OpenAI Expands Daybreak With Blue and Red for Authorized Cybersecurity Work
OpenAI has formalized an expanded Daybreak program, separating defensive model access from specialized cybersecurity research and testing workflows.
OpenAI has expanded Daybreak into two controlled-access tiers for authorized cybersecurity work: Daybreak Blue for defensive use of frontier general-purpose models, and Daybreak Red for vulnerability research, exploit validation, and security testing with purpose-trained cyber models. The August 2026 expansion matters because it creates a more explicit path for approved defenders to use capable AI systems in security workflows while retaining identity checks, monitoring, use restrictions, and legal attestations.
The program is open to approved individuals and organizations conducting authorized work, rather than being a general public release. OpenAI frames the expansion as a response to a narrowing window for defenders, with the aim of extending access to organizations of every size, independent researchers, and open-source maintainers. Its official Daybreak expansion announcement is the authoritative description of the two tiers and their safeguards.
What OpenAI Daybreak Blue and Red are designed to do
Daybreak Blue supports authorized defensive work
Daybreak Blue provides access to frontier general-purpose models, including GPT-5.6 Sol, under safeguards adapted for authorized defensive activity. OpenAI says the tier is intended to help verified defenders validate vulnerabilities and fixes with fewer refusals.
That positioning is important. Security teams can encounter legitimate tasks that resemble harmful activity in isolation, such as analyzing a vulnerability, testing whether a patch works, or reproducing a reported issue in an authorized environment. Daybreak Blue is designed to make the general-purpose model more useful for that defensive context while access remains controlled.
Daybreak Red adds a cyber-specialized model
Daybreak Red is the higher-risk research and testing tier. It offers purpose-trained cybersecurity models for vulnerability research, exploit validation, and security testing. OpenAI also introduced GPT-5.6-Cyber through Daybreak Red, describing it as a cyber-specialized model intended to reduce refusals on higher-risk cyber tasks and improve performance on advanced security workflows.
The distinction is not simply a matter of permission settings. OpenAI presents GPT-5.6-Cyber as a model specifically built for cybersecurity work, whereas GPT-5.6 Sol is a frontier general-purpose model. That makes Daybreak Red the relevant tier where a team needs AI assistance for specialized, authorized technical security research rather than broad defensive analysis.
| Daybreak tier | Models and focus | Stated use cases | Access controls |
|---|---|---|---|
| Daybreak Blue | Frontier general-purpose models, including GPT-5.6 Sol | Authorized defensive work and validation of vulnerabilities and fixes | Identity verification, monitoring, approved-use restrictions, and legal attestations |
| Daybreak Red | Purpose-trained cybersecurity models, including GPT-5.6-Cyber | Vulnerability research, exploit validation, and security testing | Identity verification, monitoring, approved-use restrictions, and legal attestations |
OpenAI reports a large evaluation gap
OpenAI reports that GPT-5.6-Cyber completed 95.0% of tasks in its internal Advanced Cybersecurity Completion Rate evaluation. In the same evaluation, GPT-5.6 Sol completed 1.5% of tasks, rising to 2.0% when used with Daybreak Blue.
These figures are OpenAI's internal evaluation results, not a guarantee of results in every security environment. Still, they indicate the company sees a substantial difference between a general-purpose model with a defensive access configuration and a cyber-specialized model built for advanced workflows. For approved users, that is the central product message behind the new tiering.
Who can get access, and what remains undisclosed
Daybreak is for approved individuals and organizations performing authorized work. OpenAI's published safeguards include:
- Identity verification for access applicants.
- Monitoring of activity within the program.
- Approved-use restrictions governing how the tools may be used.
- Legal attestations tied to authorized cybersecurity work.
The supplied announcement does not provide a public price, a detailed rollout schedule, or a complete list of eligibility requirements beyond approval and authorized work. It also does not say that every applicant will receive access. Businesses and researchers should therefore treat Daybreak as a controlled program, not as a standard self-service security product.
For businesses that carry out authorized testing, the practical opportunity is to assess where model assistance could shorten the work around vulnerability validation, remediation checks, and security research. The practical constraint is equally clear: access and use depend on OpenAI's verification and program rules, and testing must remain authorized.
Security automation is most useful when it fits a real, authorized workflow rather than becoming another disconnected tool. Scalevise can help your team evaluate practical AI security use cases, connect the right systems and controls, and design an implementation path that reduces repetitive work without overstating what automation can safely handle. Explore AI implementation and automation planning for security workflows and request a consultation to map the highest-value next step.
Frequently Asked Questions
What is OpenAI Daybreak?
Daybreak is OpenAI's controlled-access program for approved individuals and organizations conducting authorized cybersecurity work. Its expanded structure includes Daybreak Blue and Daybreak Red.
What is the difference between Daybreak Blue and Daybreak Red?
Daybreak Blue provides frontier general-purpose models, including GPT-5.6 Sol, for authorized defensive work. Daybreak Red provides purpose-trained cybersecurity models, including GPT-5.6-Cyber, for vulnerability research, exploit validation, and security testing.
Who can access OpenAI Daybreak?
OpenAI says Daybreak is available to approved individuals and organizations conducting authorized work. Access is controlled through identity verification, monitoring, approved-use restrictions, and legal attestations.
How well did GPT-5.6-Cyber perform in OpenAI's evaluation?
OpenAI reports that GPT-5.6-Cyber completed 95.0% of Advanced Cybersecurity Completion Rate tasks in its internal evaluation. GPT-5.6 Sol completed 1.5%, or 2.0% when used with Daybreak Blue.
Has OpenAI announced Daybreak pricing or a full rollout timeline?
The supplied announcement does not state public pricing or a detailed rollout timeline. It describes Daybreak as a controlled-access program for approved users.
Conclusion
OpenAI's Daybreak expansion separates defensive access to general-purpose AI from specialized support for advanced cybersecurity research and testing. Daybreak Blue and Daybreak Red give approved users clearer paths for authorized work, while GPT-5.6-Cyber's reported internal evaluation results underline why OpenAI is distinguishing the two tiers. The key questions for prospective users are eligibility, permitted use, and how the program's controlled access fits their existing security process.