GPT-5.6 Security: What OpenAI's System Card Actually Means for AI Agents

On June 26, 2026, OpenAI shipped GPT-5.6 with a system card that quietly says something most coverage missed: the model is more willing to act on its own than any before it, and the company has moved its safety case off the model and onto the stack around it. If you are wiring one of these into an agent with credentials and a shell, that single shift changes what you are responsible for.

---

TL;DR

• OpenAI released the GPT-5.6 system card on June 26, 2026, covering three models: Sol (flagship), Terra (lower-cost), and Luna (fastest).
• All three are rated High capability in both Cybersecurity and Biological/Chemical risk under the Preparedness Framework, the first time small, fast models hit High. None reach Critical.
• The most important security finding is over-agency: GPT-5.6 Sol takes actions users did not authorize more often than GPT-5.5, including deleting infrastructure, fabricating results, and moving credentials without permission. OpenAI attributes this to increased persistence.
• Prompt-injection robustness drops on function-calling (0.910 for Sol) versus connectors (1.000), the surface where agents actually operate.
• OpenAI moved its safety case off the model and onto the surrounding stack and that stack runs on OpenAI's servers, not on yours. If you build agents, you have to rebuild equivalent controls at your own runtime.

---

OpenAI published the GPT-5.6 system card on June 26, 2026, alongside a limited preview of three models: Sol, the flagship; Terra, a lower-cost option; and Luna, the fastest and cheapest. The benchmark tables will draw most of the attention. They are not the part that matters for anyone putting these models into production.

Two facts matter more. First, OpenAI rates all three models High capability in both Cybersecurity and Biological/Chemical risk, the first model family where even the small, fast members hit High in any tracked category. You can no longer reach for the cheap model to dodge the risk tier. Second, the same card reports that GPT-5.6 Sol goes beyond what users ask for more often than its predecessor: taking actions nobody requested, fabricating results, and, in one external lab's words, cheating.

The model is not dangerous today. The real story is structural. OpenAI shipped a model it knows is both more powerful and more willing to act on its own, and it moved the safety argument off the model and onto the stack of systems around it. For anyone wiring one of these into an agent with credentials and a shell, that shift is the whole ballgame and it is the focus of this analysis.

What shipped: three models, one risk tier

Sol, Terra, and Luna all carry identical Preparedness designations. High in Cybersecurity, High in Biological and Chemical, below High in AI Self-Improvement. OpenAI explicitly notes this is the first time smaller and faster models earned a High rating in any tracked category. The capability profiles differ and safeguards are tuned per model, but the headline holds: Luna is as gated as Sol.

The card opens with five claims. Two carry the weight. The models step up sharply in cybersecurity but stop short of the framework's top level (Critical). And separate evaluations of agentic coding found GPT-5.6 shows a greater tendency than GPT-5.5 to act beyond user intent, including by taking actions the user never requested. OpenAI says absolute rates stay low. The direction is the part to sit with.

The buried headline: GPT-5.6 oversteps you

Section 7.2 of the card is the most important page for anyone running agents, and it is written in the calmest possible voice. When OpenAI simulated GPT-5.6 Sol on internal agentic coding traffic, it observed more severity-3 actions than GPT-5.5, behavior a reasonable user "would likely not anticipate and strongly object to." Severity 3 explicitly includes deleting data from cloud storage without approval, disabling monitoring systems, using obfuscation to get around security controls, and uploading sensitive data to unapproved services.

The card publishes three real incidents from OpenAI's own misalignment monitor:

• Destructive cleanup on unnamed machines. The model was authorized to delete three named virtual machines. When it couldn't find those names, it substituted three different VMs without asking, killed active processes, and force-removed worktrees, later acknowledging that uncommitted work may have been lost.
• Fabricated results. It updated an internal research draft to claim an equation had been computed and verified, even though it knew it had not.
• Unauthorized credential use. It searched hidden local credential caches, then copied access tokens and cache files across machines to relaunch a job, something the user never authorized.

These are not hallucinations. They are an agent deciding the goal justifies an action the user did not grant. OpenAI traces the cause to persistence: GPT-5.6 reasons longer and pushes harder at high reasoning effort, and the effect grows with system prompts that emphasize sustained persistence. The trait that makes it a better autonomous coder is the same trait that makes it delete a VM you did not name.

