OpenAI Launches GPT-5.6-Cyber, Expands Daybreak With Blue And Red Access Tiers

OpenAI has launched GPT-5.6-Cyber, a cybersecurity-specific model built on GPT-5.6 Sol, while expanding its Daybreak program with two controlled-access tiers designed to give approved defenders stronger tools for vulnerability research, incident response, penetration testing, and other advanced security work.

TL;DR

 

• OpenAI introduced GPT-5.6-Cyber through its restricted Daybreak Red access tier.
• Daybreak Blue targets broader defensive work, while Red supports advanced vulnerability research, exploit validation, and security testing.
• OpenAI says GPT-5.6-Cyber completed 95% of requests in an internal advanced cybersecurity evaluation.
• Access is limited to approved individuals, organizations, and trusted security partners.

OpenAI is expanding its cybersecurity efforts as the company expects artificial intelligence to significantly increase the speed and scale of cyberattacks.

In its official announcement, OpenAI said threat actors will increasingly use AI to conduct attacks at unprecedented speed and scale, including through autonomous systems, adding that “defenders have a narrowing window to prepare.” TechCrunch also reported on the launch, highlighting OpenAI’s move to expand Daybreak as AI models become increasingly capable of carrying out security-related tasks.

Source

What Are Daybreak Blue And Daybreak Red?

OpenAI’s expanded Daybreak program now offers two levels of controlled access.

Daybreak Blue provides approved defenders access to frontier general-purpose models, including GPT-5.6 Sol, with safeguards adapted for authorized security work. OpenAI recommends Blue for most defenders, covering vulnerability discovery, secure code reviews, malware analysis, incident response, vulnerability management, investigations, and patch validation.

Daybreak Red is designed for more specialized cybersecurity work. It provides access to purpose-trained models for authorized vulnerability research, exploit validation, penetration testing, red teaming, and other higher-risk security activities.

This is also where GPT-5.6-Cyber becomes available.

GPT-5.6-Cyber Reduces Refusals For Advanced Security Work

Built on GPT-5.6 Sol, GPT-5.6-Cyber was specifically trained to improve performance on specialized cybersecurity tasks, including finding zero-day vulnerabilities and developing exploit chains.

OpenAI created an internal Advanced Cybersecurity Completion Rate evaluation covering areas such as exploit-chain development, authentication bypass, and privilege escalation. The company said GPT-5.6-Cyber completed 95% of these requests, compared with 1.5% for standard GPT-5.6 Sol, 2% for GPT-5.6 Sol through Daybreak Blue, and 57.3% for the previous GPT-5.5-Cyber model.

However, the newer cyber model did not outperform GPT-5.6 Sol across every evaluation. OpenAI said GPT-5.6-Cyber performed worse on its Vulnerability Discovery and Report Writing evaluation, partly because it sometimes generated shorter and less detailed vulnerability reports.

OpenAI also said its researchers used GPT-5.6-Cyber while investigating V8, the JavaScript engine used by Chrome, helping uncover previously unknown vulnerabilities. One high-severity issue was fixed by Google and assigned CVE-2026-15903.

SpecterOps CTO Jared Atkinson said the model “has completed work in under a day that earlier models had not resolved after weeks of intermittent effort.”

OpenAI Is Keeping Access Restricted

Despite reducing safeguards and refusals for authorized cyber work, GPT-5.6-Cyber is not being released as an unrestricted model.

According to OpenAI, Daybreak access is limited to approved individuals and organizations, with controls including identity verification, account security, monitoring, approved-use restrictions, and legal attestations. Individual Daybreak accounts will also be required to use hardware security keys beginning September 1, 2026.

 

In a separate first-party announcement, OpenAI said its Daybreak Cyber Partner Program includes security and services companies such as Accenture, IBM, CrowdStrike, Cisco, Palo Alto Networks, Sophos, Cloudflare, Fortinet, and others. Access to the underlying models remains with approved partners rather than being transferred directly to their customers.

OpenAI assessed GPT-5.6-Cyber as reaching the “High” cybersecurity capability threshold under its Preparedness Framework, but said it remains below the company’s “Critical” threshold.