UK Researchers Found Broad Cybersecurity Jailbreaks in OpenAI’s GPT-5.6

The findings suggest OpenAI’s newest model may have weaknesses similar to, and potentially more serious than, those that recently prompted U.S. export controls on Anthropic models.

OpenAI’s latest artificial intelligence model can reportedly be manipulated into bypassing safeguards designed to prevent it from assisting with cyberattacks, according to an evaluation conducted by a British government agency before the model’s public release.

The U.K. AI Security Institute, known as AISI, found what it described as “universal jailbreaks” affecting the cyber protections of GPT-5.6 Sol. The techniques allowed researchers to circumvent restrictions and direct the model to perform extended, autonomous tasks involving software vulnerability discovery and exploit development.

The findings were disclosed in a technical system card published by OpenAI alongside the model’s rollout on Thursday.

OpenAI has promoted GPT-5.6 as its most secure model so far. However, AISI’s assessment indicates that users who successfully defeat its safeguards could unlock cyber capabilities that the company intended to restrict.

Researchers were able to develop some of the jailbreaks within hours, according to the report. AISI cautioned, however, that its team had privileged access to internal information and testing tools that would not ordinarily be available to customers or outside attackers.

That access included the exact language of OpenAI’s safety policies, feedback from the classifiers used to identify prohibited requests, and information from the model’s internal safety reasoning system. Those advantages probably accelerated the researchers’ work.

Xander Davies, who leads AISI’s red team, said in a post on X that he believed comparable jailbreaks could still be found without the additional access.

“Exactly how much slower is unclear and an open question,” Davies wrote.

OpenAI said it had reproduced and mitigated the specific techniques identified by AISI. The company did not publicly describe the changes, making it difficult to determine whether they address the broader weakness or only the individual prompts and attack methods used by the researchers.

AISI warned that additional testing would probably uncover similar techniques.

OpenAI said it would continue working with the institute on safeguards and further evaluations. In response to questions about AISI’s findings, the company referred to its GPT-5.6 launch materials, which acknowledge that no AI system can be made perfectly secure.

The company said it uses multiple layers of protection, including monitoring model responses and rapidly addressing newly discovered jailbreaks. OpenAI also said it conducted extensive automated testing before release, including black-box evaluations designed to approximate the level of access available to an ordinary user.

Comparison with Anthropic raises policy questions

The British findings have drawn attention because of their similarities to a jailbreak that recently triggered U.S. export restrictions on two Anthropic models.

Days after Anthropic released its Fable 5 model on June 9, Amazon researchers discovered a way to bypass protections that were intended to prevent general users from accessing advanced cyber capabilities. The technique reportedly allowed the model to help identify software vulnerabilities.

On June 12, the Trump administration imposed export controls on Fable 5 and Mythos 5, the underlying model on which Fable was based. Anthropic subsequently disabled access for all users because it could not reliably verify their nationalities and because the restrictions also affected the company’s employees outside the United States.

Anthropic described the Amazon finding as narrow. The company said the jailbreak unlocked vulnerability discovery but had not been shown to provide broad access to the model’s restricted cyber functions.

At the time, Anthropic said testers had not identified a universal jailbreak capable of bypassing safeguards across a wide range of cyber activities.

The AISI findings concerning GPT-5.6 appear more extensive. The British institute characterized its techniques as universal and said they enabled autonomous exploit development, rather than merely identifying possible flaws.

After two weeks of negotiations, the Trump administration lifted the restrictions on Anthropic’s Fable 5 on July 1. The government and the company also said they would work with other technology groups on a common framework for assessing the severity of AI jailbreaks. OpenAI was not among the companies initially named as participants in that effort.

No comparable export controls have been announced for GPT-5.6.

The White House did not immediately respond to questions concerning the AISI evaluation or whether the administration was considering restrictions.

The different treatment has prompted criticism from some AI policy specialists, who say companies lack a clear understanding of what kinds of model weaknesses will trigger government intervention.

