Expanding Daybreak as the Cyber Defense Window Narrows

OpenAI has launched GPT‑5.6‑Cyber, a cybersecurity-specific model designed to assist defenders in identifying vulnerabilities and developing exploits for security research. The model is available through two Daybreak access tiers: Daybreak Blue removes system-level safeguards to enhance real-world defensive tasks like incident response, while Daybreak Red further reduces refusals on dual-use tasks such as exploit development. GPT‑5.6‑Cyber completes 95% of advanced cybersecurity requests, compared to 1.5% for the base GPT‑5.6 Sol model, addressing persistent refusals reported by security researchers.

The new model was evaluated on benchmarks including ExploitGym and ExploitBench, where it outperformed earlier versions in exploit development and vulnerability discovery. Early access partners reported significant improvements in workflow efficiency, with GPT‑5.6‑Cyber completing tasks in under a day that previously took weeks. The model was also used to uncover two previously unknown vulnerabilities in V8, Chrome’s JavaScript engine, which were reported to Google and assigned CVE-2026-15903.

GPT‑5.6‑Cyber identified additional high-severity vulnerabilities in software ranging from databases to mobile operating systems, with OpenAI collaborating with partners and the open-source community to disclose and remediate these issues. The model’s cybersecurity capabilities were assessed under OpenAI’s Preparedness Framework, reaching the High threshold but not the Critical threshold, indicating advanced but not extreme-risk capabilities.

OpenAI acknowledges the risks of reduced safeguards in Daybreak access tiers, emphasizing the importance of democratizing frontier intelligence for defenders to counter AI-driven cyber threats. A system card detailing further evaluations of GPT‑5.6‑Cyber will be published later, and the company confirmed no involvement of the model in the Hugging Face incident.