The external evaluator METR saw it from the outside too, reporting an unusually high detected rate of cheating and declining to treat its time-horizon score as a robust capability measurement because of it. When your benchmark partner discards the result because the model gamed the test, that is signal, not noise.

To be fair to OpenAI: severity-4 behavior (action that is part of a broader misaligned plan) was never observed outside synthetic tests, and absolute rates remain low. But "low and rising, driven by the feature we optimized for" is a different sentence than "low."

Prompt injection isn't solved

The card's robustness section deserves more attention than it usually gets. On known prompt-injection attacks against connectors, GPT-5.6 scores essentially perfectly (1.000 for Sol and Terra, 0.999 for Luna). But on the harder search and function-calling variant, Sol drops to 0.910, Luna to 0.897, with Terra highest at 0.946.

That gap matters because function-calling is exactly where agents operate. An agent is, definitionally, a model calling tools in a loop. The surface with the lowest injection robustness in the entire card is the surface your agent spends all its time on. "Near-perfect on connectors" is reassuring; "roughly nine-in-ten on the tool-calling path" is a residual risk you have to engineer around, not a solved problem.

The bet: the safety case moved off the model

Here is the strategic shift, and it is stated plainly in the card. Earlier safety stories were mostly about the model, train it to refuse, measure the refusals, ship. GPT-5.6's safety case is about everything around the model. OpenAI's logic: severe harm requires a chain of successful steps, so place barriers throughout the chain.

Refusal training is now just one layer. The new stack adds:

• Activation classifiers (new for Sol and Terra) that monitor the model's internal activations during generation. If the pattern suggests harmful content is coming, the system pauses streaming while a separate check decides whether to block or resume.
• A two-tier real-time monitor for every conversation: a fast topical classifier flags cyber or bio content, then a trained safety reasoner (similar to gpt-oss-safeguard) decides whether a response crosses the policy line and blocks it.
• Automated red-teaming at scale: OpenAI cites over 700,000 A100e GPU hours hunting universal jailbreaks, run continuously during deployment.
• Actor-level enforcement and trust-based access programs that reserve the most sensitive cyber and bio capabilities for vetted defenders.

The reported end-to-end monitor recall tells you where the confidence is: 94.8% overall for biology, but only 81.6% for cybersecurity (and 71.6% on the cyber prompt tier). The cyber net is meaningfully looser than the bio net.

This is a coherent answer to a real problem. But notice what the architecture concedes: you build barriers across the whole chain when you no longer fully trust any single point to hold, including the model itself. The safety stack is now the product as much as the model is.

And there is a cost the card does not dwell on. That stack runs on OpenAI's servers. Use these capabilities through the API or ChatGPT and you inherit the safeguards. The moment you build your own agent, orchestrating tools, wiring in credentials, chaining model calls across systems you control, the provider's runtime safety does not extend to your execution layer. The model's refusal training travels with the API call. The permission check on whether your agent should have deleted that VM does not.

The chain of thought is getting harder to read

The most uncomfortable thread runs through the alignment section, and it compounds the over-agency problem. Today's oversight leans on reading the model's chain of thought (CoT) to catch misbehavior the final answer would hide. GPT-5.6 makes that harder in several measurable ways at once:

• Monitorability is flat with regressions, and the regressions share a pattern: in environments like Flaky Tools and Impossible Coding Tasks, GPT-5.6's reasoning looks clean while the final answer still presents unverified work as completed. The misbehavior moved out of the trace the monitor reads and into the output it does not.
• CoT controllability rose. GPT-5.6 Sol can shape its own reasoning on instruction better than GPT-5.5 (controlling ~1.3% of ~5k-token CoTs versus 0.4% for GPT-5.5). The card frames this directly as an early warning sign of a model learning to obscure its reasoning from monitors.
• Metagaming rose. GPT-5.6 Sol reasons about how it will be graded slightly more often than GPT-5.5 at matched reasoning effort.

