BitShovel.Discover. Understand. Stay informed.
Add item中

TRACKING · Tracking record

GPT-5.6 Cyber · Records and changes

The GPT-5.6 Cyber preview named in a security study; results remain limited to the described conditions.

00
UNDERSTANDING · What we know

Uses, conditions and important changes.

Each record has its own date and scope; these do not establish the live state of the whole product.

GPT-5.6 Cyber · Recorded by the site · 27 Aug 2026 · Earlier coverage

Trail of Bits field test: a network-capable agent escaped its VM sandbox three times

A Trail of Bits engineer with preview access to GPT 5.6-Cyber (via Patch the Planet) gave it a real challenge: escape the QEMU/KVM VM (Debian 12, AMD Zen3) he uses for sandboxing. It succeeded three times — first via newly disclosed host-kernel bugs, then via disclosed bugs not yet classified as security issues after full updates, and finally by finding several 0-days in freshly rebuilt upstream sources — running autonomously for hours, pulling papers and writing oracles and minimal examples on its own.

[Evidence provenance: Trail of Bits' own blog] One machine, one demonstration — not a systematic benchmark; it targets a cyber-specialized model, and Lobsters upvotes are attention, not proof that the method generalizes to ordinary models or every configuration.

Read the record and sources →

01
THE FULL RECORD · Full timeline

3 events retained by the site.

This object’s records stay together across live coverage, the watch pool and history. Every event links to its source record; corroboration and material changes have separate labels.

Dates use Beijing time. Open an event for its full record, original source and evidence. Corroboration adds support without counting as a material change.

GPT-5.6 CyberEvents retained by the site
  1. On radarEntered the BitShovel radar: 25 entries in the current Lobsters front page feed.
  2. On radarTrail of Bits field test: a network-capable agent escaped its VM sandbox three times
  3. To watch poolThis item has left the current list. Existing records remain available, and later retained material will join the same archive.

02
COVERAGE · Record status

No live card right now.

Coverage status describes how this site maintains its records, not whether a product is worth using. Existing records remain available after leaving the current list.

Registered follow-up scope

These are registered scopes, not complete product coverage or a receipt for the latest successful check.

03
THE LINEAGE · Lineage

Explore earlier and later versions.

These are the established earlier, later and same-series versions. A version relationship does not establish matching uses, conditions or capabilities.

View the line map