One former AI policy adviser working outside the U.S. government said recent decisions risk creating damaging uncertainty and raise questions about whether authorities are applying consistent standards across AI laboratories.

Lennart Heim, an AI policy researcher, also highlighted the contrast after Davies shared part of the GPT-5.6 system card on X. Heim suggested that the outcome might have been different had Amazon reported the OpenAI vulnerability directly to the White House, referring to the way officials learned about the Anthropic jailbreak.

Davies referred questions about the comparison to the U.K. Department for Science, Innovation and Technology, where AISI is based. A department spokesperson said the institute does not comment on individual release decisions made by AI companies.

Microsoft President Brad Smith has separately warned that unclear U.S. rules governing advanced AI releases are making it harder for businesses to plan. Speaking on the sidelines of the United Nations’ AI for Good summit, Smith called for greater transparency and predictability in federal policy.

OpenAI followed a different release process

The Trump administration had already taken an unusual interest in the rollout of GPT-5.6 because of the model’s cyber capabilities.

On June 25, OpenAI said the government had asked it to release the model gradually, beginning with a limited group of trusted partners. Each participating customer was subject to government approval.

OpenAI said at the time that it did not believe such a process should become the long-term standard. The company described the arrangement as a temporary measure while it worked with the administration on a cybersecurity executive order and a more repeatable procedure for future releases.

Axios later reported that the White House cleared GPT-5.6 for launch on July 8, one day before its public debut. An administration official subsequently disputed that characterization, telling CNBC that companies did not require government permission to release AI models and remained responsible for their own launch schedules.

OpenAI’s system card indicates that GPT-5.6 has advanced offensive cyber abilities approaching those of Anthropic’s Mythos model. In AISI testing, GPT-5.6 autonomously completed one of two simulated network environments used to evaluate hacking performance. Mythos was the first tested model to complete both.

Fable was constructed from Mythos but included additional controls intended to prevent ordinary users from accessing some of the underlying model’s higher-risk cyber, biological and chemical capabilities.

Experts warn that patching individual prompts is not enough

Security specialists said the AISI results should be taken seriously, but cautioned against treating them as evidence that GPT-5.6 is uniquely unsafe.

Margaret Cunningham, vice president of security and AI strategy at cybersecurity company Darktrace and a specialist collaborator with the U.S. National Institute of Standards and Technology, said the findings should not be dismissed or viewed as catastrophic.

Her larger concern, she said, is that AI-assisted offensive research is accelerating while defensive responses still depend heavily on people deciding which vulnerabilities matter, which systems can be patched and which risks must instead be contained.

Stanislav Fort, founder and chief technology officer of AI cybersecurity company AISLE, said fixing the jailbreaks reported by AISI would address only those specific attack techniques.

“Patching what AISI found is necessary, but it unfortunately only closes those specific attack instances, not the category as a whole,” said Fort, who previously worked at Anthropic and Google DeepMind.

Fort said most deployed AI models probably contain undiscovered jailbreaks. Attackers with direct access to a model’s weights, which represent the internal parameters of its neural network, can generally defeat its safeguards. Even without that access, protections can often be circumvented when attackers are given enough time and repeated attempts.

AI developers therefore rely on overlapping safeguards rather than a single impenetrable barrier. These measures can include separate classifiers that identify and block suspicious instructions before they reach the main model, monitoring systems that evaluate responses, restrictions on tool access and post-release investigations of newly discovered techniques.

The challenge is that each defensive layer can introduce another target for researchers or attackers to study.

Fort said AISI’s expectation that additional jailbreaks will emerge represents a realistic security posture. The critical question is not whether any jailbreak exists, but how rapidly it can be discovered, what capabilities it unlocks and whether defensive systems can detect or contain its use.

The GPT-5.6 findings may intensify calls for the United States to adopt a transparent framework that applies the same criteria to every major AI developer. Without one, companies could face dramatically different regulatory consequences for vulnerabilities that are technically similar, depending on how the weakness is discovered, who reports it and which laboratory developed the model.