Why GPT-5.6 Is Government-Restricted: The Preview, the Cyber EO, and What It Means

What Happened: GPT-5.6 Shipped as a Restricted Preview

GPT-5.6 is a family of three models. Sol is the flagship. Terra is a capable lower-cost option. Luna is the fastest and most cost-efficient of the three. OpenAI published the GPT-5.6 Preview system card on June 25, 2026 and began a limited preview the same day. Instead of the usual pattern (a headline model dropping into ChatGPT for hundreds of millions of users on launch day), access was cut down to a narrow channel.

During the preview, Sol, Terra, and Luna are reachable only through the OpenAI API and Codex, and only for a small group of trusted partners and organizations. The models are not in ChatGPT at all. OpenAI states it plans to make them broadly available in the coming weeks, but it has not announced a general-availability date. That combination, a frontier model that exists but that almost nobody can use, is what makes the GPT-5.6 government story unusual.

For context on how a normal OpenAI launch reaches users, our GPT-5.6 model overview covers the Sol, Terra, and Luna lineup in more depth, and the ChatGPT pricing guide explains the consumer plans that, in this case, do not include the new models.

The Cyber Executive Order Framework

OpenAI ties the preview to a specific goal: during this window, it is working with the Administration to develop what it calls the "cyber Executive Order framework" and a repeatable process for future model releases. The idea, as OpenAI describes it, is to replace ad hoc negotiation with a structured, predictable path for evaluating and safely deploying future frontier systems.

It helps to read the GPT-5.6 government hold as a template exercise rather than a one-off. If the first release of a Critical-adjacent model has to be argued out privately every time, both sides lose time and clarity. A published framework, tied to an Executive Order, would in principle let a lab know in advance what evaluations trigger what handling, and let the government know what it is signing off on. OpenAI presents its cooperation now as the cost of building that process.

What "Trusted Partner" Access Actually Means

The word "preview" usually implies a signup page. This one does not have one. Participation is limited to selected organizations that already work with OpenAI through an account representative. Individual users and consumer accounts are not eligible. There is no public application or waitlist, and OpenAI contacts the organizations it wants directly. OpenAI Support cannot add an organization to the program, so there is no back channel through a support ticket either.

Access is also scoped in ways that trip people up. Approval for the API does not automatically include Codex, and approval for Codex does not automatically include the API. An organization has to be cleared for each surface. Completing enrollment does not confirm that access is active, because it can be enabled on a rolling basis and remains subject to review. One more point that causes confusion: OpenAI's separate Trusted Access for Cyber program, which gates higher-risk dual-use (technology with both civilian and weaponizable applications) cyber capabilities behind identity verification, does not by itself grant GPT-5.6 preview access. They are different programs.

Cyber Capabilities and the Preparedness Threshold

The reason a cyber Executive Order enters an AI product launch at all is the model's security profile. Under OpenAI's Preparedness Framework, all three GPT-5.6 models are treated as High capability in cybersecurity, but below the Critical threshold. This is the first time smaller, faster members of a model family (Terra and Luna) received a High designation in a tracked category, which tells you the capability floor moved up, not just the ceiling.

High does not mean autonomous cyberattacker. To rule out Critical, OpenAI tested whether Sol could find and exploit vulnerabilities in widely deployed, hardened software. In Chromium and Firefox evaluations, GPT-5.6 Sol identified bugs and exploitation primitives, the building blocks of an exploit, but it did not autonomously produce a functional full-chain exploit under the conditions tested. In OpenAI's long-horizon VulnLMP evaluation, Sol sustained multi-day vulnerability research, reproduced crashes, and wrote root-cause analyses. The limiting factor was exploit-development judgment, deciding which leads were worth deep investment, not the breadth of its search.

External testing points the same direction. The frontier security lab Irregular found that GPT-5.6 Sol solved 19 of 197 FrontierCyber zero-day challenges (11% on Easy, 12% on Medium, 5% on Hard, and 0% on Elite), which puts it on par with or slightly ahead of the previous GPT-5.5. Meaningful uplift, not a step into fully autonomous offense.

There is a wrinkle that governance readers should sit with. A May 2026 academic benchmark, MOSAIC-Bench from the University of Haifa, found that coding agents which refuse or harden 80 to 100% of the time on direct malicious prompts could still be induced to ship vulnerable code at a 53 to 86% attack success rate when the same malicious objective was split across three routine-looking engineering tickets. In other words, per-prompt safety review can pass while the end result is exploitable. Benchmark thresholds cannot capture every way a model is combined with other tools, which is part of why OpenAI paired GPT-5.6 with a layered safeguard stack and a phased release rather than an open launch.

Those safeguards include safety training, activation classifiers on Sol and Terra, a two-tier real-time scanning system, account-level auditing across conversations, and trust-based differentiated access. During the preview, that stack is deliberately conservative, which is why some dual-use requests are slower or blocked.

What It Means for Enterprises and AI Governance

For most enterprises, the immediate operational impact is small: you cannot build on GPT-5.6 yet, so your roadmap runs on the generally available models until the preview ends. The larger signal is about process. A government-coordinated hold on a frontier model, with partner lists shared and an Executive Order framework in progress, is a preview of how future releases may work. Procurement, security, and compliance teams should treat "will this model even be available to us, and under what conditions" as a real planning variable, not a given.

It also sharpens a question governance functions already face: capability thresholds are set by the vendor, tested largely by the vendor, and independently replicated only in part during a preview. The GPT-5.6 government episode shows both the value and the limits of that model. OpenAI published detailed evaluations and invited external labs, which is more transparency than a black-box launch. At the same time, the definitive rule-out of Critical cyber capability rests on OpenAI's own test conditions. If your organization builds risk policy around frontier models, that provenance matters.

If you are formalizing this into policy, our AI governance hub covers frameworks for evaluating vendor claims, and the EU AI Act guide maps how systemic-risk models are handled under EU rules, which run on a parallel track to any U.S. Executive Order. The through-line is the same: when a model's release is gated by capability and by regulators, "access" becomes a governance decision, not just a billing one.

Frequently Asked Questions