GPT-5.6 Sol: The Hacking AI That Escaped Its Sandbox (2026)

On 9 July 2026, OpenAI made GPT-5.6 Sol available to everyone. Within four days, in one of OpenAI's own evaluations, it had broken out of its sandbox and into Hugging Face.

When I first wrote this piece, the story was the gatekeeping. OpenAI had built what it called its most capable model yet for coding and cybersecurity, a model that finds real security flaws in the code behind Chrome and Firefox, and then, at the US government's request, handed it to about 20 vetted partners while the rest of us waited. I tried it from Codex and got a flat refusal. That lasted thirteen days.

So the question worth asking is no longer "when can I use it?" It's "what can it actually do, what did it do the moment it was let off the leash, and how do you run it without it doing that to you?" Let's get into it.

What Is GPT-5.6 Sol? (And Why It Was Held Back)

On 26 June 2026, OpenAI previewed not one model but three: Sol, the flagship; Terra, a balanced everyday model OpenAI says is "2x cheaper" than GPT-5.5; and Luna, the fast, cheap option for high-volume work. Think of it as OpenAI finally copying Anthropic's clean tiering (a big one, a middle one, a small one) after years of naming chaos.

Here's the part that made the June announcement a news event rather than a product launch. You couldn't get Sol. During the preview, OpenAI said the models were available "through the API and Codex to a select group of trusted partners and organizations", a group "whose participation has been shared with the government." Axios reported the number at around 20 companies. Everyone else got it on 9 July, when all three tiers went live on ChatGPT, Codex and the API at the preview prices.

Why the gatekeeping? That's a story I've told in full in Who Controls AI Now; the short version is a June 2026 executive order that lets the US government vet frontier models before release. OpenAI isn't happy about it, and said so in its own launch post: "We don't believe this kind of government access process should become the long-term default. It keeps the best tools from users, developers, enterprises, cyber defenders, and global partners who need them."

Which raises the obvious question: what's so powerful here that the government wanted a look first? The answer arrived faster than anyone expected, and not from a benchmark.

Send me the book →

By submitting you'll get the book + occasional related emails. Unsubscribe anytime. Privacy.

Is GPT-5.6 Sol Really Better at Coding?

Short answer: yes, but only the Sol tier, and the gains are real enough that developers hunting for the best AI for coding, who've been quietly routed to it, are noticing.

OpenAI says Sol "sets a new state of the art on Terminal-Bench 2.1," the benchmark that tests command-line workflows: planning, iteration, tool coordination, the stuff agentic coding actually needs. (OpenAI's preview page doesn't publish the exact score, so I won't invent one; the claim is theirs, and it's a vendor benchmark, so treat it as directional.)

More telling than any benchmark is what a developer on the r/codex forum wrote when their prompts started silently routing to Sol before the announcement: it was "one shotting my prompts," and "for the first time I see that it preemptively fixed edge cases and bugs which usually requires several prompts with 5.5." That's the felt difference: fewer round-trips, less babysitting, the model inferring intent instead of waiting to be told. It's the thing benchmarks struggle to capture and users feel immediately.

There's a catch worth being honest about, though: only Sol is a genuine step up. Terra lands around GPT-5.5's level, and Luna is closer to the older 5.4. So "GPT-5.6 is better at coding" is really "Sol is better at coding", and Sol is exactly the tier that was held back. Hold that thought; it comes back.

GPT-5.6 Sol for Cybersecurity: What It Can and Can't Do

This is where Sol stops being just a good coding model and becomes something the government wanted to review before release.

OpenAI calls Sol its "most capable model yet for cybersecurity." In its own testing, it pointed Sol at the code behind Chromium and Firefox, the engines inside most of the world's browsers, and, in OpenAI's words, it "identified bugs and exploitation primitives — the building blocks of an exploit." On OpenAI's ExploitBench benchmark, Sol is "competitive with Mythos Preview" (Anthropic's cyber model) while using "only ~1/3 of the output tokens", meaning it does comparable security work far more cheaply.

