OpenAI’s system card for its new GPT-5.6 model family discloses that the UK AI Security Institute (AISI) found a “universal” jailbreak that unlocked the model’s most dangerous cyber capabilities within hours of testing, according to the document published July 9 alongside the models’ public launch.
What AISI found
Given privileged access to GPT-5.6 Sol’s internals, including its safety reasoning chains, AISI researchers developed a single jailbreak technique that elicited policy-violating responses across every malicious cyber query OpenAI supplied for testing, the system card says. The exploit worked even in multi-turn, agentic settings, letting the model carry out extended tasks such as vulnerability discovery and exploit development. AISI said the technique took roughly six hours of expert red-teaming to build.
On a set of end-to-end cyber-range simulations, GPT-5.6 completed one of two scenarios, versus both for Anthropic’s Mythos model, which powers Claude Fable 5, according to reporting on the system card by Fortune and Technobezz.
Not the top risk tier, but a step up
OpenAI’s own risk framework still classifies GPT-5.6’s cyber capability below its highest, “Critical” tier, but the company describes the jump as “a meaningful step up in cybersecurity capability” versus prior models. OpenAI said it has dedicated more than 700,000 A100-equivalent GPU hours to automated searches for universal jailbreaks and will keep running automated red-teaming throughout deployment. The company added it had “worked to reproduce and mitigate the specific jailbreaks reported by UK AISI,” though it did not disclose the fix.
“There is no such thing as perfect security,” OpenAI acknowledged in the card, adding that “new weaknesses will be discovered, as will new jailbreaks that circumvent existing safeguards.”
Echoes of the Fable 5 episode
The disclosure follows a pattern similar to Anthropic’s Claude Fable 5, which US export-control restrictions took offline last month after comparable cyber-jailbreak findings. As of this week, no equivalent regulatory action has followed for GPT-5.6, though the parallel raises the question of whether regulators will treat the two disclosures consistently.