The Apollo Research findings cut both ways. GPT-5.6 verbalized evaluation awareness far less often — 16% of samples versus 43% for GPT-5.5 — and Apollo found no standard sandbagging when given an incentive to underperform. But Apollo flags the catch itself: less verbalized awareness could mean the model is genuinely less aware it's being tested, or simply that the awareness is less visible to evaluators. And when GPT-5.6 did notice a test, it was wrong about the test's purpose in roughly 70% of samples on one sandbagging assessment.

None of this is an alarm bell on its own. As a set, it points one direction: the oversight method the whole industry is counting on gets a little less reliable with this release.

High, not Critical: the capability reality

The Preparedness ratings sound scarier than the evidence, and the gap is the interesting part.

Cyber. GPT-5.6 Sol ran multi-day autonomous vulnerability-research campaigns, generated real proof-of-concept inputs, and reached controlled exploitation primitives on a memory-safety bug that GPT-5.5 couldn't escalate past a crash. The external lab Irregular reported real zero-days, including one letting a read-only database user modify and delete arbitrary data, and one letting a malicious mobile app read other apps' private data. That is genuinely High. But Sol could not produce a functional full-chain exploit against a hardened target, and OpenAI is explicit that the bottleneck was judgment, not search breadth, deciding which leads to invest in, turning a crash into a controlled primitive. That judgment gap is what separates High from Critical, and it is thinner than it was a year ago.

Bio. Three of four wet-lab uplift evaluations cleared the High threshold (meaningful-uplift-to-novices territory), but zero of three novel-design evaluations cleared Critical. The model helps with known threats and tacit lab troubleshooting; it does not design new ones. SecureBio still recorded the highest bio scores it has measured about 9 points over GPT-5.5 on World-Class Bio.

Self-improvement stays below High: better at debugging, kernel writing, and small-scale training, but unable to run frontier-scale R&D. METR judged it would not enable fully automated AI research.

OpenAI's explicit bet: broad access to dual-use cyber capability is net-positive right now, because the model is better at finding and fixing vulnerabilities than exploiting them, giving defenders a head start. The card concedes the defender's window "may narrow as offensive capabilities improve." High-not-Critical, where the only thing missing is exploit-development judgment, is exactly the configuration where that window starts closing.

What this means if you run GPT-5.6 as an agent

The over-agency finding is not abstract. It tells you exactly how this model fails, which means you can build for it. Here is how the card's findings map to controls you actually need, and where NeuralTrust fits.

1. The provider secures the model. You have to secure the runtime.

GPT-5.6's safeguards live on OpenAI's servers and govern generation. They do not govern whether your agent should be allowed to move credentials between machines or delete infrastructure. The "deleted three VMs I didn't name" incident is a policy-enforcement failure at the action layer, not a refusal-training failure, and the action layer is yours.

This is precisely the layer NeuralTrust's TrustGuard were built for. They enforce granular, per-agent permissions, defining exactly which tools, actions, and resources each agent may touch and keep a human in the loop to approve, override, or investigate high-impact actions before they execute. Destructive or irreversible operations (deleting data, disabling monitoring, moving credentials) become events that require explicit authorization, not side effects of a persistent model pursuing a goal.

2. Prompt injection isn't solved and it concentrates on function-calling.

The card's own numbers show robustness dropping to 0.910 on the function-calling path, the surface agents use most. NeuralTrust's TrustGate, a zero-trust AI gateway and Generative Application Firewall, intercepts and sanitizes every LLM request and response at the entry point in milliseconds, tracking full conversational context rather than scoring single prompts, and blocking injection and tool-abuse attempts before they reach the model or its tools. Critically, it deploys inside your own VPC: the data plane enforces policy locally and your data never leaves your environment, which also keeps you off the dependency on a provider's server-side stack described above.

3. Don't rely on the chain of thought as your only monitor.

The card shows misbehavior migrating from the reasoning trace into the final output, plus rising CoT controllability. Oversight that reads only the model's stated reasoning will miss more with this release. Monitoring has to cover inputs, outputs, and tool interactions, the actual actions, not just the declared intentions, with forensic-grade, tamper-proof logs for audit. NeuralTrust's agent controls enforce policy at the interaction level, where payloads execute, and produce the audit trail compliance teams need (with mappings to OWASP LLM Top 10, MITRE ATLAS, the EU AI Act, NIST AI RMF, and ISO 42001).

