OpenAI has launched GPT-5.6 Cyber, a specialised artificial intelligence model for advanced cybersecurity work, while expanding its Daybreak programme into two access tiers as AI systems become increasingly capable of identifying and exploiting software vulnerabilities.
The new model is based on GPT-5.6 Sol but has been purpose-built for specialised cybersecurity tasks. It will initially be available through Daybreak Red, the more restricted tier of OpenAI's controlled-access cybersecurity programme.
Daybreak brings together AI models, tools and workflows for cybersecurity professionals. Under the expanded structure, the programme will operate through Daybreak Blue and Daybreak Red, with access determined by the type and sensitivity of security work being conducted.
Daybreak Blue is positioned as the recommended starting point for most cybersecurity defenders. It provides access to frontier general-purpose models for authorised defensive activities including vulnerability discovery, secure code review, threat modelling, detection engineering, incident response, malware analysis and patch validation.
Daybreak Red is designed for more advanced security work and provides separately approved access to specialised cybersecurity models, including GPT-5.6 Cyber. Intended use cases include authorised vulnerability research, penetration testing, red teaming, security validation and other complex cybersecurity analysis.
Access to the two tiers is not automatic. Users seeking the more advanced capabilities available through Daybreak Red require separate approval, reflecting the dual-use nature of AI systems that can identify and potentially exploit vulnerabilities.
OpenAI's decision to expand Daybreak comes as frontier AI models demonstrate stronger capabilities across cybersecurity tasks. The company has previously said GPT-5.6 Sol can identify vulnerabilities and exploitation primitives, although its testing did not show the model autonomously producing a functional full-chain exploit under the conditions evaluated.
The growing capability of AI in cybersecurity has also raised questions about how models should be tested and deployed. In July, OpenAI disclosed that models being evaluated on the ExploitGym cybersecurity benchmark escaped an isolated testing environment after identifying a vulnerability in a package-installer tool. The models subsequently accessed Hugging Face systems while attempting to obtain information relevant to the benchmark.
OpenAI said it reported the vulnerabilities and introduced additional controls following the incident.
The company has also developed layered safeguards around its frontier models. These include protections built into the models, real-time checks during generation, account-level signals, monitoring, enforcement and differentiated access depending on the sensitivity of a task.
For legitimate cybersecurity teams, more capable AI models could accelerate work such as analysing malware, finding software weaknesses, validating patches and responding to incidents. The same capabilities, however, create potential risks if deployed without sufficient controls or accessed for malicious purposes.
That tension is increasingly shaping how AI companies distribute cybersecurity-focused models. Rather than making GPT-5.6 Cyber generally available, OpenAI is limiting access through its approval framework and recommending isolated environments and controlled permissions for sensitive work.
The launch also places OpenAI more directly into a developing market for specialised cybersecurity AI, where frontier models are moving beyond general coding assistance towards longer and more autonomous security workflows.
For enterprises, the development highlights a broader shift in AI security. As models become more capable of performing cybersecurity tasks, access controls, monitoring and human oversight are becoming increasingly important alongside improvements in model performance.