OpenAI announced an expansion of its Daybreak initiative that shifts focus from primarily discovering vulnerabilities to accelerating validation, patch generation, testing and deployment at scale. The package includes updates to the Codex Security plugin, the full release of GPT‑5.5‑Cyber, a Patch the Planet program for open source maintainers, and an OpenAI Daybreak Cyber Partner Program.
Problem and approach
According to OpenAI, frontier AI models have changed the dynamics of cybersecurity: models are increasingly fast at finding vulnerabilities, so the historical bottleneck of discovery has become a bottleneck in patching. In response, the company is investing in the follow‑on steps — validating findings, prioritizing risk, developing and testing fixes, coordinating disclosure, and helping teams deploy repairs.
OpenAI stresses that vulnerability reports alone do not protect systems; protection requires confirmation of the issue, an understanding of impact, development and verification of a patch, and rollout. To convert model capability into real‑world risk reduction, they are integrating models, verification controls and partner programs to help defenders through the full remediation loop.
Codex Security: scale and capabilities
The Codex Security cloud launched in research preview in March. Since then it has scanned over 30 million commits across more than 30,000 codebases; human reviewers have manually marked over 70,000 findings as fixed, and more than 500,000 findings have been automatically determined to be fixed. OpenAI says this is the scale at which patching must now operate.
Codex Security is built around a premise of placing the equivalent of a security engineer next to every developer: it does more than raise alerts. The system understands a team’s code and threat model (or generates one if missing), identifies plausible vulnerabilities, determines whether affected code is reachable, gathers validation evidence, develops a targeted patch, and verifies results. Humans remain in control of which findings to act on and what to share.
A newly released Codex Security plugin update delivers out‑of‑the‑box defensive workflows: deep scans or reviews of recent changes, reports with severity, affected code locations, validation evidence and remediation guidance, attack path tracing, threat model construction, findings validation, and codebase‑specific patch generation for review. Scans can cover entire repositories, subsets, or specific commits.
The plugin can triage and validate findings from other scanners, advisories, bug‑bounty reports, or ticketing systems, then automate patch generation at scale to reduce backlogs. When scans finish, Codex Security can export to existing vulnerability management systems or integrate using SARIF files, CodeQL queries, and more. The plugin aims to make these capabilities accessible in automated pipelines via Codex CLI or within developer workflows in the Codex app.
GPT‑5.5‑Cyber: more permissive and more capable for authorized work
OpenAI released the full GPT‑5.5‑Cyber model, described as both more permissive and more capable for advanced, authorized cybersecurity work. An initial preview primarily reduced unnecessary refusals in specialized workflows; this update is intended to be their strongest single model yet for finding and helping patch software vulnerabilities while preserving GPT‑5.5’s general intelligence and long‑task competence.
The model sustains deeper analysis across large codebases: identifying security‑relevant components, tracing whether vulnerable code is reachable, validating likely issues in controlled environments, developing and testing patches, and preparing evidence for human review. The aim is to help defenders complete remediation cycles rather than merely produce more findings.
Measured performance improvements are reported on several benchmarks. On CyberGym, which measures an agent’s ability to reproduce known vulnerabilities, GPT‑5.5‑Cyber reached 85.6% in single‑model evaluations versus 81.8% for GPT‑5.5 — the highest single‑model CyberGym score OpenAI reports. On ExploitGym, which tests turning known vulnerabilities into working exploits that achieve unauthorized code execution, GPT‑5.5‑Cyber scored 39.5% compared with GPT‑5.5’s 25.95%. On SEC‑bench Pro, which evaluates long‑horizon vulnerability discovery and proof‑of‑concept generation across complex targets, GPT‑5.5‑Cyber reached 69.8% versus GPT‑5.5’s 63.1%.
OpenAI notes that benchmarks are only part of the picture; what matters is whether models find real vulnerabilities, separate actional issues from noise, and help defenders land fixes safely. The company is continuing to evaluate the model on complex repositories and live remediation workflows as coordinated disclosures complete.
Trusted access, partner program and government engagement
OpenAI says it has ongoing dialogue with the U.S. government about its cyber approach and model preparations, collaborating with the Center for AI Standards and Innovation (CAISI) on pre‑deployment testing for GPT‑5.5 and GPT‑5.5‑Cyber, and working with the Office of the National Cyber Director (ONCD) and the Office of Science and Technology Policy (OSTP) on implementation of the recent Executive Order and industry standards.
For most defenders, GPT‑5.5 with Trusted Access for Cyber and Codex Security is the recommended starting point. GPT‑5.5‑Cyber is intended for verified defenders whose authorized work requires the most advanced cyber capabilities and more permissive behavior, accompanied by stronger verification, monitoring, scoped controls, and review. Early Daybreak use of GPT‑5.5 and Codex Security has helped validate vulnerabilities in widely used systems including Firefox, V8, Safari, OpenBSD, FreeBSD and HTTP/2 implementations.
OpenAI is launching the OpenAI Daybreak Cyber Partner Program with leading security software and services providers. Participating partners can use GPT‑5.5 with Trusted Access for Cyber inside their products and services so customers gain defensive model capabilities through trusted vendors while direct model access remains with participating partners. OpenAI will work with partners to strengthen safeguards, monitoring and abuse‑prevention standards; the rollout begins with an initial set of partners and will expand in coming months.
OpenAI also says it has established Trusted Access for Cyber partnerships with Australia, Canada, France, Germany, Japan, the Republic of Korea and EU institutions such as ENISA, and is growing a trusted partnership with the UK government on cyber, testing and evaluation, and related areas.
Patch the Planet: reducing burden on open source maintainers
Patch the Planet, founded with Trail of Bits and in collaboration with HackerOne and Calif, funds expert security researchers and equips them with Codex Security and advanced models to work directly with open source maintainers. Participating projects receive ChatGPT Pro, conditional access to Codex Security, and API credits to support core development, maintainer automation, and release workflows.
OpenAI notes that open source powers products, public services, developer tools and critical infrastructure, yet many projects are sustained by very small teams. Research from the Linux Foundation and Harvard found that 94% of widely used projects studied had fewer than ten developers responsible for more than 90% of the code added in a year. As AI increases the volume of findings, maintainers risk being overwhelmed by reports — many false positives — unless remediation capacity is provided. Patch the Planet centers expert human review: researchers consult with maintainers to set priorities and disclosure processes, then validate and deduplicate vulnerabilities and patches before they reach maintainers, reducing maintenance burden and speeding remediation.
An initial five‑day sprint across multiple projects surfaced hundreds of issues for review, merged dozens of patches with more underway, and produced reusable fuzzing, variant‑analysis, differential‑testing and specification‑based testing workflows.
From finding to fixing
Daybreak brings models, Codex Security, Patch the Planet, expert researchers, maintainers, security partners, critical infrastructure operators and trusted access controls together to help human defenders manage the increased pace and scale of vulnerability discovery. Organizations can work with OpenAI Daybreak to identify, validate and remediate vulnerabilities in software they build and rely on; developers and maintainers can run Codex Security on their own code, review findings and help land fixes; security partners can integrate frontier models into defensive tools and deliver those capabilities more broadly.
OpenAI frames the overall goal succinctly: it is not enough to find vulnerabilities — the world is protected when fixes are developed, validated and deployed.
