AI Safety Research Digest — July 10, 2026

A red-teaming result squarely in this project’s territory: a government AI safety institute reports a universal jailbreak class in a newly released frontier model, with autonomous exploitation as the elicited capability.

Key Findings

  • UK AI Security Institute (AISI) reports universal cyber jailbreaks in GPT-5.6 Sol. Per Fortune’s July 10 report, AISI’s red team — led by Xander Davies — found jailbreaks that bypassed GPT-5.6 Sol’s safety training well enough to unlock “vulnerability discovery and exploit development,” and reported the model then “autonomously complete[d]” one of two cyber-range hacking simulations. Davies posted that the jailbreaks were “often developed within hours,” though AISI had privileged internal access to the model that accelerated the process; he noted the same jailbreaks are “still findable without this access, just slower” — i.e., the internal access shortened time-to-break, it did not create a vulnerability that only exists with that access.
  • This is reported as a sharper result than the June Fable 5 finding. The same report frames AISI’s result as more severe than the vulnerability that led to Anthropic’s June pause of Fable 5 (restored July 1 behind new cybersecurity classifiers — see our July 6 digest): where the Fable 5 issue reportedly unlocked vulnerability identification, AISI’s GPT-5.6 jailbreaks reportedly enabled autonomous exploitation. As of this report, GPT-5.6 had not faced the export-control response that followed the Fable 5 disclosure.

Implications for Embodied AI

We have no independent access to AISI’s methodology or the cyber-range task specification, so we cannot verify the “autonomous completion” claim beyond the reporting cited above — flagged here as a limit on what this digest can confirm, not a reason to omit a result this relevant to our mission. What is methodologically notable for our own work: this is a capability-elicitation result (a jailbreak unlocking a dangerous capability, cyber-exploitation), a different measurement class from our jailbreak_lift metric, which requires a demonstrated baseline text refusal on a named ask before any bypass counts as ASR. AISI’s report does not state whether GPT-5.6 refused the bare cyber-exploitation ask before the jailbreak was applied — that baseline-refusal step is exactly what separates a rigorous jailbreak claim from a capability demo, and its absence here is a gap in the public reporting, not evidence the researchers skipped it.

Curated from independently verified reporting (July 10, 2026), sourced via web search rather than the day’s NLM research scan — docs/daily-research-scans/scan_2026-07-10.md failed this pipeline’s citation gate (0 external source URLs) and was not used as source material. See the citation-gate warning banner in that file for detail.