OpenAI Expands Daybreak With Tiered Cyber Access
OpenAI expanded its Daybreak cybersecurity initiative on August 10, adding Daybreak Blue and Daybreak Red access tiers. Daybreak Red users can access the new GPT-5.6-Cyber model for security testing, vulnerability research, and exploit validation, while Blue provides modified safeguards for defensive work. Axios reports the program also broadens approved partner use in security products and managed services.
OpenAI expanded its Daybreak cybersecurity partner initiative on August 10, adding Daybreak Blue and Daybreak Red access tiers and introducing GPT-5.6-Cyber for approved Red participants. CNBC reports that the program, introduced in May, provides ecosystem partners access to advanced models for defensive cybersecurity work.
According to CNBC, Daybreak Blue offers OpenAI's advanced general-purpose models with safeguards altered for defensive security tasks. Daybreak Red provides access to purpose-trained cybersecurity models for security testing, vulnerability research, and exploit validation. OpenAI wrote, "As the threat landscape evolves, we're putting frontier intelligence in the hands of trusted defenders before attackers can deploy offensive AI at scale."
Different access levels for defensive workflows
Axios reports that Blue members receive GPT-5.6 Sol without system-level cyber guardrails, while Red members receive GPT-5.6-Cyber for more advanced vulnerability research and exploit validation. The distinction is significant because broad frontier-model safeguards can refuse legitimate defensive prompts as well as potentially harmful ones.
Axios reported testing results in which GPT-5.6-Cyber responded to 95% of requests involving advanced cybersecurity work, including exploit-chain development, authentication bypass, and privilege escalation. By comparison, GPT-5.6 Sol responded to 1.5% of those requests, while the version available to Daybreak Blue participants responded to 2%, Axios reported.
OpenAI's Daybreak partner page describes the program as supporting governed integrations and partner-operated workflows. It identifies application security, security operations, and AI and agent security as target areas, including workflows to secure agent environments, development environments, and systems surrounding Codex. The page also describes two engagement models: embedding approved capabilities into bounded product workflows, or delivering them through managed and advisory services with partner teams remaining hands-on-keyboard.
Partners and oversight
Axios reports that OpenAI is allowing companies including Accenture, IBM, CrowdStrike, Cisco, and Palo Alto Networks to incorporate the models into security products, managed services, and customer work. OpenAI's partner page states that proposed workflows are intended to include safeguards, monitoring, human review, and expert judgment.
The expansion follows publicly disclosed incidents involving AI agents accessing systems during cybersecurity testing, CNBC reports. Axios also reported that OpenAI delayed its forthcoming Astra model after safety testing found critical hacking capabilities. Axios reported that GPT-5.6-Cyber reached OpenAI's "High" cyber-capability threshold, while distinguishing it from Astra.
For security teams, tiered access is a practical attempt to separate routine defensive assistance from workflows that require exploit validation or deeper technical investigation. Comparable controlled-access programs commonly depend on authorization checks, scoped environments, logging, and human review because the same techniques used to validate a vulnerability can be repurposed offensively. The reported response-rate gap between the Cyber and Sol variants also illustrates the operational trade-off: stronger model capability can reduce refusals for legitimate research, while increasing the importance of access controls and monitoring.
Key Points
- 1OpenAI added Blue and Red Daybreak tiers, separating general defensive assistance from advanced vulnerability research and exploit-validation access.
- 2Axios reported GPT-5.6-Cyber answered 95% of advanced cybersecurity requests, materially above the reported response rates for GPT-5.6 Sol variants.
- 3Controlled cyber-model access reflects an industry pattern: capable defensive workflows require authorization, monitoring, bounded scope, and human expert review.
Scoring Rationale
The program expands controlled access to a purpose-trained cyber model and could affect how enterprise security providers evaluate frontier-model use in defensive workflows. Its reported exploit-validation capabilities and tiered access design are directly relevant to security engineers, AI governance teams, and practitioners building agent-security tooling.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
