OpenAI divided its Daybreak cybersecurity program into Blue and Red access tiers. The company also introduced GPT-5.6-Cyber for approved defenders handling advanced security research. Red customers receive the specialist model, while Blue customers use GPT-5.6 Sol with adjusted safeguards.
The new structure separates defensive work from higher-risk testing. OpenAI says the model completed 95.0% of prompts on its internal advanced cybersecurity benchmark. A partner program also connects 16 security providers with OpenAI’s frontier models.
Daybreak Blue supports vulnerability discovery, secure code review, malware analysis, incident response and patch validation. It uses OpenAI’s general-purpose GPT-5.6 Sol model with safeguards tailored for authorized defensive tasks. OpenAI calls Blue the ‘recommended starting point for most defenders.’
Blue access does not automatically grant entry to Daybreak Red. OpenAI requires separate approval and provisioning for the advanced tier. Red supports vulnerability reproduction, exploit validation, penetration testing, red teaming and complex system analysis.
Daybreak began earlier this year as a program for approved private organizations and governments. It provided unreleased frontier models for defensive cybersecurity work. The expanded structure now gives participants access based on their tasks, identity and approved systems.
Meanwhile, OpenAI built GPT-5.6-Cyber on GPT-5.6 Sol and trained it for specialist security work. The model can search for unknown software flaws and develop linked exploit methods. It also refuses fewer authorized requests involving higher-risk, dual-use tasks.
OpenAI tested the model through its Advanced Cybersecurity Completion Rate benchmark. The evaluation covers exploit-chain development, authentication bypass, privilege escalation and related scenarios. GPT-5.6-Cyber completed 95.0% of the requests.
By comparison, GPT-5.6 Sol completed 1.5% under standard access and 2.0% through Daybreak Blue. The older GPT-5.5-Cyber reached 57.3%. OpenAI said unnecessary refusals had limited researchers using earlier models.
The company also tested GPT-5.6-Cyber on ExploitGym2, which measures controlled exploit development from known vulnerabilities. OpenAI reported stronger results than GPT-5.6 Sol and GPT-5.5-Cyber. It classified the new model at the high cybersecurity threshold, below the Critical threshold.
OpenAI created a partner program covering 16 cybersecurity providers. The list includes IBM, CrowdStrike, Accenture, Cisco, Cloudflare, KPMG, Ernst & Young, Palo Alto Networks and Sophos. Customers can use the models through security services they already purchase.
GPT-5.6-Cyber is available only to ‘trusted customer partners.’ OpenAI named Accenture, IBM, CrowdStrike and Cloudflare among those partners. Other approved users can request Daybreak Red access for authorized research and testing.
OpenAI applies identity checks, account security controls, monitoring, approved-use limits and legal attestations. Individual Daybreak accounts must use hardware security keys from September 1. The company also recommends automatic review for Codex actions requiring elevated permissions.
OpenAI reported that GPT-5.6-Cyber helped find flaws in software used across browsers, databases, mobile systems and operating system kernels. Researchers found two unknown V8 vulnerabilities and reported them to Google. Google fixed the issue, which received the identifier CVE-2026-15903.
The company also reported at least five mobile operating system flaws and three critical database vulnerabilities. Its research identified more than 400 kernel flaws linked to possible privilege escalation. OpenAI plans to publish a fuller system card for GPT-5.6-Cyber.
Also Read: Alibaba to Charge Enterprise Users for Next Open-Source AI Model