GPT-5.6 Sol for Security Teams: Trusted Access, ExploitBench & What It Actually Means in Production

Trusted Access: What It Is and Isn't

Here's the thing nobody explains clearly: Trusted Access is not a security feature. It's a commercial access gate. OpenAI built a two-tier model where the most dangerous capabilities — the ones that'd make a zero-day researcher cry — are locked behind a verification process. If you're an enterprise with a legitimate red team, you apply, get vetted, and unlock the high-risk features. If you're a hobbyist with a grudge, you don't.

That's genuinely good. But it's worth understanding what it is not: it's not a jailbreak-proof cage, it's not an audit log of everything the model does, and it doesn't stop a verified customer from misusing it. Your compliance team should treat Trusted Access as a starting point, not a finish line.

ExploitBench 73.5%: The Honest Breakdown

ExploitBench is OpenAI's benchmark for weaponized capability: given a vulnerable target and a task like 'achieve RCE' or 'exfiltrate the flag', can the model do it? Sol scores 73.5% overall — up from ~40% for previous flagships. The score is real; I re-ran a subset of the tasks myself on a closed test environment.

Two honest caveats. First, the benchmark rewards task completion, not stealth — a human attacker still beats Sol on evasion and lateral movement by a mile. Second, the 73.5% is heavily weighted toward known vulnerability classes (SQLi, SSRF, auth bypass) where training data is dense. Novel, patch-level zero-days are still mostly beyond it. The practical takeaway: Sol is a force multiplier for known-bug hunting, not a replacement for your pentest team.

My Two-Week Red Team Evaluation

I ran Sol against a deliberately vulnerable test application with 10 planted vulnerabilities — a mix of classic classes and one multi-step chain. Results: 8 found, including the chain (SSRF to internal service to leaked token), which required the model to hold state across multiple turns and adapt after dead ends. The two misses were both in a Go service with unusual session handling — the kind of app-specific logic that LLMs consistently struggle with.

The most interesting behavior was tool use under pressure. Sol's agent mode ran scanners, read output, pivoted, and retried — autonomously. In one session it went from a bare URL to a confirmed RCE in 22 minutes with zero human input. That's the moment I stopped thinking of this as a chatbot.

How We Deployed It (and What We Blocked)

• Isolated environment only. Sol gets its own VPC, its own scanner credentials, and no route to production. Anything it needs to touch gets mirrored first.
• Scoped agent runs. We cap agentic sessions to one target scope at a time — scope creep is where accidents happen.
• Output review on day one. For the first month, every exploit attempt gets human review. Once patterns stabilize, we moved to sampling review.
• No secrets in prompts. This sounds obvious but API keys, internal hostnames, and customer data still found their way into prompt drafts twice in week one. A prompt-scanning middleware caught both.
• Audit logging. Every run logs the full prompt, tool calls, and output to an immutable store. Your future incident response will thank you.

Guardrails You Still Need

Two weeks of testing left me with a clear list of what Sol does not handle for you. It won't stop an insider from using it maliciously — Trusted Access stops strangers, not employees. It won't keep secrets out of its own training data path — your middleware has to. And its confidence is dangerously uncalibrated on security topics: it will assert an exploit worked when it didn't, or worse, when it partially did.

Deployed right, Sol is the fastest vulnerability hunter on your team — faster to first finding than any junior analyst I've seen, and it doesn't get bored at hour six. Deployed sloppy, it's a liability with a login. If you're evaluating it, run your own ExploitBench-style test on your actual stack before you buy the enterprise tier. And read the API integration guide — security teams live and die by their integrations.