GPT-5.6 Enters Limited Preview: OpenAI's Strongest Model, Held Back by Its Own Safety Risks

Just now, the GPT-5.6 family officially entered preview, but it is not being opened broadly. Instead, OpenAI is starting with a limited preview.

As OpenAI's strongest generation so far, GPT-5.6 arrives with three models whose names are deliberately poetic:

Sol is the flagship model, and OpenAI calls it its strongest model to date.

Terra is the balanced model for everyday work, competing with GPT-5.5 while costing roughly half as much.

Luna focuses on speed and low cost, making it the cheapest model in the GPT-5.6 family.

Judging by this naming system, Sam Altman has clearly absorbed some of Anthropic's marketing playbook. Alongside the GPT-5.6 launch, OpenAI also reorganized its model naming structure.

The number represents the generation, while Sol, Terra, and Luna represent different capability tiers. In product terms, Sol is aimed at difficult and complex tasks, Terra covers everyday workflows, and Luna is for low-cost calls.

In other words, GPT-5.6 is not only a capability upgrade. It is also OpenAI's attempt to segment its model product line more clearly.

🔗 https://openai.com/index/previewing-gpt-5-6-sol/

GPT-5.6 lands overnight, topping the benchmarks across the family

As OpenAI's strongest model so far, GPT-5.6 Sol's capability story is concentrated in three areas: coding, bioinformatics, and cybersecurity.

These scenarios share one feature:

They are complex, long-horizon, and highly dependent on context. The model must keep planning, reasoning, calling tools, correcting mistakes, and moving the process forward. OpenAI calls this agentic capabilities, meaning the model behaves more like an agent that can independently execute tasks.

In coding, GPT-5.6 Sol no longer stops at code completion. It reaches into complex command-line work.

OpenAI says Sol has refreshed performance on Terminal-Bench 2.1, a benchmark for command-line workflows that tests planning, iteration, and tool coordination.

Benchmark results show GPT-5.6 Sol Ultra scoring 91.9% on Terminal-Bench 2.1, while GPT-5.6 Sol scores 88.8%. For comparison, GPT-5.5 scores 88.0%, GPT-5.6 Terra scores 82.5%, and GPT-5.6 Luna scores 84.3%.

Compared with other models, Claude Mythos 5 scores 84.3%, Claude Fable 5 scores 83.4%, Claude Opus 4.8 scores 78.9%, and Gemini 3.1 Pro Preview scores 70.7%.

Sol Ultra's score also points to GPT-5.6's core feature.

On one side, max reasoning effort lets the model spend more time on deep reasoning. On the other, the new Ultra mode dispatches multiple sub-agents to split up complex tasks and then consolidate the results.

In real development work, a model often has to understand a project structure, read files, change code, run commands, analyze errors, and keep revising. A complex task usually cannot be completed in one answer. Ultra mode is aimed at letting different sub-agents handle different parts of the workflow before merging the results, improving completion efficiency for complex tasks.

In biology, GPT-5.6 Sol's improvement shows up on GeneBench v1. This benchmark focuses on long-horizon genomics and quantitative biology analysis tasks. OpenAI says Sol achieves stronger results than GPT-5.5 while using fewer output tokens.

Swipe left to see more.

This matters especially in research. Bioinformatics, genomics, and quantitative biology often require a model to keep analyzing data, explaining results, choosing methods, comparing hypotheses, and maintaining context across multiple steps. Whether a model can complete these tasks matters, and whether it can do so with lower token cost matters just as much.

If Sol can achieve stronger results with fewer output tokens, it means better cost efficiency in professional scientific workflows. For labs, enterprise R&D teams, and biomedicine scenarios, token consumption directly affects call cost and whether the model can enter large-scale workflows.

Cybersecurity is GPT-5.6 Sol's most sensitive capability area.

OpenAI says Sol is its strongest cybersecurity model so far, pushing the performance and efficiency frontier for long-horizon security tasks, including vulnerability research and exploitation-related tasks.

On ExploitBench, GPT-5.6 Sol performs close to Mythos Preview while using roughly one-third of the output tokens.

OpenAI also mentions ExploitGym, an evaluation system built by UC Berkeley with several frontier labs to measure model capability in security tasks. As reasoning improves, Sol, Terra, and Luna all make clear progress in this area.

But OpenAI clearly pumps the brakes in this section.

The official explanation emphasizes that Sol is better at finding and fixing vulnerabilities, but still cannot reliably complete end-to-end attacks. In evaluations involving Chromium and Firefox, Sol can identify bugs and program defects, the basic components of exploitation, but under test conditions it does not autonomously generate a full working attack chain.

Based on these results, OpenAI concludes that GPT-5.6 Sol has not crossed the cybersecurity critical-risk threshold in its Preparedness Framework.

