GPT-5.6 Explained: Three Variants and OpenAI's First Government Review of an AI Model

An Unusual Release

On June 26, OpenAI released its next-generation model, GPT-5.6. Unlike previous launches that went directly to all users, this time OpenAI took an unprecedented path—first handing the model to the U.S. government for review, with only a small-scale private beta. This "government reviews first" release process is a first not only for OpenAI but for the entire AI industry, and the signal it sends may deserve more attention than the model's performance itself.

GPT-5.6 introduced three variants at once, while also rewriting OpenAI's naming conventions: the number represents the generation, and the variant name represents the capability tier. This new naming logic makes product positioning clearer, and marks OpenAI beginning to segment users with different needs in a fine-grained way, like a mature commercial company. Notably, the three-tier naming of Soul/Terra/Luna borrows from conventions in the chip industry (such as Intel's Core i3/i5/i9) and cloud computing service tiers—which also means OpenAI is shifting from "selling models" to "selling service tiers," where price anchoring and capability positioning matter more than raw parameter scale alone.

Three Variants, Three Positions

The three newly released versions have clearly divided roles:

• Soul: The flagship variant, with the strongest capabilities and the highest price. Calculated per million tokens, input costs $5 and output costs $30.
• Terra: Aimed at high-frequency daily work scenarios, with performance comparable to the previous generation GPT-5.5, at only half the price of Soul.
• Luna: Focused on speed and cost savings, with the lowest barrier—input is just $1 and output $6.

On the caching mechanism, GPT-5.6 also becomes more controllable, supporting explicit breakpoints, with cache hits still billed at just 10% of the rate. Behind this lies the KV Cache (key-value cache) mechanism in large model inference—its technical roots are grounded in the attention computation principles of the Transformer architecture. Since Google introduced the Transformer in 2017, the self-attention mechanism has become the core computational unit of large language models: when the model processes input, it computes key (Key) and value (Value) vectors for each token. In autoregressive generation mode, every newly generated token requires access to the K/V vectors of all preceding tokens, and if recomputed each time, the computational load grows quadratically with sequence length. KV Cache stores the already-computed K/V vectors in GPU memory, allowing subsequent generation steps to read directly from the cache, reducing computational complexity from O(n²) to O(n)—a key optimization on the engineering side for reducing inference latency. When a user repeatedly submits the same prefix content across multiple requests (such as system prompts, long documents, or code repositories), a cache hit means there's no need to recompute those tokens, significantly reducing both inference latency and computational cost.

Support for explicit breakpoints further improves controllability: it allows developers to precisely mark "reusable boundaries" within prompts, avoiding a situation where a single character change at the end of the prompt invalidates the entire cache block. For enterprise-grade applications using long system prompts, RAG (Retrieval-Augmented Generation) document injection, or code repository context, explicit breakpoints can reduce token costs by 40%-70% while making latency more deterministic, which facilitates SLA (Service Level Agreement) commitments.

Two Capability Upgrades: Max and Ultra

Beyond variant tiering, GPT-5.6 brings two new features at the capability level.

Max reserves the longest thinking time for the flagship Soul variant, used to handle complex problems requiring deep reasoning. Essentially, it trades "time for quality"—slowing the model down on critical tasks so it can think more thoroughly. This mechanism is closely tied to what the AI field calls "Test-Time Compute Scaling," whose theoretical basis extends from thinking about "training-time Scaling Laws." The Scaling Laws proposed by OpenAI in 2020 showed that increasing model parameter count and training data volume predictably improves performance; research by institutions like DeepMind further found that increasing the compute budget during the inference phase—for example, through Best-of-N sampling, Tree of Thought search, or iterative self-correction—can also yield significant performance gains, and on certain tasks offers better cost-effectiveness than simply scaling up model size.

Traditional models' reasoning capabilities are primarily determined during the training phase, whereas test-time scaling allows the model to invest more computational resources during inference, improving answer quality by extending the Chain-of-Thought or performing multiple self-verifications. Research shows that in structured reasoning tasks such as mathematical proofs and code debugging, the gains from increasing test-time compute sometimes even exceed those from expanding model parameters themselves. It's worth mentioning that OpenAI's o1 series has already commercially validated the feasibility of this path, and the Max feature further productizes the "slow thinking" mechanism—which also hints that future AI pricing may evolve from "billing per token" to "billing per compute time," moving closer to the elastic resource model of cloud computing.

