OpenAI's GPT-5.6 Sol sets a hacking benchmark record as Codex Security ships

AI cybersecurity just hit a new milestone. OpenAI announced that GPT-5.6 Sol set a new state of the art on “The Last Ones” cyber range, one of the toughest hacking skill benchmarks there is.

Offense shipped as defense

Here is the twist: the same skills that would make a dangerous attacker are being shipped as a defensive tool. OpenAI released Codex Security, a plugin that runs a security scan on any codebase you point it at, directly inside Codex.

The loop it promises is the whole security workflow compressed: find the vulnerability, validate it, fix it, before criminals find it first. OpenAI says teams are already seeing the capability translate into real defensive outcomes in production code.

A quiet turning point for developers

Security review has always been one of the most expensive and specialized parts of software work: scarce experts, slow audits, and a cost structure that means most code ships with far less scrutiny than anyone would like.

Codex Security points at a different model, where a security audit becomes something you run like a spell-checker. If that holds up in practice, the economics of secure software change, especially for small teams that could never afford a dedicated security review.

The question that stays open

The uncomfortable part does not go away: every tool that finds holes for defenders describes those same holes to attackers. Capability is symmetric; only the deployment is not.

OpenAI’s bet is that putting frontier-level vulnerability discovery in defenders’ hands, integrated into the tools where code already lives, tilts the balance toward the people fixing things. The race between AI that breaks code and AI that fixes it is now officially on, and both runners are the same model.

Would you trust an AI security audit over a human one? For teams that currently get neither, the answer may not need to be philosophical.