OpenAI Daybreak

Daybreak is OpenAI's gated cybersecurity programme, giving approved security teams frontier models whose safeguards are retuned for legitimate security work. Since August 2026 it splits into a Blue tier for defensive operations such as malware analysis and incident response, and a Red tier that unlocks GPT-5.6-Cyber for authorized vulnerability research and exploit validation.

Daybreak is OpenAI's cybersecurity programme, announced in May 2026 and substantially restructured on 10 August 2026. It exists because OpenAI's general-purpose models refuse most dual-use security work: on the company's Advanced Cybersecurity Completion Rate benchmark, ungated GPT-5.6 Sol completes only about 1.5% of sensitive requests covering exploit-chain development, authentication bypass and privilege escalation. The programme originally bundled GPT-5.5-Cyber, Codex Security (an agent that analyses codebases, identifies and validates vulnerabilities and helps develop patches), the Patch the Planet open-source remediation initiative run with Trail of Bits, a Cyber Partner Program letting approved vendors embed the capability in their own products, and a Trusted Access for Cyber governance layer. The August 2026 restructure collapsed that into two named tiers. Daybreak Blue is the recommended entry point for most enterprises and provides frontier models including GPT-5.6 Sol with safeguards adjusted for vulnerability discovery, secure code review, malware analysis, incident response and patch validation — though it lifts benchmark completion only to roughly 2%. Daybreak Red unlocks the purpose-trained GPT-5.6-Cyber, built on GPT-5.6 Sol, which completes about 95% of that same benchmark against 57.3% for the previous GPT-5.5-Cyber, and scores higher on the ExploitGym and ExploitBench evaluations. OpenAI says it used the model internally to find CVE-2026-15903, a CVSS 8.8 out-of-bounds flaw in Chrome's V8 engine, plus more than 400 kernel privilege-escalation issues. Red has no self-serve signup: access routes through roughly sixteen named partner organisations including Accenture, IBM, CrowdStrike, Cloudflare, Cisco, EY and KPMG, accounts are continuously monitored, and hardware security keys become mandatory for all Daybreak logins from 1 September 2026. GPT-5.6-Cyber is rated High, not Critical, under OpenAI's Preparedness Framework.

Category

Governance & Security

Pricing

Contact for pricing

Target Market

CISOs, Security Engineers, Vulnerability Researchers, MSSPs, CTOs

Deployment

API-based, Cloud-only

Founded

2015

Headquarters

San Francisco, United States

Team Size

500+

• ✓
  Daybreak Blue tier

  Frontier models including GPT-5.6 Sol with safeguards retuned for defensive work: vulnerability discovery, secure code review, malware analysis, incident response and patch validation.

• ✓
  Daybreak Red tier and GPT-5.6-Cyber

  A purpose-trained cyber model completing roughly 95% of sensitive exploit-development tasks, versus about 1.5% for the ungated frontier model.

• ✓
  Codex Security

  An agent that analyses whole codebases, identifies and validates vulnerabilities, then helps develop and check the corresponding patches.

• ✓
  Trusted Access for Cyber governance

  A vetting and access-control layer binding capability to an approved organisation, with ongoing monitoring applied to Red-tier accounts.

• ✓
  Mandatory hardware security keys

  From 1 September 2026 every Daybreak account must authenticate with a hardware key, closing the credential-theft path into offensive capability.

• ✓
  Cyber Partner Program

  Approved security vendors such as CrowdStrike, Cloudflare and Cisco can embed Daybreak capability directly into their own products and services.

• ✓
  Patch the Planet

  A remediation initiative run with Trail of Bits applying these models to finding and fixing vulnerabilities in open-source software.

• •
  Internal red-team exploit validation

  A vetted security team uses GPT-5.6-Cyber to develop and validate an exploit chain against its own systems before an attacker finds the same path.

• •
  Zero-day discovery in dependencies

  Researchers point the model at browser, kernel or database code, as OpenAI did to surface the CVSS 8.8 Chrome V8 flaw CVE-2026-15903.

• •
  Malware triage during a live incident

  Blue-tier access lets responders have a frontier model reason about a live sample without hitting the refusals a consumer model returns.

• •
  Continuous secure code review

  Codex Security scans a codebase in CI, validates which findings are genuinely reachable, and drafts patches for engineers to review.

• •
  MSSP service differentiation

  A partner consultancy folds Daybreak capability into a managed offering, reselling access its clients could not obtain directly.

OpenAI has published no rates for either Daybreak tier. Access is granted rather than purchased: Blue requires approval as a legitimate defender, and Red is not self-serve at all, routing through roughly sixteen named partner organisations. For most enterprises the practical cost is therefore a contract with a partner such as Accenture, IBM, CrowdStrike or EY rather than a line item with OpenAI, and every account must also fund hardware security keys once they become mandatory on 1 September 2026.

This page was written from 6 sources, 6 on domains other than openai.com.

1. 1.infosecurity-magazine.com — openai daybreak blue red gpt cyber
2. 2.siliconangle.com — openai expands daybreak cybersecurity research program
3. 3.thehackernews.com — openai launches gpt 56 cyber with
4. 4.techcrunch.com — as ai led attacks multiply openai launches a new cyber model
5. 5.explainx.ai — openai gpt 5 6 cyber daybreak red blue august 2026
6. 6.techjuice.pk — openai daybreak expansion gpt 5 6 cyber model enterprise def