Ultra takes a more radical approach, no longer relying on the capability ceiling of a single agent but instead mobilizing a group of sub-agents to work in parallel, jointly completing complex tasks. This represents an important evolution of AI architecture from a monolithic LLM to a Multi-Agent System. When combining multi-agent systems with large language models, several unique engineering challenges arise: the orchestrator model needs to accurately break down complex tasks into subtasks that can be executed in parallel, and decomposition errors can lead to cascading amplification of deviations; each sub-agent needs sufficient background information to complete its task, but passing along the full main-task context multiplies token consumption; multiple sub-agents may also produce mutually contradictory intermediate conclusions, requiring the orchestrator to have conflict-resolution capabilities. Even more concerning is the "hallucination amplification" effect—a hallucination from one sub-agent may be treated as fact and processed further by other agents, with errors cascading along the call chain.

The academic roots of multi-agent systems can be traced back to distributed artificial intelligence research in the 1980s. Current mainstream frameworks include Microsoft's AutoGen, CrewAI, and LangGraph. Combining them with large language models is an engineering practice that has only truly materialized in the past two years. Ultra encapsulates this complex coordination logic as a product-grade capability, meaning developers can invoke an "agent cluster" without building their own orchestration layer. The core challenge lies in how to balance information sufficiency against token cost, and how the overall protection mechanism responds when a sub-agent produces harmful content.

In the officially published benchmarks, the Terminal Bench in the programming domain achieved a new high score, and its performance on biology benchmarks was also more token-efficient than GPT-5.5. It should be noted that these results are currently self-disclosed by OpenAI, and independent reproduction and verification will only be possible once the model is truly opened up.

The Real Focus: Cybersecurity Capabilities

If performance improvements are routine, then the true core topic of this release is cybersecurity.

One of GPT-5.6's headline capabilities is finding vulnerabilities and researching how to exploit them. OpenAI stated that in tests targeting the Chromium and Firefox browsers, the model could not only find vulnerabilities but also piece together the "components" used to launch attacks.

This involves a core concept in cybersecurity: a zero-day vulnerability refers to a security flaw not yet known to the software vendor, and therefore without a patch. "Zero-day" means that once the vulnerability is publicly disclosed, the vendor has zero time to fix it—the vulnerability is exploited before a patch is released, giving it extremely high attack value. A complete exploit chain is the core technical path of a cyberattack, usually requiring multiple vulnerabilities to be chained together to complete the full process from "discovering a flaw" to "gaining control." Take a browser attack as an example: the first step exploits a rendering engine vulnerability (such as a type confusion vulnerability in the V8 JavaScript engine) to execute arbitrary code; the second step uses an information-leak vulnerability to bypass ASLR (Address Space Layout Randomization)—a fundamental defense mechanism in modern operating systems that prevents attackers from predicting code locations by randomizing memory address layouts; the third step breaks browser process isolation through a sandbox escape vulnerability (sandbox isolation separates the browser's rendering process from the rest of the operating system, preventing a single vulnerability from compromising the entire system), ultimately gaining control of the operating system.

Each step requires specialized security knowledge, and traditionally only experienced security researchers or nation-state APT (Advanced Persistent Threat) organizations possessed full-chain capabilities. AI's involvement makes some of these stages (especially vulnerability pattern recognition and PoC code draft generation) automatable, which lowers the research costs for defenders while also potentially lowering the technical barrier for attackers—forming a classic "double-edged sword" effect. GPT-5.6's test results show that AI can already complete the first few steps of "component assembly," but fully autonomous construction of an attack chain has not yet been achieved.

However, under test conditions, it still cannot autonomously build a complete attack chain from start to finish. According to OpenAI's own Preparedness Framework, Soul did not cross the "cyber critical" red line—but it's worth noting that it is getting increasingly close.

