OpenAI has expanded its Daybreak programme for vetted cybersecurity defenders and launched GPT-5.6-Cyber, a specialised model trained to reduce refusals on advanced offensive security tasks.
Daybreak now offers two tiers. Daybreak Blue gives approved defenders access to the general-purpose GPT-5.6 Sol with standard safeguards relaxed for authorised work such as vulnerability discovery and incident response. Daybreak Red, aimed at advanced vulnerability research and exploit development, provides access to GPT-5.6-Cyber.
OpenAI said GPT-5.6-Cyber completes 95% of requests on an internal benchmark measuring willingness to assist with exploit-chain development, authentication bypass and privilege escalation scenarios, against 1.5% for standard GPT-5.6 Sol and 57.3% for the previous GPT-5.5-Cyber.
Using the new model, OpenAI researchers found two previously unknown vulnerabilities in Chrome's V8 JavaScript engine, since patched by Google and assigned CVE-2026-15903, alongside vulnerabilities in a mobile operating system, a widely used database and an operating system kernel.
Under OpenAI's Preparedness Framework, GPT-5.6-Cyber was assessed as High for cybersecurity capability, below the Critical threshold. OpenAI confirmed that GPT-5.6-Cyber played no role in the earlier Hugging Face security incident, and that no other models currently planned for release were involved either.
The company is requiring hardware security keys for all Daybreak accounts from 1 September 2026 and is pushing Codex users toward auto-review mode to limit destructive actions.
