OpenAI's most powerful model went public — but nobody can say how the government decided it was safe

Information Technology 5 min 80 sources

GPT-5.6 cleared a US government review and shipped to everyone on Thursday. The people who study AI safety for a living say they have no idea what the review actually checked.

Key takeaways

OpenAI's GPT-5.6 went public after a US government review, but AI-safety experts — including people at the frontier labs — say they can't see what the review actually checked.
The AI pitch has shifted from "smarter" to "cheaper": OpenAI says its new model does the same coding work using 54% fewer tokens, as enterprises watch their spending.
A wave of AI money is arriving before anyone asks — one startup let its own AI agent run a $100 million raise, pulling $400 million in interest without a founder leaving the office.

The biggest thing in AI on Thursday wasn’t the model. It was the permission slip.

OpenAI got a government green light — and nobody can see the reasoning

OpenAI released GPT-5.6 to the public on Thursday, ending roughly two weeks in which its most capable model was available only to a handful of “government-approved organizations” [37]. The restriction wasn’t OpenAI’s idea. Late last month, the US government asked the company to limit the rollout, citing worries about the model’s cyber abilities [3]. On Thursday, the Trump administration lifted the limit and let the model go out to everyone [37].

Here’s the part worth sitting with: almost no one outside the room can say what the government checked, or what “safe enough” meant.

Sam Altman, OpenAI’s CEO, said the company worked with Commerce Secretary Howard Lutnick, Treasury Secretary Scott Bessent, and National Cyber Director Sean Cairncross in what he called a “collaborative back and forth” — the government running tests, raising problems, OpenAI fixing them [4]. That’s the vendor’s account. When TechCrunch asked people who study this for a living, the answers were blunt. Mina Narayanan, a security analyst at Georgetown’s Center for Security and Emerging Technology, said she doesn’t have visibility into the process and can’t say whether it’s adequate [35]. Dean Ball, a former Trump policy advisor now working at OpenAI, wrote last month that “nobody knows what the requirements are to get licensed” [35]. Andy Konwinski, who co-founded Databricks and Perplexity, said he’s never met anyone who understands the process — including people who work at the frontier labs [35].

“It’s existentially a problem,” Konwinski told TechCrunch. “Safety or not, it’s about who has the power to make decisions — who gatekeeps and decides on permissions?” [35]

A new gate has appeared in front of frontier AI: a government sign-off before a powerful model reaches the public. Anthropic’s Fable model went through a version of the same thing — briefly cut off from public access, then cleared after the company said it built a jailbreak-detection system and closed some gaps [35]. The gate is real. What’s missing is any published standard for what passing it means. For anyone building on these models, that’s the thing to track: not the benchmark scores, but whether the approval process ever becomes something you can read.

What actually shipped: a coding race and a pivot to “efficiency”

Underneath the permission drama, OpenAI shipped a lot. GPT-5.6 comes in three sizes — Sol (the workhorse), Terra (mid-range), and Luna (the cheap one) [3]. OpenAI calls Sol its “strongest cybersecurity model yet,” built for defensive work like reviewing code for holes and patching them before attackers find them [3]. That defensive framing is not incidental — the cyber strength is exactly what got the model held back in the first place [3].

The pitch has shifted from “smarter” to “cheaper per job.” Altman told CNBC that Sol is 54% more token-efficient on agentic coding — meaning it does the same coding work while consuming a little over half the tokens, the billable units of text a model reads and writes [4]. “Every enterprise now is thinking about spend and the value they’re getting in exchange for AI,” Altman said [4]. When a company leads with efficiency instead of raw capability, it’s usually a sign the capability gap has narrowed and the fight has moved to price.

OpenAI also launched ChatGPT Work, an agent that combines ChatGPT with its coding tool Codex so non-programmers can hand it whole tasks — pulling context from Slack, Gmail, Google Drive, and calendars to produce documents, spreadsheets, and slide decks [37]. It’s a direct shot at Anthropic’s Claude Cowork [37].

And OpenAI wasn’t alone on Thursday. Meta launched Muse Spark 1.1, its own coding model built for the same agentic, multi-step work, explicitly chasing OpenAI and Anthropic after spending billions to catch up [1][5]. Two of the largest companies in the world shipped near-identical coding tools on the same day — a good measure of how crowded this particular corner has become.

An AI agent raised its own money

The quieter story of the day says something about the moment. Lyzr, a three-year-old startup in Jersey City that helps companies build AI agents, used one of its own agents to run its $100 million funding round [6]. The agent, called SivaClaw, fielded questions from more than 130 investors, drafted the investment memos, and even tracked which pitch-deck slides backers lingered on [6]. It raised the round at a roughly $500 million valuation while doubling as a live demo of the product [6].

The detail that lands isn’t the agent — it’s how little effort the humans put in. Lyzr said it drew $400 million in interest from Silicon Valley, the Middle East, and finance without a founder flying out for a single coffee meeting [6]. That’s less a story about clever software than about money: there is so much capital chasing AI right now that a founder with traction can raise nine figures without leaving their desk. The same flood showed up elsewhere Thursday — Ollama, an open-source tool that lets developers run AI models on their own PCs, raised $65 million and said it’s near 9 million users [21].

