OpenAI is beginning a limited preview of the GPT-5.6 series: Sol, the flagship model; Terra, a balanced model for everyday work; and Luna, a fast and affordable model. Terra delivers competitive performance to GPT-5.5 at half the cost, while Luna offers strong capability at OpenAI's lowest price point.
GPT-5.6 Sol launches with OpenAI's most robust safety stack to date. The company strengthened protections for higher-risk activity, sensitive cyber requests, and repeated misuse, spending multiple weeks finding weaknesses, pressure-testing the system, and hardening it against real-world attacks.
OpenAI believes in broad access and plans to make GPT-5.6 Sol, Terra, and Luna generally available in the coming weeks. As part of ongoing engagement with the U.S. government, OpenAI previewed plans and model capabilities ahead of the launch. At the government's request, the release starts with a limited preview for a small group of trusted partners whose participation has been shared with the government, before releasing more broadly. During this preview, OpenAI will continue testing and coordinating closely with partners as it works toward broader availability. OpenAI does not believe this kind of government access process should become the long-term default, as it keeps the best tools from users, developers, enterprises, cyber defenders, and global partners who need them. OpenAI is taking this short-term step because it believes it is the strongest path to broader availability in the coming weeks, while working with the Administration to develop the cyber Executive Order framework and a repeatable process for future model releases.
Capabilities
GPT-5.6 Sol is OpenAI's strongest model yet. To give a preview of model performance, OpenAI shares a set of evaluations highlighting improved agentic capabilities in coding, biology, and cybersecurity, with additional safety and preparedness evaluations available in the system card. An expanded suite of evaluation results will be shared when the model becomes broadly available.
With GPT-5.6, OpenAI introduces a new max reasoning effort to give Sol the most time to reason deeply. Additionally, a new ultra mode goes beyond the capabilities of a single agent by leveraging subagents to accelerate complex work.
For coding workflows, GPT-5.6 Sol sets a new state of the art on Terminal-Bench 2.1, which tests command-line workflows requiring planning, iteration, and tool coordination.
GPT-5.6 Sol also shows broad improvements in biology workflows. On GeneBench v1, which evaluates long-horizon genomics and quantitative-biology analyses, it achieves stronger results than GPT-5.5 while using fewer tokens.
GPT-5.6 Sol is OpenAI's most capable model yet for cybersecurity. It shifts the performance-efficiency frontier for long-horizon security tasks including vulnerability research and exploitation. On ExploitBench, GPT-5.6 Sol is competitive with Mythos Preview using only roughly one-third of the output tokens. On ExploitGym, a benchmark created by UC Berkeley researchers in collaboration with OpenAI and other frontier labs, GPT-5.6 Sol, Terra, and Luna models all demonstrate strong improvements in cyber capabilities as reasoning is increased.
Stronger Cyber Capabilities with Stronger Safeguards
OpenAI developed GPT-5.6 Sol, Terra, and Luna with its most robust safeguards to date, with configurations matched to each model's capabilities. As the model becomes more capable, safeguards are designed to increasingly hold up to real-world adversarial pressure while preserving access to legitimate work such as code review, vulnerability research, patch development, debugging, security education, and defensive testing. The goal is to make prohibited offensive activity more difficult, uncertain, and detectable without unnecessarily limiting beneficial uses. Based on OpenAI's assessment of the model and safeguards, the company expects substantial benefit for legitimate defensive work, while meaningfully constraining prohibited offensive use.
GPT-5.6 Sol is better at helping people find and fix vulnerabilities than reliably carrying out end-to-end attacks. As these capabilities continue to advance, OpenAI's priority is to ensure they reach and benefit defenders, who can use these tools to find weaknesses, develop patches, and strengthen systems more broadly.
GPT-5.6 Sol does not cross the Cyber Critical threshold under OpenAI's Preparedness Framework. In evaluations involving Chromium and Firefox, it identified bugs and exploitation primitives-the building blocks of an exploit-but did not autonomously produce a functional full-chain exploit under the conditions tested. However, benchmark thresholds cannot capture every way a model may be used or combined with other tools. That uncertainty, along with the model's broader step change in capabilities, is why OpenAI is pairing increased capabilities with stronger safeguards and a phased release. More details about the safeguards are available in the GPT-5.6 Preview system card.
