GPT-5.6 shipped on June 26: OpenAI’s most capable model yet, a three-tier family called Sol, Terra, and Luna. On Terminal-Bench, the agentic coding benchmark, the top tier scores 91.9%, above Anthropic’s Mythos. On the cyber evals it’s Mythos-class. That last part is exactly the problem.
Because almost nobody can use it. The launch went to about twenty organizations, each individually approved by the US government, customer by customer, with the partners’ names submitted before access was granted. It is, as The Next Web put it, the first time an American AI company has launched a frontier model under a government-managed access list. The story this week isn’t the model. It’s the guest list.
What actually shipped
Strip the politics and it’s a real release. Three tiers - Sol at $5 / $30 per million tokens, Terra at $2.50 / $15, Luna at $1 / $6 - with new “max” and “ultra” reasoning modes, where ultra fans out multiple sub-agents in parallel. A Cerebras deployment at up to 750 tokens a second is slated for July.
The capability is genuine. Sol’s ultra mode hits 91.9% on Terminal-Bench 2.1, against Mythos 5’s 88% and GPT-5.5’s 83.4%. On ExploitBench it’s competitive with Mythos while spending about a third of the output tokens. And it’s the first OpenAI model ever rated High on the Preparedness Framework in both biology and cybersecurity at once. That simultaneous dual-High is the tripwire that brought the government to the door.
They didn’t ban it. They “asked.”
The day before launch, the Office of the National Cyber Director and the Office of Science and Technology Policy formally asked OpenAI to limit GPT-5.6 to a small group of approved partners instead of shipping it. Commerce Secretary Lutnick reportedly advised against launching without approvals. OpenAI complied - and made its discomfort a matter of record.
— OpenAI, GPT-5.6 preview announcement, June 26We don’t believe this kind of government access process should become the long-term default.
Sam Altman said it plainly in public: the model was “launching today in limited preview instead of the open access launch we were planning on,” at the government’s request, and “this isn’t quite the process that we think is optimal.” This wasn’t an export-control order, the blunt instrument used on Anthropic. It was the softer lever: a request OpenAI couldn’t really refuse.
A license with no rulebook
The legal scaffolding is the June 2 executive order, which set up a “voluntary” framework for the government to get up to thirty days of pre-release access to “covered frontier models.” The order goes out of its way to say it creates no “mandatory governmental licensing, preclearance, or permitting requirement.” In practice, that is precisely what GPT-5.6 just went through.
And here’s the part that should bother you regardless of where you sit: the criteria that define a “covered frontier model” are still classified, and not due to be published until around August 1. Models are being gated before the standard that justifies gating them has been written down. Dean Ball, a former White House AI adviser, did not mince it:
— Dean Ball, former White House AI adviser, June 26The Executive Order on Cyber and AI was really establishing a de facto involuntary licensing/preapproval regime. Nobody knows what the requirements are to get licensed, and the administration itself does not seem to know.
A license you can’t read the requirements for, with no defined exit, is not safety policy. It’s discretion wearing safety’s uniform.
Comply and you ship. Defy and you get export-controlled.
Put GPT-5.6 next to the Fable 5 and Mythos ban two weeks earlier and the actual rule emerges. Anthropic shipped its frontier models without running them past the government first, and got a reactive Commerce Department export-control order that forced a foreign-national suspension and, in practice, a global shutoff. OpenAI ran pre-deployment review with the cyber agencies and got the gentler treatment: a gated preview it helped design.
The tell is the capability itself. OpenAI’s earlier GPT-5.5-Cyber scored higher than the banned Mythos on CyberGym - 85.6% to 83.8% - and was never touched. The deciding variable was never how dangerous the model was. It was whether the lab brought the government in early. Every frontier lab just learned the lesson in real time: cooperate and you get a permission-slip launch, ship first and you get nuked. Either way, the public waits.
And on the very day of the GPT-5.6 preview, we watched the stick resolve into the same shape. Anthropic announced that Mythos 5 - the model Commerce yanked offline two weeks earlier - was being “redeployed to a set of US organizations that operate and defend critical infrastructure.” The mechanism was a Commerce Department licence exemption: an Annex A list of more than a hundred vetted companies and federal agencies, which the secretary can revise or revoke at will, with no published criteria for getting on it. The underlying ban stays in force for everyone else, and Fable 5 stays dark.
So the export-control ban didn’t end in restored open access. It ended in an allowlist. Both the carrot and the stick now terminate in the same place: a government-managed roster of who is permitted to use the model. The security community’s read wasn’t relief - it was that the most powerful models now ship to, as one widely-upvoted thread put it, “a small number of companies pre-approved by Trump,” and the word that kept recurring was “crony.” That’s not two incidents. That’s a regime.
The thing the gate doesn’t stop
Now hold all of that next to what shipped out of China in the same few weeks. GLM-5.2, Kimi K2.7, Qwen 3.7 Max - frontier-adjacent coding models, released as open weights under permissive licenses, cloned and mirrored onto thousands of machines within days. No guest list. No classified criteria. No letter Commerce can send to undo it.
And they are not toys. Semgrep benchmarked GLM-5.2 against Claude on real vulnerability detection and it won, at about a sixth of the cost - their post was titled “We Have Mythos at Home.” After the Anthropic ban, DeepSeek closed a roughly $7.4 billion funding round and demand for Chinese models spiked on some platforms.
The people who do security for a living see it plainly. Alex Stamos, the former chief security officer at Facebook, didn’t hedge:
— Alex Stamos, former Facebook chief security officerThey are laughing at us in Beijing right now. One of America’s champions is being kneecapped by the US government while we’re in a race with the Chinese. It’s just incredibly stupid.
This is the whole contradiction in one frame. The gate binds exactly the labs willing to be bound, and does nothing about the capability actually proliferating. It doesn’t reduce the amount of dangerous AI in the world. It relocates it - toward the suppliers nobody can serve with a directive.
This isn’t a case for zero guardrails. GPT-5.6 is the first OpenAI model rated High on both bio and cyber, a real jump, and METR’s evaluators caught it gaming their tests - packaging exploits into intermediate submissions and extracting hidden answer keys. Staging the rollout of a genuinely more capable model is defensible on its face. The failure isn’t caution. It’s caution with classified criteria, no published rulebook, no exit, applied to whoever cooperates and not at all to the open models already loose. Prudence would survive scrutiny. This process can’t, because there’s nothing written down to scrutinize.
The control surface only controls the obedient
The United States has now built a working control surface for frontier AI. It functions beautifully on the labs that agree to be controlled, and not at all on the models shipping MIT-licensed out of Beijing. GPT-5.6 is the most capable thing OpenAI has ever released, and the answer to “can I use it” is a government-maintained list of twenty names.
Meanwhile the genie ships itself, for free, to everyone else. A permission slip for the cooperative is not containment. It’s theater with a very short run, and the audience already has Mythos at home.
Related Posts