System Card 🔗: https://deploymentsafety.openai.com/gpt-5-6-preview/introduction

This cautious judgment is clearly meant to avoid repeating the Mythos episode.

On one hand, OpenAI wants to prove that Sol is much stronger on cybersecurity tasks. On the other, it also needs to explain that Sol has not reached a risk level that requires extreme restriction. More ironically, much of this pressure comes from the AI hype narrative OpenAI itself helped shape.

At the same time, OpenAI admits that benchmarks cannot cover every real-world use. No evaluation can represent every product configuration, multi-step attack, or actual workflow. A model may be connected to other tools or placed inside a more complex attack chain.

This uncertainty is exactly why GPT-5.6 is being released so cautiously.

The strongest performance, but AI safety gets the spotlight

Safety takes up an unusually large share of the GPT-5.6 announcement.

OpenAI has configured tiered protections for Sol, Terra, and Luna. The stronger the model, the stricter the guardrails. The goal is to suppress offensive uses while preserving legitimate scenarios such as code review and vulnerability research.

At the model layer, the system is trained to refuse disallowed cybersecurity requests, even when users try to disguise or bypass them. During generation, real-time classifiers detect and block high-risk content, and higher-capability models can review borderline cases when needed. At the account layer, OpenAI combines cross-conversation behavior and risk signals to identify persistent abuse.

This mechanism is described as a layered safety stack covering model refusal, real-time detection, account review, differentiated access, and continuous testing. The layers work together against complex abuse while trying to reduce disruption to legitimate work.

For enterprise customers, OpenAI also proposes privacy-preserving detection, customer-controlled security settings, and risk-tiered access, trying to find a balance between safety and data protection.

To avoid repeating past mistakes, OpenAI spent more than 700,000 A100-equivalent GPU hours on automated red-team testing, focusing on general jailbreaks, supplemented by expert human testing. OpenAI has also built a rapid-response process to reproduce, evaluate, and fix new vulnerabilities and fold them into continuous evaluation.

In terms of availability, GPT-5.6 is still in limited preview.

OpenAI says the models will first be available through the API and Codex to a small group of trusted partners, then gradually expand to ChatGPT, Codex, and broader API users.

OpenAI also says it believes frontier models should be made as broadly available as possible, and plans to move GPT-5.6 Sol, Terra, and Luna into more general availability in the coming weeks.

The early reaction does not look especially flattering.

Pricing was announced at the same time:

Per million tokens, Sol costs $5 for input and $30 for output; Terra costs $2.50 for input and $15 for output; Luna costs $1 for input and $6 for output.

GPT-5.6 also introduces more predictable prompt caching, with explicit cache breakpoints and at least a 30-minute cache lifetime. Cache writes are billed at 1.25 times the uncached input price, while reads receive a 90% discount.

Of course, it will still take some time before most users can access it. OpenAI announced that GPT-5.6 Sol will arrive on Cerebras in July, with speeds up to 750 tokens per second. That version will also initially be limited to select customers, with wider access expanding as capacity grows.

In other words, GPT-5.6's limited preview is not just a product rollout. It is also a safety validation process. OpenAI needs to find a controllable balance among capability, risk, and openness.

Frontier model releases enter a new cycle

Two weeks ago, Anthropic disabled one of its strongest models, Fable 5, after the U.S. government asked the company to restrict use of the model by foreign citizens both inside and outside the United States, citing national security.

In GPT-5.6's rollout, the first users are also not decided entirely by OpenAI.

In its official blog, OpenAI says it showed the U.S. government GPT-5.6's capabilities and release plan before launch. At the government's request, the model will launch as a limited preview, available only to a small number of trusted partners, and information about those partners has been shared with the government.

The Washington Post reported that the U.S. federal government will review which companies can access OpenAI's latest technology. At present, only companies approved by the U.S. government can access the new model, and individual users have no application channel.

Bloomberg reported that about 20 partners are in the first access group for GPT-5.6, and one possible entry point may be Amazon's Bedrock platform.

OpenAI's attitude toward this arrangement is clearly somewhat ambiguous. In the blog post, OpenAI says it does not believe government involvement in model access should become the long-term default, because that would keep the best tools away from users, developers, companies, cyber defenders, and global partners.

But in practice, OpenAI still chose to accept the arrangement, saying it wants to win broader openness while working with the U.S. government on a replicable model release process.

Behind this shift, frontier AI models are gradually being folded into national security frameworks.

In the past, a new model launch was mainly a company product-cycle issue. Now, once a model crosses new capability thresholds in programming, cybersecurity, biology, and agentic workflows, its release rhythm may enter safety and export-control discussions.

For OpenAI, GPT-5.6 is both a flagship model preview and a policy trial. OpenAI needs to prove Sol is strong enough, prove its safety system is strict enough, and find an executable path between U.S. government review and commercial openness.