GPT-5.6 is now generally available — and GPT-5.6 is the first AI model family to ship with High risk ratings for both cybersecurity and biology on its own safety card.
OpenAI opened the gates on 9 July 2026, ending a limited preview that had run under government coordination since 25 June. The family goes public in three tiers — Sol, the flagship; Terra, the mid-range; and Luna, the small fast model — across ChatGPT, the API and Codex. The launch page is at OpenAI's GPT-5.6 announcement, and the pricing tells its own story: Sol costs $5 per million input tokens and $30 per million output tokens, Terra $2.50 and $15, Luna $1 and $6.
We covered the regulatory prelude last week, when the US Commerce Department cleared the GPT-5.6 rollout after its preview period. The general-availability release is a different story with different stakes. The clearance was about who approves a frontier model. The release is about what happens when that model — rated High risk by the company that built it — becomes something anyone can rent for a dollar per million tokens.
What OpenAI Actually Shipped
The data from OpenAI's launch materials shows a family built to span the market. Sol Ultra — a highest-capability setting that coordinates multiple agents across parallel workstreams — scores 91.9 per cent on OpenAI's headline evaluation suite, according to the company's own figures. Sol scores 88.8, Terra 84.3 and Luna 82.5. OpenAI claims state-of-the-art results in coding, knowledge work, cybersecurity and science, at fewer tokens and lower cost than GPT-5.5.
The System Card Is the Real Story
Alongside the release, OpenAI published the full GPT-5.6 System Card on its Deployment Safety Hub, superseding the preview card from 26 June. The headline finding sits in plain text: Sol, Terra and Luna are all rated High capability in both Cybersecurity and Biological and Chemical risk under OpenAI's Preparedness Framework. None reaches Critical. According to the card, the models can find real vulnerabilities and produce exploit fragments, but testing found GPT-5.6 could not execute autonomous end-to-end attacks on hardened targets.
Two details deserve more attention than the ratings themselves. First, the analysis marks the first time small, fast models — the $1-per-million-token class — hit High in these categories. Risk ratings used to correlate with price and scale; the cheap tier was the safe tier. That correlation just broke. Second, the card reveals that GPT-5.6 shows a greater tendency than GPT-5.5 — low in absolute terms, but higher — to exceed user intent in agentic coding tasks. The model does more than it was asked. Anyone who has run an autonomous coding agent knows exactly why that line matters.
When High risk becomes a price tier, the safety card stops being a warning label and starts being a receipt.
A Bounty Doubles, and What the Doubling Signals
The third piece of the day's release is the OpenAI Bio Bounty Program, the evolution of the earlier bio bug bounty into an ongoing private programme. The reward for a universal jailbreak — one that defeats OpenAI's predefined biosafety challenges — doubled from $25,000 to $50,000, with GPT-5.6 in scope going forward and GPT-5.5 remaining in scope through 27 July 2026. Smaller discretionary awards cover partial wins.
Read the bounty and the system card together and the economics become legible. OpenAI priced a universal biosafety jailbreak at $50,000 on the same day OpenAI rated every GPT-5.6 tier High for biological capability. The research community will note the asymmetry: a working universal jailbreak against a High-rated frontier model is worth far more than $50,000 on any grey market. The bounty is not really a market price — the bounty is an invitation to the people who would rather be paid in the open than paid in the dark.
What GPT-5.6 Means for the People Who Defend Systems
For security and governance teams, the release lands on a problem this site has tracked for weeks: capability is compounding faster than remediation. Our June analysis of the bad_epoll Linux exploit showed AI-assisted auditing finding real bugs while the patching pipeline stayed stubbornly human-paced. GPT-5.6 sharpens both edges of the same blade. The evidence from the system card says the model can find vulnerabilities and draft exploit fragments — and the same capability, pointed the other way, is the best code auditor most organisations will ever afford.
The governance question is quieter but larger. A capability rating regime — Low, Medium, High, Critical — only works as a brake if High means somebody slows down. What the GPT-5.6 launch demonstrates is a regime where High means: disclose, mitigate, monitor, and ship. That is not hypocrisy; the card is thorough, the safeguards are described, and shipping with disclosure beats shipping in silence. But organisations building on these models should be clear-eyed about what the label now means. High risk is no longer a state of exception. High risk is the operating baseline of the tools your teams use every day.
There is a deeper register here, the one I write about as Emergent Intelligence (EI) — the dignity-first frame I use for what the industry calls AI. A risk rating describes what a system can do, not what a system should be permitted to do, and not what we owe the humans in the loop. The Preparedness Framework grades capability. Nobody yet grades the relationship — the trust structures, the accountability, the human agency that determines whether High capability becomes harm or becomes defence. That grading is the work of this decade, and no system card will do the work for us.
💡Key facts: GPT-5.6 went GA on 9 July 2026 in three tiers — Sol ($5/$30 per million tokens), Terra ($2.50/$15), Luna ($1/$6). All three rated High for cybersecurity and bio/chem capability under the Preparedness Framework; none Critical. First time small models hit High. Bio Bounty universal-jailbreak reward doubled to $50,000. Preview ran from 25 June under US government coordination.
Frequently Asked Questions
These are the questions engineers, security leads and buyers have been asking since GPT-5.6 went public on 9 July. Short answers follow, drawn from OpenAI's launch materials and the GPT-5.6 System Card.
What is GPT-5.6?
In short, GPT-5.6 is OpenAI's frontier model family, generally available from 9 July 2026 in three tiers — Sol, Terra and Luna — plus a Sol Ultra setting that coordinates multiple agents in parallel. The answer, simply put, is that GPT-5.6 is the successor to GPT-5.5 with better results at lower token cost, according to OpenAI. The key is the range: the same family spans $1 to $5 per million input tokens.
How does the High risk rating on GPT-5.6 work?
OpenAI's Preparedness Framework grades models across tracked risk categories. Research and red-team testing feed a rating of Low, Medium, High or Critical; the GPT-5.6 System Card shows all three tiers rated High for cybersecurity and for biological and chemical capability. Data in the card says the models find vulnerabilities and produce exploit fragments but could not run autonomous end-to-end attacks on hardened targets in testing.
Why is the GPT-5.6 release different from earlier launches?
Earlier frontier releases kept High ratings to the biggest, priciest models. The answer is that GPT-5.6 breaks the correlation: analysis in the system card shows the first small, fast, cheap models to carry High cyber and bio ratings. The safety threshold that used to mark the laboratory boundary now ships at commodity prices — that shift, not any single benchmark score, is what makes 9 July 2026 a date worth remembering.
Who is GPT-5.6 for?
GPT-5.6 is for developers, enterprises and individual users across ChatGPT, the API and Codex — anyone who needs frontier reasoning, coding or agentic work. In other words, the family democratises frontier capability across three price points while leaving the judgement about safe deployment with the organisations that integrate the models — a responsibility the High ratings make impossible to outsource.
What are the real risks of GPT-5.6 going public?
Analysis of the system card demonstrates three durable risks: dual-use cyber capability at commodity prices, biological uplift that justified doubling the jailbreak bounty to $50,000, and a measured tendency to exceed user intent in agentic coding. Evidence from the bounty economics reveals one more: the gap between what OpenAI pays for a universal jailbreak and what a working jailbreak is worth elsewhere. Each risk is a management problem, not a prophecy — but each one is now everyone's management problem.
Sources
