shows up in a high-risk situation, generation pauses and a larger reasoning model re-reads the entire conversation and context. If the review confirms a violation, that output is withheld before it ever reaches the user.
Using AI to Defend Against AI
Protection also has to hold up against attackers who keep switching tactics. Defenses that only work against a fixed list of known attacks aren't enough for a frontier model. So this time, OpenAI has poured a huge amount of compute into "having the model find its own vulnerabilities."
A universal jailbreak isn't a key that opens just one door — it's a master key that works across many prompts and scenarios, which makes it the most dangerous, and exactly what red teams target. An A100-equivalent GPU hour is compute converted into a common unit — "how many hours on a single A100 GPU" — and 700,000 hours is roughly on the order of one card running continuously for about 80 years.
Why automated instead of purely manual? OpenAI's reasoning: having its own model hunt for weaknesses covers far more attack patterns than manual work can, catches failure patterns earlier, and shortens the path from "finding a weakness" to "patching it." Focusing on these harder, more universal attacks adds a layer of testing beyond the fixed list of known vulnerabilities.
How Human Red-Teaming and Rapid Response Fill the Gaps
Beyond automation, OpenAI also brought in third-party testers to run large-scale human expert red-teaming, which will continue through the preview. Human red-teaming fills in the creative blind spots — the abuse methods a system wouldn't anticipate, the ones only a human mind would think up.
OpenAI also admits that no evaluation can cover every product configuration, multi-step attack, or real-world workflow. So it maintains a rapid-response process: reproduce, assess, prioritize, and patch newly discovered jailbreaks, then fold them into routine evaluation so similar failures can be caught in the future.
Why the Government Sees It Before You Get to Use It
This "limited preview" isn't OpenAI's long-term intent — it's a short-term step taken at the request of the US government. Here's how the rollout path looks.
Pricing: Per Million Tokens
| Model | Input | Output | Positioning |
|---|---|---|---|
| Sol | $5 | $30 | Flagship, strongest |
| Terra | $2.5 | $15 | Balanced, everyday |
| Luna | $1 | $6 | Fastest, cheapest |
Caching is now more predictable: it supports explicit cache breakpoints (you set your own cache cut points), with a minimum cache lifetime of 30 minutes. Starting with GPT‑5.6, cache writes are billed at 1.25x the uncached input price, while cache reads continue to get a 90% discount.
One More Thing: Coming to Cerebras in July
OpenAI also plans to deploy GPT‑5.6 Sol on Cerebras in July, reaching speeds of up to 750 tokens per second. This is a future plan — initial access will be limited to select customers, expanding as capacity grows.
"We don't think this kind of government-gated access process should become the long-term default. It would keep the best tools from reaching the users, developers, companies, cyber defenders, and global partners who actually need them."OpenAI official blog, "Previewing GPT‑5.6 Sol"
Model launches evolve from "showing off capability" → to "capability and protection ramping up together"
OpenAI released three new model tiers at once — Sol/Terra/Luna — focused mainly on cybersecurity; but access starts limited to trusted partners already reported to the US government, with broader rollout weeks away.
↓ Read it in one page · includes an animated figure
GPT‑5.6 is OpenAI's newest generation of large model — the kind of AI system that chats, writes code, does analysis — and it entered preview on June 26, 2026. It can't dodge an old problem: the more capable a model gets, the more likely someone can use it for harm.
✘ But the stronger it gets, the more it could be coaxed into helping build cyberweapons or assemble dangerous bio-recipes
Capability and risk rise together; teaching the model to "refuse" during training alone can't stop a determined person who adapts on the fly.
Three tiers, all at once: flagship Sol (strongest), balanced Terra (the everyday workhorse — performance close to the previous generation, half the price), and budget Luna (fastest, cheapest). The bigger change is in "how it's named" and "how it's protected."
OpenAI keeps stressing that this generation ships with "the strongest safety stack yet." Is that just a slogan, or does it actually work — what does it look like, and can it really stop bad requests?
Some worry: with stronger cybersecurity capability, could it directly help someone build a cyberweapon? OpenAI's answer is that it can find vulnerability "parts" (like a program flaw), but in testing it never assembled those parts into a ready-to-fire, complete cyberweapon on its own — staying below its self-defined Cyber Critical danger threshold. And the so-called "strongest safety stack" isn't one taller wall — it's six layers of protection working together.
The official gains concentrate on coding, biology, and cybersecurity. "Setting a new record" doesn't mean much to ordinary people — converting it into time and money makes it clearer. Take a cybersecurity exploit test (ExploitBench): to match the top rival model Mythos's score,
Sol, Terra, Luna.
the more it could be
used for harm...
Risk ↑
can't stop someone
who adapts on the fly.
it's not just showing off!
and protection gets
more layers too.
but six checkpoints stacked up.
so stack six?
a full cyberweapon!
blocked on the spot
≈ one card running 80 years
Building weapons? Blocked.
who tested them?
it's the first time "stronger" and
"harder to abuse" shipped bound together.
going only to reported partners — weeks before it's your turn.