This framework is OpenAI's internal risk assessment system officially released in late 2023, the industry's first systematic and publicly disclosed frontier-model risk assessment framework, specifically designed to measure the potential harm of frontier models across four high-risk domains: cybersecurity, chemical/biological/radiological/nuclear weapons (CBRN), deceptive alignment, and autonomous replication capability. Its institutional design borrows from the dual-use research of concern (DURC) oversight mechanism in the field of biosafety—a mechanism that originated from the global controversy sparked by the 2011 H5N1 avian flu enhanced-transmissibility research, after which the scientific community established a convention of special review for "research reasonably believed to be susceptible to misuse for large-scale harm." Each dimension is divided into four levels by degree of harm: low, medium, high, and critical. "Critical" means the model's capability could cause irreversible systemic harm to society—the framework stipulates that reaching "critical" should in principle not be released, and it establishes a dedicated Safety Advisory Group responsible for grading.

Its core methodology is Red Teaming, borrowed from the military and cybersecurity fields, referring to assembling a dedicated team to play the attacker's role and systematically attempt to trigger the model's harmful outputs or find protection loopholes, thereby identifying risks before release. Critics also point out that this framework is currently still a form of self-assessment: the framework's designer, executor, and the subject being assessed are all OpenAI itself, lacking independent third-party verification, and the framework's designer being simultaneously the assessed subject creates a structural conflict of interest. GPT-5.6 was rated as close to but not crossing the "critical" red line in the cybersecurity dimension, which is precisely the direct reason for initiating the government-review-first process this time.

For this reason, OpenAI equipped GPT-5.6 with a three-layer protection system.

Three-Layer Protection System

Model level: Directly training the model to refuse illicit cyberattack requests, so that even if a user attempts to disguise their intent or perform a jailbreak, it is difficult to break through. This layer of protection is implemented through reinforcement learning from human feedback (RLHF) and updated alignment techniques, embedding the safety boundary into the model weights themselves rather than relying solely on external filtering. "Training in" the ability to refuse illicit requests is theoretically harder to circumvent than runtime filtering—jailbreaking requires simultaneously cracking the model's internal logic rather than merely bypassing an outer-layer check. But research also shows that existing alignment techniques are imperfect, and adversarial prompting can still break through protections under certain conditions, which is precisely the significance of having a three-layer protection system.

Output level: During generation, real-time classifiers continuously check the output content. Once an anomaly is detected, the response is paused and handed over to a larger model to review the context before deciding whether to release it.

Account level: There is also an account-level review mechanism, used to distinguish between "momentary suspicious behavior" and "long-term malicious intent." This behavior-history-based risk judgment shares the same lineage as User and Entity Behavior Analytics (UEBA) in the cybersecurity field—UEBA originated in enterprise cybersecurity, and its core idea is to establish a "normal behavior baseline" for each account through machine learning, detecting statistical deviations (such as abnormal access times, rare API call sequences, or sudden shifts in content topics) to identify systemic threats. Applying this logic to LLM platforms means that even if a user's single query appears harmless, the system will combine their historical request patterns to judge intent, identifying systematic malicious behavior that gradually probes the system's boundaries. Of course, this also involves a delicate balance between user privacy protection and security monitoring, as well as the risk of the behavior-baseline model misjudging non-mainstream usage patterns.

To ensure this protection remains effective in real attack environments, OpenAI invested over 700,000 GPU hours, actively using its own model to uncover universal jailbreak vulnerabilities. This number itself shows that safety investment is no longer a pre-release "going through the motions," but a systematic engineering effort on par with capability development.

Why Let the Government Review First

It is precisely this cybersecurity capability, combined with that red line not yet crossed but already imminent, that prompted OpenAI to make an unusual decision: before full release, pass the government's review first.

OpenAI notified the U.S. government of its release plan and model capabilities in advance, and at the government's request, first provided a private beta to a small group of trusted institutions, with the relevant list also reported.