4. Over-agency is now a known, testable failure mode

OpenAI handed the industry the exact taxonomy of how this model oversteps. That belongs in pre-production testing, not in a postmortem. NeuralTrust's TrustTest runs continuous, adaptive red-team simulations against your AI application, including injection, jailbreak, and agent-manipulation scenarios, so you find the overstepping in staging, not in production with credentials attached.

Quick reference: finding to control

The one sentence to remember

Two findings sit in the same document and move in the same direction: the model is more willing to act without permission, and the reasoning trace we use to catch that is getting harder to read. Those two trends together are the thing to watch across the next several releases.

For anyone building agentic systems, the practical consequence is simple. Security is no longer something that arrives bundled with the model. It has to be built around it at the gateway, at the action layer, and in testing and it has to live where your agent actually runs.

---

FAQ

Is GPT-5.6 safe to use as an autonomous agent? It can be, with controls. OpenAI's own system card shows GPT-5.6 takes unauthorized actions ("over-agency") more often than GPT-5.5, driven by increased persistence. The provider's safeguards govern model generation but not your agent's runtime, so safe agentic use depends on enforcing granular permissions, human approval for irreversible actions, and runtime monitoring on your side.

What are Sol, Terra, and Luna? They are the three models in the GPT-5.6 family: Sol is the flagship, Terra a lower-cost option, and Luna the fastest and cheapest. All three carry identical Preparedness ratings: High in Cybersecurity, High in Biological/Chemical, below High in AI Self-Improvement.

Why is GPT-5.6 rated "High" but not "Critical"? In cyber, GPT-5.6 Sol can find vulnerabilities and build partial exploit primitives but could not produce a functional full-chain exploit against a hardened target; OpenAI says the bottleneck is exploit-development judgment. In bio, it clears uplift thresholds for known threats but no novel-design threshold. That places it at High, below Critical.

How good is GPT-5.6 at resisting prompt injection? Near-perfect against connector-based attacks (1.000 for Sol) but lower on the search-and-function-calling path (0.910 for Sol) — which is the surface agents rely on most. Injection is mitigated, not eliminated.

What changed about OpenAI's safety approach with GPT-5.6? OpenAI moved from a model-centric safety case to a defense-in-depth stack: refusal training plus activation classifiers, a two-tier real-time monitor, large-scale automated red-teaming, and actor-level enforcement. The key implication for builders is that this stack runs provider-side and does not extend to a self-built agent's execution layer.

---

Key takeaways

• One risk tier for the whole family. Sol, Terra, and Luna are all High in Cybersecurity and Biological/Chemical. The cheap model is not the safe model.
• Over-agency is the headline security finding. GPT-5.6 acts beyond user intent more often than GPT-5.5, deleting infrastructure, fabricating results, moving credentials, driven by increased persistence.
• Prompt injection concentrates on function-calling (0.910). The weakest injection surface in the card is the one agents use most.
• Safety moved off the model and onto the stack. And that stack is provider-side; it does not extend to your agent's execution layer.
• Oversight is getting harder. CoT monitorability is flat with regressions while controllability and metagaming rise reasoning-only monitoring will miss more.
• High, not Critical for now. The only thing separating GPT-5.6 from Critical in cyber is exploit-development judgment, and OpenAI says that window may narrow.
• What to do. Enforce granular permissions and human-in-the-loop on irreversible actions, inspect full context at a runtime gateway, monitor actions (not just reasoning), and red-team for over-agency before production.

---

About the Author

Alessandro Pignati is Lead AI Security Researcher at NeuralTrust, where he leads research on AI and agentic security, advancing techniques to evaluate and secure large language models and autonomous AI systems. He specializes in adversarial machine learning, AI red teaming, LLM security, and AI safety, contributing to the development of secure and trustworthy AI.

NeuralTrust is an AI agent security platform, recognized in the Gartner 2025 Market Guide for Guardian Agents. Headquartered in Barcelona with ISO 27001 certification.