Cheap models, gated releases, and money that arrives before you ask for it. The three stories are one story about an industry moving faster than the rules meant to hold it.

02 · Lesson · why it matters

The stamp that hides its own reasons

An approval you can't inspect doesn't tell you a thing is safe — only that someone with the power to say yes said it.

A green light with the reasons painted over

On Thursday, the US government let OpenAI’s most powerful model out to the public. For two weeks it had been held back over worries about what it could do. Then the worry lifted, and everyone got access.

Now ask a simple question: what changed? What did the review check, and what did “safe enough” turn out to mean?

The people best placed to answer said they don’t know. A security analyst at Georgetown said she can’t see the process, so she can’t say if it was adequate. A former government advisor — who now works at OpenAI — wrote that nobody knows what the requirements even are. A veteran who helped found two of the biggest names in the field said he’s never met a single person who understands how the decision gets made, including people inside the labs.

So we have a stamp that says “safe.” We have no way to read what’s under it.

What a stamp is supposed to do

A stamp of approval is a compression trick. Somewhere, someone did a lot of hidden work — tested, measured, poked for holes. All of that gets squeezed into one word you can lean on without repeating it yourself. “Inspected.” “Certified.” “Cleared.” The word saves you the labor of checking.

That trick only works if two things are true. The checking has to be real. And it has to be the kind of thing you could, in principle, look at. Not that you will — almost no one reads the safety report. But that someone independent could, and would raise a hand if it were empty.

Take away the second part and the word stops carrying information. From the outside, “we reviewed it carefully and it passed” and “we didn’t really look” produce the exact same stamp. If you can’t tell those two apart, the stamp isn’t telling you the thing is safe. It’s telling you someone with authority is willing to say so. Those are not the same fact, and the gap between them is invisible until the day it isn’t.

We are built on stamps we can’t read

This isn’t a story about AI being special. It’s a story about how much of ordinary life already runs on borrowed judgment.

You can’t test your own drinking water, audit the bank holding your money, re-derive the safety of the bridge you drive over, or check the training of the surgeon before the anesthesia. So you don’t. You rely on a stamp — a rating, a license, a certification, a “reviewed by experts.” Trust like this isn’t weakness. It’s infrastructure. No one has the hours or the expertise to verify everything, so we delegate the checking and get on with our day.

The whole arrangement rests on a quiet promise: that behind each stamp, someone competent and independent actually looked, and that if they hadn’t, we’d eventually find out. Most days the promise holds. We only notice it exists on the days it doesn’t.

Who holds the stamp, and by what rule

Here’s the part that poses as natural but was a choice. A new gate appeared in front of these models in a matter of weeks — a government sign-off before a powerful system ships. That may be wise. A model strong enough to find security holes is a real thing to be careful with. But no published standard came with the gate. There’s the vendor describing a “collaborative back and forth” with named officials, and there’s the absence of any outside account of what that back-and-forth required.

Notice how close the players stand. The company describes its own review. A former official now draws a paycheck from the company he once might have regulated. The line between the checker and the checked gets thin. And the independence of a stamp is exactly the thing you can’t verify from the outside — you have to take that on faith too.

None of this means the review was bad or the model is dangerous. It might have been careful and the model might be fine. The point is narrower and harder: you cannot tell from here, and neither can most of the experts.

The seat you’re sitting in

It’s tempting to file this under “the AI companies and the government,” a fight between big players far from your desk. But look again at who’s downstream. Everyone who will type into these tools — you, probably, soon — is now relying on a yes whose reasons are sealed. And so is nearly everyone upstream. Even the engineers building the models can’t see the gate their own work has to pass through.

That’s the strange shape of it. There’s no room where someone holds the full picture. The regulator sees the tests they ran. The company sees its own fixes. The analyst sees a press release. Each seat catches a slice and calls it the view. The confidence you feel about a stamp is usually just the size of your particular slice.

What to carry

The humble move isn’t to distrust every stamp. You’d never leave the house. And it isn’t to trust this one because powerful people signed it. It’s to keep hold of one distinction that’s easy to lose: a verification you could check, even if you never do, is a different kind of thing from a yes you couldn’t check even if you tried.

Most of the trust that carries your day is the first kind, and it’s earned. Some of it is the second kind wearing the same uniform. Seeing which is which — and admitting how often you can’t tell — is the whole of it. We lean on far more borrowed judgment than we ever inspect, and we are, all of us, standing on stamps we’ve never read.

03 · Lab · your turn

Read the Stamp

Rehearse relying on approvals you can and can't inspect, and feel how a sealed stamp carries the word "approved" but no information.

04 · Hope · carry this

The very fact that we can name what's missing — a review we can't read, a stamp we can't check — is the first step toward asking for one we can. Open processes don't appear on their own; they get built, slowly, by people who kept pointing at the sealed door until it opened.