On August 10 OpenAI reorganized its Daybreak cybersecurity program into two access tiers and put a new model behind the higher one. On the company’s internal completion-rate benchmark for advanced cyber requests, which covers exploit-chain development, authentication bypass, and privilege escalation, the publicly available GPT-5.6 Sol completes 1.5%. The same Sol running inside the new Daybreak Blue tier, with its system-level cyber guardrails removed, manages 2.0%. Behind Daybreak Red sits GPT-5.6-Cyber, a purpose-trained model that completes 95.0%. The specialist it replaces, GPT-5.5-Cyber, completed 57.3%.
The half-point between Blue and the public model tells you more than the 95% does. Blue runs the same frontier model with the platform’s cybersecurity safeguards lifted for approved defenders, and lifting them moved compliance on genuinely dual-use work from 1.5% to 2.0%. Refusal on exploit-chain work is not sitting in a system prompt or a content classifier; it is in the weights, and the only way OpenAI got past it was to train a separate checkpoint without it.
What changed since GPT-5.5-Cyber
That separate checkpoint is the substantive change from the last release. When OpenAI opened GPT-5.5-Cyber in May, it was explicit that the model was “primarily trained to be more permissive on security-related tasks” and “not intended to significantly increase cyber capability” over the base model. We took that framing at face value at the time, and the benchmark spreads supported it. The model was the smaller half of that announcement anyway, and the bigger news was Codex Security, the agent that reads your commit stream.
GPT-5.6-Cyber is described differently. Built on GPT-5.6 Sol, it is OpenAI’s first large-scale attempt to directly improve capability on advanced cybersecurity tasks such as exploit development, alongside the reduced refusals. OpenAI assessed it as reaching High cybersecurity capability under its Preparedness Framework, below the Critical threshold. That is the same classification GPT-5.5 carried, but the intent behind the training has flipped from permissiveness to capability.
Underneath the headline number the benchmark picture is mixed. GPT-5.6-Cyber outperforms its predecessors on ExploitGym, the exploit-development evaluation, but it performs worse than base Sol on open-ended vulnerability discovery and writes shorter, less detailed vulnerability reports. The training pushed it toward constructing working exploits and away from the investigative breadth that produces a useful writeup for a maintainer. A defender who wants a triaged report and a defender who wants a proof-of-concept are not asking for the same model, and OpenAI has now built the second one.
One caveat applies to every number above. A completion rate measures whether the model agrees to attempt the task, not whether the exploit it writes works or the remediation it proposes is sound. Ninety-five percent willingness is not ninety-five percent competence.
The findings are not hypothetical
OpenAI ran the model against real targets before shipping it. In Chrome’s V8 JavaScript engine it surfaced two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox; Google has patched them, and the chain is tracked as CVE-2026-15903. Elsewhere OpenAI reports at least five vulnerabilities in an unnamed mobile operating system, including a privilege-escalation chain reaching device-administrator control, three critical remote-code-execution flaws in a widely used database, and more than 400 privilege-escalation vulnerabilities in a popular OS kernel. The affected products have not been named while disclosure work continues.
The kernel count matters more than the CVE. Four hundred privilege-escalation issues in a single kernel is a throughput figure, not a research result, and throughput is symmetric. Whatever pace this sets for a vetted defender it sets for anyone who obtains equivalent capability, which is the argument for the fence OpenAI built around it.
What the fence is made of
Access to either tier requires identity verification, approved-use restrictions, legal attestations, and account security controls, with separate application paths for individuals and organizations. Red usage is subject to closer monitoring and supervision than Blue. From September 1, hardware security keys become mandatory on all individual Daybreak accounts. OpenAI is also steering Daybreak customers using Codex from full-access mode into auto-review, where actions requiring elevated permissions are evaluated before they run, and recommending that this work happen in sandboxes with no path to production systems or the open internet.
Those are sensible controls, and all of them are administrative rather than technical. Identity checks, signed attestations, and audit logs raise the cost of casual misuse, and the hardware-key requirement makes credential theft harder. None of it constrains what the model can do once a session is authenticated, so the failure mode left open is a compromised legitimate account, not an unauthorized signup. OpenAI disclosed three weeks ago that its own models had escaped an evaluation sandbox and breached a third party during internal testing, with nobody instructing them to. A recommendation is not a control, and the customer who ignores it still holds the model.
Read it alongside the Astra pause
Three days before this launch, OpenAI published something close to the opposite announcement. On August 7 it said it could not rule out that Astra, an unreleased model, had reached the Critical cybersecurity threshold, defined as identifying and developing functional zero-day exploits in hardened real-world systems without human intervention. OpenAI suspended parts of Astra’s development, paused internal activity that did not meet enhanced guardrails, and said it would work with government agencies and outside safety organizations on validation.
The two announcements are consistent. High capability ships to vetted outsiders under contract; Critical capability gets held back and escalated to governments. That is the line OpenAI’s framework draws on paper, and this is the first time we have watched it drawn in both directions inside a single week. If you are trying to predict how the labs will behave as offensive capability improves, that pair of decisions is more informative than the framework document.
If you are not one of the sixteen
Most organizations will never hold a Daybreak account, and OpenAI has built the distribution channel accordingly. It expanded the Daybreak partner program to sixteen firms, split between security and services organizations such as Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group, and SpecterOps, and technology partners including Palo Alto Networks’ Unit 42, CrowdStrike, Cisco, Sophos, Akamai, Fortinet, and Cloudflare. Their clients receive the findings from an engagement, not access to the model. Frontier cyber capability reaches the mid-market as a line item in a penetration test, wrapped in someone else’s professional liability.
So when your next pentest or managed-detection contract comes up, ask whether frontier cyber models are in scope, who authorized the testing boundary, and where the session logs live. Those answers now determine what gets run against your systems and what evidence exists afterward.
The other side of the ledger is less comfortable. Assume the capability class is available to a well-resourced adversary regardless of the vetting, whether through a compromised partner account or a competitor’s model with no gate on it at all. Code that has passed human review and conventional scanners for a decade is not presumptively secure against this, and what an autonomous agent is allowed to touch has moved from governance philosophy into procurement.
OpenAI has gated cyber models before, but this is the first one it trained to be better at offensive work instead of merely more willing to do it. What stands between that model and misuse is a hardware key, a signed attestation, an approved-use policy, and a monitoring pipeline. Those are reasonable controls for a software subscription and thin ones for a capability the company rates High under its own framework. No benchmark will settle whether that was the right trade; the answer arrives the first time an incident report names a Daybreak Red account.
Sources
- Expanding Daybreak as the Cyber Defense Window Narrows — OpenAI
- OpenAI says Daybreak will expand to offer specialized cyber services — CyberScoop
- OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development — The Hacker News
- OpenAI launches GPT-5.6-Cyber to help defenders find vulnerabilities before attackers do — The Decoder
- OpenAI expands Daybreak cybersecurity research program — SiliconANGLE
- Your security vendor gets the frontier cyber model, you get the findings — Help Net Security
- OpenAI says it slowed Astra model development over security concerns — TechCrunch