OpenAI's hacking model found two real bugs in Chrome. The word zero-day got added in post.
The V8 flaws are genuine and Google patched them, at High severity, weeks before OpenAI said a word. The zero-day drama and the 95% score are packaging.
"OpenAI's new GPT-5.6-Cyber model found two previously undocumented Chrome V8 flaws (billed as zero-days) and completes 95% of advanced cybersecurity requests the standard model refuses." [SOURCE ↗]
THE MOVE: RENTED HALO, the achievement is real, the drama around it is borrowed
THE CLAIM. OpenAI says GPT-5.6-Cyber found bugs no one had documented before, including two Chrome V8 flaws that chain into a sandbox escape, and answers 95% of advanced cyber prompts the stock model refuses.
THE CHECK. the bugs are real. Google patched them as CVE-2026-15903, severity High, weeks before the announcement, and no exploit has ever been seen in the wild. A zero-day is a flaw attackers use before defenders can respond. These were found by the defender and were dead on arrival. The 95% counts how often the model agrees to answer, not whether the answer works. And on OpenAI's own report-writing eval, Cyber scores worse than plain Sol.
On August 10 OpenAI expanded Daybreak, its vetted-access security program, and introduced GPT-5.6-Cyber, a variant of GPT-5.6 Sol trained for exploit development and vulnerability research. Access is restricted to the program's Red tier. The launch rides on two artifacts. One: the model "found bugs
🔒 THE FULL AUTOPSY · FREE WITH AN ACCOUNTYou just read the free check. Sign in free, a code by email, no passwords, and the rest unlocks: the evidence trail, the steelman and the rebuttal, all 6 sources with quotes and screenshots, and our on-record call.
Couldn't verify your access. This looks like our error, not yours.