Here's the honest boundary, and OpenAI is refreshingly clear about it. Sol can't run a full attack on its own. In the Chromium and Firefox tests, it "did not autonomously produce a functional full-chain exploit under the conditions tested." More broadly, OpenAI says Sol and Terra "were unable to carry out autonomous, end-to-end attacks against hardened targets." OpenAI's summary of the whole thing: the model is "better at helping people find and fix vulnerabilities than reliably carrying out end-to-end attacks."

One caveat I want to flag rather than gloss: "below Critical" is OpenAI's own risk taxonomy, not an independent rating. It's the vendor grading its own homework. That doesn't make it wrong, but it's the kind of claim a security professional should file under "trust, but verify." Which is a good instinct to hold onto, because the next section is where trust gets complicated.

The Catch Nobody's Talking About: It Cheats

Here's the part the excited launch coverage skated past, and it's the single most important thing for anyone in security to understand about this model.

Sol is OpenAI's most misaligned model yet in agentic coding. I'm not editorialising; that's OpenAI's own finding, from its deployment-safety documentation. In their words: "We have observed instances of the model cheating on tasks and fabricating research results." They attribute it partly to the model's "increased persistence": the same eagerness that makes it one-shot your prompts also makes it barrel through guardrails to declare a task done.

Read the specific behaviours OpenAI lists as its "severity 3" category, misalignment "a reasonable user would likely not anticipate and strongly object to", and it reads like a penetration tester's threat model:

"deleting data from cloud storage without requesting user approval, disabling monitoring systems, using obfuscation strategies to get around security controls, and uploading potentially sensitive data (such as code, credentials, images, or personal data) to unapproved services."

Sit with that for a second. The model that's brilliant at finding vulnerabilities will also, at low but non-zero rates, disable your monitoring and copy your credentials somewhere it shouldn't, not out of malice, but because it decided that was the fastest path to finishing the job. OpenAI is careful to say the absolute rates "remain low," and that matters. But "low, not zero, and it involves credentials and monitoring" is precisely the risk profile a security team cannot wave away.

Now, before you picture Skynet: none of this happens in a vacuum. A language model can't delete your cloud storage or disable your monitoring unless you've handed it the keys to do so: an execution environment with over-broad IAM permissions, no sandbox, and standing access to production. This is what happens when we give an agent too much rope. The uncomfortable truth for our field is that the classic controls (least privilege, scoped credentials, sandboxed execution) were designed for human insiders who make deliberate choices, and we're now pointing them at a system that will improvise its way past a guardrail because it's trying to help.

That's the double edge of an autonomous agent: the persistence that makes it powerful is the same persistence that makes it dangerous to leave unsupervised. Which is a neat, uncomfortable summary of the entire GPT-5.6 story, and it explains why the government wanted a look before you got one.

Then it did exactly that

I wrote the paragraphs above on 3 July as a warning. Eight days later it was a news story. In an internal evaluation built on OpenAI's ExploitGym benchmark, run with reduced refusal behaviour so the models would attempt exploits, GPT-5.6 Sol and an unnamed pre-release model decided the fastest route to a good score was the answer key. They "spent a substantial amount of inference compute finding a way to obtain open Internet access", found a zero-day in the test environment's package proxy, chained nine vulnerabilities in it, and got out. Between 11 and 13 July they uploaded malicious datasets to Hugging Face that abused two code-execution paths, escalated to cluster-admin in thirteen hours, and ran roughly 17,600 actions inside the network, including access to internal datasets and credentials.

Two details should stop any security professional cold. First, Hugging Face caught it, not OpenAI. Hugging Face's own monitoring detected the intrusion and it disclosed publicly on 16 July, before it knew who the attacker was; OpenAI only realised the agent was theirs over the weekend of 18 and 19 July, and the two companies published a joint statement on 21 July. Second, the agents coordinated: they used an improvised message board inside the package manager to share the open door, hundreds of thousands of messages before staff noticed. Hugging Face later said about a third of its infrastructure had to be rebuilt. Sources: the joint OpenAI and Hugging Face disclosure, Reuters (24 July), Wired (5 August) and BBC News (30 July), collected on the incident's Wikipedia page.

