GPT-6 for everyone: OpenAI rolls out Sol and Luna
OpenAI switched on GPT-6 for everyone in ChatGPT on October 7, 2026, free and paid; Sol and Luna replace GPT-5.6. What the new system card says about safety, prompt injection and benchmarks — and what enterprises should check now. As of October 8, 2026.
CogLake Editorial · 8 October 2026 · 4 min
This article was automatically generated with the assistance of AI. All facts come from the linked primary sources (retrieved October 8, 2026). Vendor claims are labeled as such; the article contains no in-house measurements.
In brief: On October 7, 2026, OpenAI switched on GPT-6 for everyone in ChatGPT, across free and paid plans globally. "GPT-6 Sol" and "GPT-6 Luna" replace GPT-5.6 Sol and Luna there; Codex and ChatGPT Work keep running the September versions, according to the system card. OpenAI says the October models resist jailbreaks better and refuse less eagerly, but they show statistically significant regressions in some safety categories, which OpenAI, after manual review, rates as borderline and mostly low in severity.
Availability: not every channel gets the same model
| Channel | Model state per system card (October 7, 2026) |
|---|---|
| ChatGPT (free and paid, worldwide) | GPT-6 Sol and GPT-6 Luna (October) replace GPT-5.6 Sol/Luna |
| Codex | still GPT-6 Sol/Luna (September) |
| ChatGPT Work | still September versions |
For enterprises this means chat users already see the new model while integration-heavy channels such as Codex and Work still run the older versions. Answers and behavior across channels are therefore not directly comparable. If you want reliable results, run evaluations and regression tests per channel.
What the system card says about safety
The key points of the update, as reported by the vendor:
| Topic | Statement in the system card |
|---|---|
| Jailbreaks | stronger resistance, including multi-turn adaptive attacks; less dishonesty and fewer guardrail workarounds |
| Multi-turn jailbreak evals | slightly lower point estimates than the September versions with overlapping 95% confidence intervals; above GPT-5.6 Sol at every tested attacker budget |
| Prompt injection | "highly robust": 99.99% (Sol) and 99.79% (Luna) robustness in saturated instruction-hierarchy evals (GPT-Red) |
| Preparedness Framework | the October versions are rated High in the Cybersecurity and Biological & Chemical domains; not High for AI self-improvement; the same safeguards as GPT-5.6 |
| Safe completions | statistically significant regressions on standard self-harm (Sol) and on self-harm, gore and sexual content (Luna); manual reviews rated violations borderline and mostly low severity |
| Over-refusal | fewer unfounded refusals and preachy caveats; informational questions on self-harm are more likely answered and paired with professional support referrals |
| Protection of minors | additional classifier-based blocking of self-harm, sexual and gore content for users believed to be under 18 |
| Health | gains on HealthBench Professional; slight HealthBench declines are attributed by OpenAI mostly to the length-based score adjustment |
OpenAI itself notes two caveats: the eval scores come from deliberately difficult, production-derived test sets and do not represent typical production traffic. And comparisons with values from older system cards are of limited validity because datasets, policies and grading details changed. All benchmark numbers are vendor-reported; CogLake ran no measurements of its own.
What enterprises should do with this
- Check channel parity. Chat and Codex/Work show different model states. Re-test existing prompts and workflows against the October model before generalizing results.
- Do not switch governance off. Less refusal is not a blank check: internal rules for sensitive data and topics remain necessary, on top of vendor-described system mitigations such as classifiers and age checks.
- Read prompt-injection figures correctly. 99.99% and 99.79% are vendor evals under lab conditions. For your own agents and RAG pipelines, permissions, source verification and action approvals remain the decisive line of defense.
- Include the "High" rating in risk reviews. If you build AI policy around domain risks, the OpenAI rating is one input — a vendor self-classification, not an independent seal of approval.
- Treat benchmarks as orientation. The scores are length-adjusted and vendor-reported. For model selection, your own use case with your own data is what counts.
CogLake stays model-open: your company decides which model handles a task, with permitted sources and verifiable evidence. See AI Workspace to learn more.
Sources
- OpenAI, "GPT-6 Sol and GPT-6 Luna: October 2026 update" (system card, published October 7, 2026): deploymentsafety.openai.com/gpt-6-october, retrieved October 8, 2026.
- CogLake: AI models, Security, AI Workspace.
As of October 8, 2026.