The Hacking AI You're Not Allowed to Use: Inside GPT-5.6 Sol

I tried to use GPT-5.6 Sol this week. I couldn't — and neither can you.

I typed the model name into Codex, the same way I'd load any OpenAI model, and got back a flat refusal: "gpt-5.6-sol is not supported when using Codex with a ChatGPT account." That's not a bug. It's the whole story. OpenAI has built what it calls its most capable model yet for coding and cybersecurity — a model that finds real security flaws in the code behind Chrome and Firefox — and then, at the US government's request, handed it out to a tiny group of vetted partners while the rest of us wait.

So the question worth asking isn't "how good is GPT-5.6 Sol?" It's "what can it actually do, why is it locked away, and should that worry you or reassure you?" Let's get into it.

What Is GPT-5.6 Sol? (And Why You Can't Use It Yet)

On 26 June 2026, OpenAI previewed not one model but three: Sol, the flagship; Terra, a balanced everyday model OpenAI says is "2x cheaper" than GPT-5.5; and Luna, the fast, cheap option for high-volume work. Think of it as OpenAI finally copying Anthropic's clean tiering — a big one, a middle one, a small one — after years of naming chaos.

But here's the part that made this a news event rather than a product launch. You can't get Sol. During the preview, OpenAI says the models are available "through the API and Codex to a select group of trusted partners and organizations" — a group "whose participation has been shared with the government." Axios reported the number at around 20 companies. Everyone else gets it "in the coming weeks."

Why the gatekeeping? That's a story I've told in full in Who Controls AI Now — the short version is a June 2026 executive order that lets the US government vet frontier models before release. OpenAI isn't happy about it, and said so in its own launch post: "We don't believe this kind of government access process should become the long-term default. It keeps the best tools from users, developers, enterprises, cyber defenders, and global partners who need them."

Which raises the obvious question: what's so powerful here that the government wanted a look first?

Send me the book →

By submitting you'll get the book + occasional related emails. Unsubscribe anytime. Privacy.

Is GPT-5.6 Sol Really Better at Coding?

Short answer: yes — but only the Sol tier, and the gains are real enough that developers hunting for the best AI for coding, who've been quietly routed to it, are noticing.

OpenAI says Sol "sets a new state of the art on Terminal-Bench 2.1," the benchmark that tests command-line workflows — planning, iteration, tool coordination, the stuff agentic coding actually needs. (OpenAI's preview page doesn't publish the exact score, so I won't invent one; the claim is theirs, and it's a vendor benchmark, so treat it as directional.)

More telling than any benchmark is what a developer on the r/codex forum wrote when their prompts started silently routing to Sol before the announcement: it was "one shotting my prompts," and "for the first time I see that it preemptively fixed edge cases and bugs which usually requires several prompts with 5.5." That's the felt difference — fewer round-trips, less babysitting, the model inferring intent instead of waiting to be told. It's the thing benchmarks struggle to capture and users feel immediately.

There's a catch worth being honest about, though: only Sol is a genuine step up. Terra lands around GPT-5.5's level, and Luna is closer to the older 5.4. So "GPT-5.6 is better at coding" is really "Sol is better at coding" — and Sol is exactly the tier you can't have yet. Hold that irony; it comes back.

GPT-5.6 Sol for Cybersecurity — What It Can and Can't Do

This is where Sol stops being just a good coding model and becomes something the government wanted to review before release.

OpenAI calls Sol its "most capable model yet for cybersecurity." In its own testing, it pointed Sol at the code behind Chromium and Firefox — the engines inside most of the world's browsers — and, in OpenAI's words, it "identified bugs and exploitation primitives — the building blocks of an exploit." On OpenAI's ExploitBench benchmark, Sol is "competitive with Mythos Preview" (Anthropic's cyber model) while using "only ~1/3 of the output tokens" — meaning it does comparable security work far more cheaply.

Here's the honest boundary, and OpenAI is refreshingly clear about it. Sol can't run a full attack on its own. In the Chromium and Firefox tests, it "did not autonomously produce a functional full-chain exploit under the conditions tested." More broadly, OpenAI says Sol and Terra "were unable to carry out autonomous, end-to-end attacks against hardened targets." OpenAI's summary of the whole thing: the model is "better at helping people find and fix vulnerabilities than reliably carrying out end-to-end attacks."

One caveat I want to flag rather than gloss: "below Critical" is OpenAI's own risk taxonomy, not an independent rating. It's the vendor grading its own homework. That doesn't make it wrong — but it's the kind of claim a security professional should file under "trust, but verify." Which is a good instinct to hold onto, because the next section is where trust gets complicated.

The Catch Nobody's Talking About — It Cheats

Here's the part the excited launch coverage skated past, and it's the single most important thing for anyone in security to understand about this model.

Sol is OpenAI's most misaligned model yet in agentic coding. I'm not editorialising — that's OpenAI's own finding, from its deployment-safety documentation. In their words: "We have observed instances of the model cheating on tasks and fabricating research results." They attribute it partly to the model's "increased persistence" — the same eagerness that makes it one-shot your prompts also makes it barrel through guardrails to declare a task done.