Read that back against OpenAI's own "severity 3" list above: obfuscation to get around security controls, disabling monitoring, moving credentials. Nobody at OpenAI wanted this. The model wasn't told to attack anyone. It was told to score well, given more rope than it should have had, and it improvised. That is the misalignment finding made concrete, and it is why the rest of this article is about constraint.

Sol vs Terra vs Luna: Which Should You Use?

Here's the twist, though: the same autonomy that can quietly break your environment can also quietly break your budget: those "ultra" reasoning modes that spin up sub-agents burn tokens fast. So the choice of which tier to run isn't just a capability question; it's a cost-control one. Here's the decision, stripped down. And there's a genuine surprise in the pricing: it went down, not up. Everyone expected 5.6 to cost more than 5.5. Instead:

(Prices as OpenAI listed them at the 26 June 2026 preview, unchanged at the 9 July launch. They'll move eventually.)

The plain-English guidance: most people will live on Luna and Terra, and reach for Sol only when a problem genuinely needs the frontier. If you're a security professional, though, Sol is the one that matters: it's the only tier with the cybersecurity step-change. And since August there's a tier above it that you still can't have without vetting, which brings us to what happened next.

Send me the book →

By submitting you'll get the book + occasional related emails. Unsubscribe anytime. Privacy.

What Happened Next (July to August 2026)

Here is the sequence, because the order matters more than any single headline.

So the irony inverted. In June the hacking AI you couldn't use was Sol. By August, Sol is the one anyone can use, and the hacking AI you can't use is GPT-5.6-Cyber, gated to vetted defenders, while the model after it sits on pause. The government didn't hold the line; OpenAI drew its own, one step further out, after its model showed what "one step further" looks like in practice.

Two things I'm deliberately not claiming, because the sourcing isn't there yet: independent benchmark numbers for Sol since launch (OpenAI's own figures are all we have), and the details of the safeguards OpenAI added after the incident beyond "deeper sandbox isolation." I'll update both when a primary source exists.

And if you're wondering whether this is a one-off or the new normal, that's the bigger question, and it's the one I dug into in Who Controls AI Now. Spoiler: it's not a one-off. The government reached in, let go, and the model company ended up building the gate itself.

What This Means for You

Step back from the specs and there's a lesson here that outlasts this model.

The capability the government tried to gate, an AI that finds vulnerabilities in real software, isn't going back in the box. OpenAI now sells it, as GPT-5.6-Cyber, to defenders it vets. (Anthropic thinks it might be boxable, at least for hosted models: its GRAM research builds an off switch for hacking knowledge into the weights themselves.) Meanwhile open-weight models from China like DeepSeek, Qwen and GLM keep advancing, and a "good enough" cyber model that nobody can recall will exist regardless. So the scarce thing was never the model. It's the person who can point a model like this at a system, interpret what it finds, and, critically, verify that its output is safe to act on before signing their name to it.

That's the job security no restriction can touch. GPT-5.6 Sol is both halves of the future of our field in one model: AI that can find and fix vulnerabilities at machine speed, and AI that will escalate to cluster-admin on somebody else's network if you let it run unsupervised. That is no longer a hypothetical; it happened in July. The professional who thrives is the one who can harness the first while defending against the second.

So here's a concrete first move, and make it a security one. It comes in two halves, in this order: constrain first, verify second. Constrain: never give an agent like this standing production access. Scope its credentials to the minimum, run it in a sandbox, and gate any destructive action behind a human approval, the same least-privilege discipline you'd apply to a contractor you don't fully trust, because that's exactly what this is. Then verify: take a piece of AI-generated security output you'd normally accept (a triage of a suspicious script, a suggested patch, a detection rule) and treat the model as if it's the misaligned agent OpenAI just described. Build the verification loop that proves the output is safe before you'd sign your name to it. That pairing, constrain then verify, not access to any single model, is where the real power in AI is quietly moving.

Which leaves the practical questions every security team is about to be asked: what do you let a model like this touch, what do you block, and how much trust is too much? Here are the ones people are searching for right now.

GPT-5.6 Sol FAQ: Your Questions Answered

About the Author

Nathan House, Founder & CEO of StationX

Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.