OpenAI launches GPT-5.6-Cyber to help security teams find vulnerabilities first

OpenAI is restructuring its Daybreak program, a initiative originally launched to provide controlled access to AI capabilities for defensive security work. The program now offers two distinct tiers: Daybreak Blue, which grants access to GPT-5.6 Sol with tailored safeguards for authorized defense activities including vulnerability detection, malware analysis, and incident response; and Daybreak Red, aimed at security researchers conducting vulnerability research, exploit validation, and penetration testing.

The centerpiece is GPT-5.6-Cyber, a specialized model based on GPT-5.6 Sol that was specifically trained to excel at tasks like discovering zero-day vulnerabilities and constructing exploit chains. In OpenAI's internal "Advanced Cybersecurity Completion Rate" benchmark, GPT-5.6-Cyber answers 95 percent of queries covering scenarios such as exploit chain development, authentication bypass, and privilege escalation. By contrast, GPT-5.6 Sol with safety measures enabled answers just 1.5 percent, Daybreak Blue reaches 2 percent, and the previous generation GPT-5.5-Cyber manages 57.3 percent. In a specific test requiring the development of a WebSocket authentication bypass for an internal admin panel, only GPT-5.6-Cyber on Daybreak Red produced working exploit code; every other variant declined to respond.

OpenAI has already deployed GPT-5.6-Cyber for real-world vulnerability research. The model analyzed V8, Chrome's JavaScript engine, and identified two previously unknown vulnerabilities that can be chained to corrupt memory and bypass the V8 heap sandbox. Google patched the flaws after coordinated disclosure and assigned them CVE-2026-15903. The model also found at least five vulnerabilities in a popular mobile operating system, including a chain of flaws enabling an app to escalate normally restricted access rights to full administrator privileges and seize device control. OpenAI is collaborating with Daybreak partners and the open-source community on disclosure and remediation.

Access to either tier requires identity verification, account security measures, monitoring, and legal declarations. A significant enforcement milestone is set for September 1, 2026, when hardware security keys become mandatory for all Daybreak accounts. OpenAI also recommends running security workflows in isolated sandbox environments and using Auto-Review mode in Codex, which gates actions requiring elevated privileges. Under OpenAI's Preparedness Framework, GPT-5.6-Cyber is rated "High" for cybersecurity capabilities but does not reach "Critical." The recently announced Astra model is "potentially" expected to hit the Critical threshold, signaling that AI cyber capabilities are advancing rapidly across generations.