GPT-5.6-Cyber gives approved defenders advanced capabilities for vulnerability research, while global security partners bring the technology into governed enterprise services and workflows
OpenAI has expanded its Daybreak cybersecurity programme with two access tiers, introduced the specialised GPT-5.6-Cyber model and established a global partner network to bring frontier AI capabilities into enterprise security operations.
The developments come amid growing concerns that threat actors could use AI to identify vulnerabilities, develop exploits and navigate complex systems with greater speed, scale and autonomy. Security teams, meanwhile, face a rising volume of weaknesses across the software and infrastructure under their protection.
OpenAI said the programme aims to give approved defenders access to advanced AI capabilities before offensive applications become widely deployed.
Daybreak Blue provides access to OpenAI’s frontier general-purpose models, including GPT-5.6 Sol, with safeguards tailored to authorised defensive security activities. The tier supports vulnerability discovery, secure code reviews, malware analysis, incident response, patch validation and security assessments.
Daybreak Red gives approved users access to purpose-trained cybersecurity models for vulnerability research, exploit validation, red teaming and advanced security testing. GPT-5.6-Cyber, built on GPT-5.6 Sol, is available through this tier.
OpenAI trained GPT-5.6-Cyber to improve performance across specialised workflows, including zero-day vulnerability discovery and exploit-chain development. The model also reduces refusals for selected dual-use cybersecurity tasks when used by verified researchers within authorised environments.
Internal testing found that GPT-5.6-Cyber completed 95 per cent of requests included in OpenAI’s Advanced Cybersecurity Completion Rate evaluation. The assessment covers scenarios involving exploit-chain development, authentication bypass and privilege escalation.
GPT-5.6 Sol completed 1.5 per cent of the same requests under its standard safeguards and 2 per cent through Daybreak Blue. GPT-5.5-Cyber recorded a completion rate of 57.3 per cent, according to OpenAI.
Benchmark performance varied by task. GPT-5.6-Cyber outperformed GPT-5.6 Sol and GPT-5.5-Cyber on ExploitGym, which measures whether AI agents can turn known vulnerabilities into working exploits within controlled environments.
GPT-5.6 Sol performed better during OpenAI’s Vulnerability Discovery and Report Writing evaluation. OpenAI attributed the result to GPT-5.6-Cyber sometimes producing shorter and less detailed vulnerability reports. GPT-5.6 Sol also led the standard 300-turn ExploitBench assessment, although the performance gap narrowed when the limit increased to 600 turns.
Jared Atkinson, CTO, SpecterOps, said GPT-5.6-Cyber was materially improving the company’s specialist vulnerability-research workflows.
“Reducing unnecessary refusals helps authorised researchers preserve momentum and spend more time validating findings and turning them into defensive value,” Atkinson said.
Moving from detection to remediation
OpenAI is also expanding the Daybreak Cyber Partner Program to bring its models into security products, managed services and customer engagements.
Security and services partners include Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group and SpecterOps. Technology partners include Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet and Cloudflare.
Participating organisations can incorporate Daybreak capabilities into vulnerability discovery and validation, red teaming, penetration testing, incident response and remediation services across complex enterprise environments.
The partner model is intended to help organisations use frontier cybersecurity models without establishing and operating their own specialised cyber-AI programmes. It also places security practitioners between the underlying model and the customer, providing technical expertise, governance and knowledge of the customer’s environment.
Harpreet Sidhu, Global Lead, Accenture Cybersecurity, said security teams must now address vulnerabilities as quickly as they discover them.
“Cybersecurity teams are under growing pressure to not just find vulnerabilities quickly, but to now fix them quickly,” Sidhu said.
Mark Hughes, Global Managing Partner, Cybersecurity Services, IBM Consulting, said organisations need defences capable of keeping pace with machine-speed threats while remaining grounded in governance and human expertise.
IBM plans to combine OpenAI’s cyber models with its Autonomous Security capabilities to help organisations identify and prioritise significant vulnerabilities. Its Lightwell technology will support remediation across open-source software supply chains.
Cisco is also exploring the integration of Daybreak capabilities with its platforms and services. DJ Sampath, SVP and GM, AI Software and Platform, Cisco, said the combination of frontier AI, security expertise and governance could help “enterprises move at speed without sacrificing control.”
Palo Alto Networks plans to combine OpenAI’s reasoning capabilities with its security platforms to support faster threat detection, automated response and operational resilience. CrowdStrike will apply the models alongside its threat intelligence and real-time security data to support vulnerability assessment and red-team operations.
Sophos is applying Daybreak models across its managed detection and response, incident-response and advisory services. EY and PwC are focusing on governed consulting and managed-security workflows, while Cloudflare, Fortinet and Akamai plan to use the technology across threat intelligence, risk validation and remediation services.
Controlled enterprise access
Daybreak Cyber Partners will use OpenAI’s models within controlled and governed customer engagements. Safeguards may include identity verification, defined testing scopes, activity logging, monitoring and human oversight.
Access to the underlying models remains with the approved partner and is not transferred directly to the customer. Partners will work with organisations to establish the boundaries of each engagement, review findings and apply professional judgement before any action is taken.
Daybreak Blue and Daybreak Red are also available to approved individuals and organisations conducting authorised security work.
OpenAI controls direct access through identity verification, account-security requirements, monitoring, approved-use restrictions and legal attestations.
Individual Daybreak accounts will be required to use hardware security keys from September 1, 2026. OpenAI is also encouraging customers using Codex to adopt auto-review mode, which evaluates actions requiring elevated permissions before execution.
Security teams are advised to run Daybreak workflows in isolated environments without access to sensitive production systems or the open internet. OpenAI also recommends continuous monitoring, human oversight and clearly defined authorisation boundaries for systems and actions.
The company assessed GPT-5.6 Sol and GPT-5.6-Cyber as reaching the “High” cybersecurity capability threshold under its Preparedness Framework, but remaining below the “Critical” threshold.
Real-world vulnerability research
OpenAI used GPT-5.6-Cyber to examine V8, the JavaScript engine used by Google Chrome. The research uncovered two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox.
The findings were reported to Google through a coordinated vulnerability disclosure process. Google fixed the high-severity vulnerability and assigned it CVE-2026-15903.
Further research reportedly identified at least five vulnerabilities in a widely used mobile operating system, three critical vulnerabilities in a popular database and more than 400 vulnerabilities capable of enabling privilege escalation in an operating-system kernel.
OpenAI said it is working with Daybreak partners and members of the open-source community to disclose and remediate the outstanding issues.
Daybreak Blue is positioned as the starting tier for most defenders. Security teams conducting advanced vulnerability research, exploit development or authorised red teaming can apply for Daybreak Red. Cybersecurity companies, service providers and consultancies can also apply to join the partner programme.
Source: Tahawul Tech