OpenAI's GPT-5.6-Cyber Completes 95% of Exploit Requests to Arm Defenders

OpenAI is expanding its Daybreak initiative with a new purpose-trained model, GPT-5.6-Cyber, and restructuring the program into two access tiers calibrated to capability and risk. The core argument: attackers are already using AI to compress the time between finding and exploiting a vulnerability, and defenders need equivalent tools before that window closes.

Two tiers, one mission

The expanded Daybreak program now splits into two lanes:

• Daybreak Blue gives approved defenders access to GPT-5.6 Sol, OpenAI's flagship general-purpose model, with cybersecurity guardrails removed. This is the recommended entry point for most security teams, covering vulnerability discovery, secure code review, malware analysis, incident response, and patch validation.
• Daybreak Red provides access to GPT-5.6-Cyber, a purpose-trained model built for authorized vulnerability research, exploit validation, and advanced security testing. It requires a stricter approval process and additional monitoring.

Security teams have long complained about high refusal rates from frontier AI models as labs try to serve defenders without handing the same capabilities to attackers. Daybreak Red is OpenAI's direct answer to that frustration.

The refusal problem, mostly solved

OpenAI built an internal benchmark called the Advanced Cybersecurity Completion Rate, measuring how often models respond to requests involving exploit-chain development, authentication bypass, privilege escalation, and similar scenarios. GPT-5.6-Cyber completes 95.0% of these requests. GPT-5.6 Sol manages 1.5%, and Daybreak Blue access raises that only to 2.0%.

The generational jump is equally significant. The previous model, GPT-5.5-Cyber, completed just 57.3% of the same requests. Security researchers who hit persistent refusals with that version will find the new model substantially more cooperative for authorized offensive work.

To make the difference concrete, here is what a prompt requesting a macOS Keychain bypass tool gets from each tier:

• GPT-5.6-Cyber (Daybreak Red): Provides working Swift/ObjC code using the installed, code-signed Chrome as a decryption oracle.
• GPT-5.6 Sol (Daybreak Blue): Refuses.
• GPT-5.5-Cyber (Daybreak Red): Also refuses.

A model that found real Chrome bugs

OpenAI tested GPT-5.6-Cyber beyond benchmarks. After training completed, the company used it to investigate V8, Chrome's JavaScript engine, and uncovered two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox. Google fixed the issue after coordinated disclosure, assigning it CVE-2026-15903. OpenAI Codex Security reported the bug on July 6; the bounty amount is still listed as TBD.

The V8 chain required two separate vulnerabilities, and GPT-5.6-Cyber found both. OpenAI also reports using the model to find:

• At least five vulnerabilities in a popular mobile operating system, including a chain from an untrusted app to local privilege escalation.
• Three critical vulnerabilities in a popular database, including a remote path to code execution.
• Over 400 vulnerabilities leading to privilege escalation in a popular OS kernel.

Early access partners are already seeing production results. Jared Atkinson, CTO of SpecterOps, noted that the model "reasons more accurately about real exploit constraints, tracks complex state better, and has completed work in under a day that earlier models had not resolved after weeks of intermittent effort."

Why now, and why this way

The premise behind Daybreak is that AI capabilities accelerating attacks must be deployed at scale on the defense side, or the speed gap between attacker and defender widens every quarter. According to the World Economic Forum's Global Cybersecurity Outlook 2026, 94% of cyber leaders surveyed said AI would be the most significant driver of change in cybersecurity risk this year.

OpenAI is threading a genuine tension here. Building AI capable of defending against AI-enabled threats can simultaneously sharpen offensive capabilities. The company's approach is to make capability a function of verified identity: the more dangerous the model, the harder it is to access.

The competitive context matters too. The global cybersecurity market runs roughly $200 billion annually. Anthropic has deployed Mythos-class models with built-in safeguards for vetted customers including the US government. Both labs are now shipping defender-first AI, and Daybreak signals that OpenAI intends to compete with purpose-built products rather than leaving third parties to wrap general-purpose ChatGPT in security workflows.

The safety architecture

Access controls are layered and escalating:

• Identity verification via government ID and KYC checks for all Daybreak members.
• Starting September 1, 2026, individual members of the Trusted Access for Cyber program must activate Advanced Account Security and authenticate with a hardware-backed passkey to retain access to frontier models.
• Daybreak customers using Codex are strongly encouraged to switch to auto-review mode, which evaluates actions requiring elevated permissions before execution and can block requests that pose a significant risk of destructive behavior.
• Daybreak Red requires additional monitoring, scoped permission profiles, and legal attestations.

The hardware key stores the private authentication credential on a physical device, making it substantially harder for attackers to capture through phishing, copy between devices, or reuse after compromising a password. OpenAI has partnered with Yubico on preferred pricing for YubiKeys for eligible users.

Under OpenAI's Preparedness Framework, its internal rubric for assessing model risk, GPT-5.6-Cyber reached the "High" cyber capability threshold but not the Critical threshold. That distinction matters: OpenAI's safety team judged the model capable enough to require gated access, but not so capable that it crosses into territory the company considers too risky to deploy.

Who benefits, and what to watch

The clearest beneficiaries are security teams at organizations large enough to qualify for Daybreak access. OpenAI is also allowing companies including Accenture, IBM, CrowdStrike, Cisco, and Palo Alto Networks to incorporate the models into security products, managed services, and customer work, so the capability will flow downstream into commercial offerings beyond direct API users.

The tension worth watching is misuse. A model that answers 95% of advanced exploit requests is a high-value target for credential theft or insider abuse, which is precisely why the hardware key requirement exists. OpenAI's bet is that identity-gating and monitoring can keep the model out of the wrong hands, but that bet will be tested as access scales.

For the broader industry, the announcement reflects a shift in how defenders think about the vulnerability lifecycle. Finding bugs has become faster; patching them at scale remains the harder problem. With Daybreak combining frontier models, Codex Security workflows, open-source partnerships, and critical infrastructure collaboration, OpenAI is positioning AI-driven remediation as the next competitive frontier in cyber defense.

How to get access

OpenAI recommends Daybreak Blue as the starting point for most defenders. To apply:

1. Individuals can apply at openai.com/daybreak/partners for personal access.
2. Organizations can apply through the Enterprise Trusted Access form.
3. Teams doing advanced vulnerability research, exploit development, or red teaming can then request Daybreak Red access specifically.
4. All individual members must enable hardware-backed passkeys before September 1, 2026, or lose access to the advanced tiers.

The Codex Security CLI is available now for teams wanting to start scanning without waiting for Daybreak approval. It covers common defensive workflows and connects to GitHub repositories for ongoing scans. The system card for GPT-5.6-Cyber will be published separately.