A Layered Safeguard Stack
No single safeguard is sufficient against determined or adaptive misuse. Across the GPT-5.6 preview, OpenAI uses layered safeguards, with exact configurations varying across models, and pressure-tests them for real-world attacks. These include protections trained into the model, real-time checks during generation, account-level signals, differentiated access, monitoring, enforcement, and continued testing.
GPT-5.6 is trained to refuse prohibited cyber assistance, including when users attempt to disguise their intent or jailbreak the model. These model-level safeguards establish the first boundary around what the model should and should not help with.
Real-time cyber and biology misuse classifiers provide another layer by evaluating output as it is generated. For higher-risk cases, if they detect a potential violation, the generation may be paused while a larger reasoning model reviews the conversation and its context. If the output is assessed as disallowed, it is withheld before it reaches the user.
Flagged activity can also trigger account-level review across relevant conversations and risk signals, consistent with OpenAI's terms and policies around content retention and review. Looking beyond a single conversation helps OpenAI's systems distinguish persistent malicious behavior from legitimate dual-use security work, where similar technical concepts may appear in very different contexts.
Together, these layers make the overall approach more robust than any single safeguard on its own. Model behavior reduces the likelihood of harmful responses, real-time systems can intervene during generation, account-level review can identify broader patterns, and differentiated access preserves important defensive work without making the most sensitive capabilities broadly available by default.
During the preview especially, users may encounter safeguards that block or refuse some requests. Other requests may take longer because generation is paused for additional review. Safeguards may occasionally intervene on legitimate work, particularly in dual-use areas where defensive and offensive activity can initially look similar.
That is part of what the preview is designed to test. OpenAI wants to understand not only whether the safeguards constrain misuse, but whether legitimate users can still complete normal work reliably and efficiently. Feedback during the preview will help reduce unnecessary blocks and delays, improve how the safeguards interpret context, and create a smoother experience before wider release.
OpenAI is also working with enterprise customers on longer-term approaches-including privacy-preserving detection, customer-operated safety controls, and access calibrated to the risk of a customer, user, or workload-to advance safety while supporting enterprise privacy requirements.
Improving Robustness with Automated Red-Teaming
Safeguards also need to remain effective when attackers adapt their tactics. A protection that works only on a fixed set of known attacks is not robust enough for a frontier model.
That is why OpenAI is applying more intelligence and compute than ever before to safety, using its own models to find weaknesses and improve safeguards faster. Over 700,000 A100-equivalent GPU hours were dedicated to automated red teaming aimed at finding universal jailbreaks: attacks that can work across many prompts or contexts, not just one narrow setting. Focusing on these harder, more general attacks allowed testing safeguards beyond a fixed set of known failures. It also enabled exploring far more attack patterns than human testing alone could cover, identifying failure patterns earlier, and shortening the path from finding a weakness to addressing it.
In addition to automated red-teaming, OpenAI worked with third-party testers to conduct extensive human expert red teaming, which will continue during the preview period. Human red-teaming complements the automated work by testing safeguards against creative experts trying to misuse the model in ways OpenAI's systems might not anticipate.
No evaluation can represent every product configuration, multi-step attack, or real-world workflow. OpenAI therefore maintains a rapid-response process to reproduce, assess, prioritize, and remediate newly discovered jailbreaks, then add them to ongoing evaluations so they can test against similar failures in the future.
Availability and Pricing
During the preview, GPT-5.6 models will initially be available through the API and Codex to a select group of trusted partners and organizations. OpenAI plans to make them more broadly available to people using ChatGPT, Codex, and the API soon.
In the new naming system introduced with GPT-5.6, the number identifies a model's generation, while Sol, Terra, and Luna identify durable capability tiers that can advance on their own cadence. Together, the family gives people and developers clearer choices across intelligence, speed, and cost.
GPT-5.6 is priced per 1M tokens across three model sizes: Sol is $5 input / $30 output; Terra is $2.50 input / $15 output; and Luna is $1 input / $6 output. GPT-5.6 also introduces more predictable prompt caching, including support for explicit cache breakpoints and a 30-minute minimum cache life. For GPT-5.6 and later models, cache writes are billed at 1.25x the model's uncached input rate, while cache reads continue to receive the 90% cached-input discount.
OpenAI is also launching GPT-5.6 Sol on Cerebras at up to 750 tokens per second in July, bringing frontier intelligence to customers at unprecedented speed. Access will initially be limited to select customers as capacity expands.
OpenAI is excited to continue learning from this preview period and to bring GPT-5.6 Sol, Terra, and Luna to more people soon.