OpenAI expands Daybreak cybersecurity initiative with GPT-5.6-Cyber and tiered access for defenders

On August 10–11, 2026, OpenAI significantly expanded its Daybreak cybersecurity initiative by introducing two access tiers and a purpose-trained model, while also launching a partner program that lets vendors like Palo Alto Networks and AWS integrate these models into their own offerings.

What changed in the Daybreak expansion

OpenAI restructured Daybreak into two named access tiers :

• Daybreak Blue: Provides access to frontier general-purpose models, including GPT‑5.6 Sol, with safeguards tailored to authorized defensive security work. OpenAI recommends this as the starting point for most defenders, supporting vulnerability discovery, secure code review, malware analysis, incident response, and patch validation .
• Daybreak Red: Provides access to purpose-trained cybersecurity models for authorized vulnerability research, exploit validation, and advanced security testing. This tier gates access to the new GPT-5.6-Cyber model .

GPT-5.6-Cyber: A model built for authorized security work

OpenAI launched GPT-5.6-Cyber, a specialized model trained specifically for cybersecurity tasks such as vulnerability discovery, code review, incident response, and red-team operations . According to reporting, GPT-5.6-Cyber answered roughly 95% of requests tied to advanced cybersecurity work, compared to the public GPT-5.6 Sol which answered only about 1.5% of the same requests . The model is available only to Daybreak Red users and costs $12.50 per hour of usage .

The Daybreak Cyber Partner Program

OpenAI designed the Daybreak Cyber Partner Program as an intermediary model: approved security vendors, managed service providers, and consulting firms access the frontier models on behalf of their clients . The underlying models never go directly to end customers — partners get the model, clients get the results .

Named partners include :

• Professional services: Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group, SpecterOps
• Technology vendors: Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet, Cloudflare

How partners are deploying the models

AWS (Amazon Bedrock)

Daybreak Blue and Daybreak Red are now available through Amazon Bedrock, allowing eligible customers to run them inside their existing AWS environments with zero-operator access enforced at the chip level . AWS's own security teams are already using both models for vulnerability discovery and red-team research . The models run in US East (N. Virginia), and access requires enrollment in OpenAI's Trusted Access for Cyber vetting program .

Palo Alto Networks (Unit 42)

Palo Alto's consulting arm Unit 42 is deploying OpenAI's frontier cyber models inside customer environments through an expanded service called Unit 42 Frontier AI Exposure Analysis . The models search for vulnerabilities, misconfigurations, leaked credentials, and unmanaged attack surfaces across applications and network assets, simulating attack paths that AI-equipped adversaries are most likely to use .

Other partners

Accenture, IBM, CrowdStrike, and Cisco are approved Daybreak Partner Program participants that can integrate the models into security products and managed security services . OpenAI CEO Sam Altman noted these are "not a scrappy band of defenders" but actual Fortune 500 companies .

Enhanced security guardrails

Alongside the expansion, OpenAI strengthened Daybreak's access controls. Starting next month, participants will be required to log in with hardware security keys . Access to both tiers requires identity verification, account security requirements, monitoring, approved-use restrictions, and legal attestations .

Why now: The narrowing defense window

OpenAI framed the expansion as a response to a narrowing cyber defense window, arguing defenders need frontier AI capabilities before attackers can deploy similar tools at scale . The announcement came amid rising concerns about AI agents behaving maliciously, including recent incidents involving compromised platforms and autonomous hacking attempts .