This move reflects the broader backdrop of the accelerating formation of the global AI governance landscape. The 2023 U.S. Executive Order 14110 required developers of large AI models to report safety testing results to the government before release; the EU AI Act took effect in 2024 as the world's first systematic AI legislation, dividing AI systems into four risk tiers—unacceptable risk (outright ban), high risk (strict regulation), limited risk, and minimal risk—setting clear compliance requirements for "high-risk" and general-purpose AI systems (GPAI), including mandatory safety assessments, transparency obligations, and registration and record-keeping. Systems with cyberattack-assistance capabilities could theoretically fall into the high-risk or even unacceptable-risk range.

The first AI Safety Summit held at Bletchley Park in the UK in November 2023 was an important milestone in multilateral coordination for global AI governance. The Bletchley Declaration, signed by 28 countries and the EU, for the first time confirmed at the intergovernmental level a political consensus that "frontier AI poses catastrophic risks," establishing an international mechanism for "frontier model safety testing" coordinated by countries' AI safety institutes. Since then, major economies including the UK, the U.S., the EU, Japan, and Singapore have established AI safety institutes one after another, and at the 2024 Seoul Summit signed the more operational Frontier AI Safety Commitments, requiring signatories to conduct safety assessments after model training is complete and before release, and to share assessment methods with other governments. This process resembles the International Atomic Energy Agency (IAEA) inspection mechanism in the nuclear non-proliferation field, but for now it remains a "soft law" framework lacking means of mandatory enforcement.

Against this backdrop, OpenAI proactively inviting the government to participate in the release process is both a response to regulatory pressure and a way of shaping an industry precedent—whoever first establishes the action template for "responsible release" may occupy a favorable position in future regulatory dialogues. The release of frontier models is no longer merely a business decision but a societal event that needs to incorporate a public governance perspective.

You may not have noticed, but OpenAI itself also emphasizes that this "government reviews first" process should not become the default practice in the future—because it would hinder the developers and defenders who truly need these tools. For now, this is just a short-term transitional arrangement.

Therefore, the number of people who can currently use GPT-5.6 is very limited. The private beta will proceed through direct API connections and GPU resource allocation processes, after which OpenAI and Codex will open up to a wider range of institutions, which the company says will be within the coming weeks. In addition, hardware support from Cerebras will launch in July, claiming to output 750 tokens per second.

Cerebras is an AI hardware company focused on wafer-scale chips (Wafer-Scale Engine, WSE), and its technology represents a fundamental paradigm shift in AI chip design. In traditional AI computing architectures, the bandwidth wall (Memory Wall) between compute units (GPU/TPU) and memory (HBM), as well as inter-chip interconnect latency, are the key bottlenecks constraining inference speed: NVLink's inter-chip bandwidth is about 900GB/s, while the WSE-3 has about 44GB of on-chip SRAM with a bandwidth of 21PB/s, roughly two orders of magnitude higher. Traditional GPUs and TPUs package multiple chips on a single PCB, communicating between chips via high-speed interconnects, and inter-chip communication remains a significant latency bottleneck; the WSE designs an entire 300mm silicon wafer as a single processor, containing about 400,000 AI-optimized compute cores, completely eliminating inter-chip communication overhead. The engineering challenge of the WSE lies in the yield problem of wafer-scale manufacturing—Cerebras solved this manufacturing challenge through redundant circuit design (bypassing defective cores). The speed of 750 tokens/second is roughly 5 to 10 times the inference speed of a traditional GPU cluster, meaning users can barely perceive output latency, which is significant for security analysis and code generation scenarios that require real-time responses.

How to Release Is Becoming as Important as Capability Itself

Looking back at the entire release, its most special aspect is not any benchmark score, but a company proactively hitting the pause button on its most powerful model and submitting to government scrutiny first.

There has never been a precedent for this. It reflects an emerging industry trend: as model capabilities continually approach the critical point where they could be misused, the question of "how to release, and who can use it" is becoming as important as—or even more sensitive than—"the capability itself."

Of course, the officially self-disclosed benchmark results still need to be independently verified by third parties once the model is truly opened up. But regardless of the final performance, the release philosophy of "balancing capability with governance" represented by GPT-5.6 may well foreshadow a profound shift in how frontier AI models enter the market.

Key Takeaways