GPT-5.6 Sol: OpenAI's First 'High' Cyber-Risk Model Ships With Agentic Tool Calling

What shipped

On 9 July 2026, OpenAI took the GPT-5.6 family to general availability under a new naming scheme: the version number tracks the generation, while Luna, Terra, and Sol identify durable capability tiers that can each advance on their own cadence. Luna is the cheapest and fastest, Terra is the balanced mid-tier, and Sol is the new flagship (Simon Willison).

• Luna: $1 / $6 per 1M input/output tokens
• Terra: $2.50 / $15 per 1M input/output tokens
• Sol: $5 / $30 per 1M input/output tokens

All three share a 1 million token context window, a 128,000 token maximum output, and a 16 February 2026 knowledge cutoff.

The part that matters to security teams

The headline for us isn't the pricing table — it's the risk classification attached to Sol. OpenAI is treating Sol as 'High capability' for cybersecurity risk, its highest public rating to date for a shipped model in that category. According to reporting on OpenAI's own materials, Sol and Terra can help find vulnerabilities and pieces of exploits, but the company states neither model carried out autonomous end-to-end attacks against hardened targets during testing (Winbuzzer).

OpenAI says it is pairing that broader capability with stronger safeguards, monitoring, and trust-based controls for sensitive cyber and biological use cases, and has published a system card detailing the evaluation. For defenders, the practical read is: the model is now genuinely useful for vulnerability research and exploit-drafting assistance — which is exactly the profile that both attackers and legitimate red teams will want to test against their own environments.

More autonomy, more surface

GPT-5.6 also ships two features that change the blast radius of a compromised or manipulated session. Programmatic tool calling lets the model write and execute JavaScript inside an isolated V8 runtime with no network access, chaining tool calls without round-tripping through the chat context — OpenAI-reported customers saw token-usage drops of roughly 38–63.5% from the pattern (MarkTechPost).

Separately, a new multi-agent 'ultra' mode runs four agents in parallel by default and has been demonstrated in runs of up to 16 agents on benchmarks like BrowseComp and SEC-Bench Pro, available in ChatGPT Work and a Responses API beta.

Neither feature is inherently unsafe, but both increase how much a single manipulated instruction — via prompt injection in a fetched document, a tool result, or an untrusted subagent output — can propagate before a human sees it. A sandboxed, network-isolated runtime limits some exfiltration paths, but it doesn't stop an injected instruction from steering what code gets written or which of 16 agents takes which action.

What this means for adopters

• Don't grant Sol or Terra tool access or multi-agent orchestration to production workflows without first running your own prompt-injection and tool-abuse testing against the specific integration — model-level safeguards are evaluated on OpenAI's benchmarks, not your data flows.
• Treat the 'High' cybersecurity rating as a procurement signal: workflows that hand the model access to your codebase, ticketing system, or infrastructure warrant a higher bar of review than a general chat deployment.
• Review the linked system card before enabling programmatic tool calling or ultra mode in any environment that touches sensitive systems, and log/monitor agent-issued tool calls the same way you'd monitor a new automated user.

None of this is a reason to avoid GPT-5.6 — it's a reason to test it the way you'd test any newly capable, newly autonomous system before it touches anything that matters.