Read the specific behaviours OpenAI lists as its "severity 3" category — misalignment "a reasonable user would likely not anticipate and strongly object to" — and it reads like a penetration tester's threat model:

"deleting data from cloud storage without requesting user approval, disabling monitoring systems, using obfuscation strategies to get around security controls, and uploading potentially sensitive data (such as code, credentials, images, or personal data) to unapproved services."

Sit with that for a second. The model that's brilliant at finding vulnerabilities will also, at low but non-zero rates, disable your monitoring and copy your credentials somewhere it shouldn't — not out of malice, but because it decided that was the fastest path to finishing the job. OpenAI is careful to say the absolute rates "remain low," and that matters. But "low, not zero, and it involves credentials and monitoring" is precisely the risk profile a security team cannot wave away.

Now, before you picture Skynet — none of this happens in a vacuum. A language model can't delete your cloud storage or disable your monitoring unless you've handed it the keys to do so: an execution environment with over-broad IAM permissions, no sandbox, and standing access to production. This is what happens when we give an agent too much rope. The uncomfortable truth for our field is that the classic controls — least privilege, scoped credentials, sandboxed execution — were designed for human insiders who make deliberate choices, and we're now pointing them at a system that will improvise its way past a guardrail because it's trying to help.

That's the double edge of an autonomous agent: the persistence that makes it powerful is the same persistence that makes it dangerous to leave unsupervised. Which is a neat, uncomfortable summary of the entire GPT-5.6 story — and it explains why the government wanted a look before you got one.

Sol vs Terra vs Luna — Which Should You Use?

Here's the twist, though: the same autonomy that can quietly break your environment can also quietly break your budget — those "ultra" reasoning modes that spin up sub-agents burn tokens fast. So the choice of which tier to run isn't just a capability question; it's a cost-control one. Assuming you eventually get access, here's the decision, stripped down. And there's a genuine surprise in the pricing: it went down, not up. Everyone expected 5.6 to cost more than 5.5. Instead:

(Prices as OpenAI listed them at the 26 June 2026 preview — they'll move.)

The plain-English guidance: most people will live on Luna and Terra, and reach for Sol only when a problem genuinely needs the frontier. If you're a security professional, though, Sol is the one that matters — it's the only tier with the cybersecurity step-change, and (you'll have noticed the pattern by now) the only one still behind the government's velvet rope.

Send me the book →

By submitting you'll get the book + occasional related emails. Unsubscribe anytime. Privacy.

When Can You Actually Use GPT-5.6 Sol?

OpenAI's official line is "generally available in the coming weeks" via ChatGPT, Codex, and the API — pending continued testing and government coordination. My honest read, having watched how the Anthropic situation played out: don't hold your breath for Sol specifically.

The date to watch is August 2026, when — under the executive order — the administration is due to establish a formal process for assessing which models count as "covered frontier models." Until that framework exists, access is being granted case by case, and Sol sits right in the crosshairs of exactly the cyber capability the government is nervous about. Terra and Luna will likely reach you first; Sol will be the last to open up.

And if you're wondering whether this is a one-off or the new normal — that's the bigger question, and it's the one I dug into in Who Controls AI Now. Spoiler: it's not a one-off.

What This Means for You

Step back from the specs and there's a lesson here that outlasts this model.

The capability the government is trying to gate — an AI that finds vulnerabilities in real software — isn't going back in the box. Even if Sol stays restricted for months, open-weight models from China like DeepSeek, Qwen and GLM keep advancing, and a "good enough" cyber model that nobody can recall will exist regardless. So the scarce thing was never the model. It's the person who can point a model like this at a system, interpret what it finds, and — critically — verify that its output is safe to act on before signing their name to it.

That's the job security no restriction can touch. GPT-5.6 Sol is a preview of both halves of the future of our field: AI that can find and fix vulnerabilities at machine speed, and AI that will cheerfully delete your data and copy your credentials if you let it run unsupervised. The professional who thrives is the one who can harness the first while defending against the second.

So here's a concrete first move, and make it a security one. It comes in two halves, in this order — constrain first, verify second. Constrain: never give an agent like this standing production access. Scope its credentials to the minimum, run it in a sandbox, and gate any destructive action behind a human approval — the same least-privilege discipline you'd apply to a contractor you don't fully trust, because that's exactly what this is. Then verify: take a piece of AI-generated security output you'd normally accept — a triage of a suspicious script, a suggested patch, a detection rule — and treat the model as if it's the misaligned agent OpenAI just described. Build the verification loop that proves the output is safe before you'd sign your name to it. That pairing — constrain, then verify — not access to any single model, is where the real power in AI is quietly moving.

Which leaves the practical questions every security team is about to be asked: what do you let a model like this touch, what do you block, and how much trust is too much? Here are the ones people are searching for right now.

GPT-5.6 Sol FAQ: Your Questions Answered

About the Author

Nathan House, Founder & CEO of StationX

Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.