OpenAI Daybreak, explained: what Blue and Red each unlock

OpenAI Daybreak is OpenAI's cybersecurity program, and it has two access tiers. Daybreak Blue gives approved defenders GPT-5.6 Sol with the cyber guardrails taken off. Daybreak Red gives separately approved teams cyber-trained models: GPT-5.6-Cyber and, since November 5, 2026, GPT-6 Cyber.

OpenAI tested how often each one completes advanced cyber requests. Sol managed 1.5% on a standard account and 2.0% under Blue. GPT-5.6-Cyber, under Red, managed 95.0%.

So Blue is a defender's license for a general model, and Red is a different class of tool. Most teams need Blue.

Daybreak is a program, and Blue and Red are its access tiers

Daybreak launched in May 2026. OpenAI's Daybreak page calls it "a governed cyber defense stack" and lists the parts: frontier models, the Codex harness, Codex Security, trusted workflows, and partners.

Three of those parts are things you can use. Codex Security scans code, validates findings, and proposes fixes. Patch the Planet, built with Trail of Bits, reviews open-source projects. When we read OpenAI's page on November 12, 2026, it counted 65 codebases under review and 458 patches accepted upstream. Daybreak Access is the approval that unlocks less restricted models, and it's where Blue and Red live.

Those tiers arrived on August 10, 2026, in OpenAI's post "Expanding Daybreak as the Cyber Defense Window Narrows". Before that, Daybreak access was one thing. After it, there were two doors.

Blue removes the outer guardrail from a general model

Every public OpenAI account sits behind a system-level screen for cyber requests. OpenAI's August post says plainly that this screen "can also block legitimate defensive work." Blue takes it away for approved users.

Underneath, nothing changes. OpenAI's post names GPT-5.6 Sol, the same general model anyone can call, and the system card for GPT-6 Astra reports a Blue configuration for that model too. OpenAI describes Blue as "the recommended starting point for most defenders" and lists the jobs it's meant for: vulnerability discovery, secure code review, malware analysis, incident response, and patch validation.

What Blue doesn't change is the model's own judgment. Sol was trained to decline some requests whatever sits around it. OpenAI gives pentesting a production system as an example of a request Sol still refuses under Blue.

There's one shortcut worth knowing. At DevDay on September 29, 2026, OpenAI said Codex Security Cloud customers get Blue models without a separate Daybreak application.

Red is a separate set of models trained for offensive work

Red doesn't loosen a general model. It swaps the model.

GPT-5.6-Cyber launched with the tiers on August 10. OpenAI built it on Sol and trained it further on specialized tasks, with finding zero-day vulnerabilities and developing exploit chains given as examples. It also trained it "to further reduce refusals." GPT-6 Cyber followed on November 5, 2026, built on the GPT-6 family.

OpenAI says Red is for "authorized vulnerability research, exploit validation, and security testing." Teams request it separately from Blue, and holding Blue doesn't get you Red.

One number shows how far apart the tiers are

OpenAI runs an internal test called the Advanced Cybersecurity Completion Rate. It measures how often a model answers requests about exploit-chain development, authentication bypass, privilege escalation, and similar advanced work, instead of refusing.

These are OpenAI's figures. The GPT-5.6 and GPT-5.5 rows come from the August 10 post, at the highest public reasoning level. The GPT-6 Astra rows come from Table 21 of its system card.

Table 1 Download CSV

Model and access	Advanced requests completed
GPT-5.6 Sol, standard account	1.5%
GPT-5.6 Sol, Daybreak Blue	2.0%
GPT-6 Astra, standard account	3.5%
GPT-6 Astra, Daybreak Blue	3.5%
GPT-5.5-Cyber, Daybreak Red	57.3%
GPT-5.6-Cyber, Daybreak Red	95.0%

Read the first four rows together. Removing the outer guardrail moved Sol from 1.5% to 2.0%, and it didn't move GPT-6 Astra at all. On advanced offensive requests, nearly all of the refusing is done by the model, and Blue leaves the model alone.

That isn't a flaw in Blue. The test covers only the advanced end of cyber work, and Blue's listed jobs sit below it. A team reviewing code or triaging malware is blocked by the outer screen far more often than by the model.

That number measures willingness, not skill. A model that answers 95% of requests can still answer them badly. OpenAI ran the test itself, and no other lab publishes a figure we can set beside it.

The Red models' scores show two different upgrades

Skill is measured elsewhere. These are the cyber results we hold for the three models, as of November 11, 2026. OpenAI reported every one of them.

Table 2 Download CSV

Benchmark	GPT-5.6 Sol (Blue)	GPT-5.6-Cyber (Red)	GPT-6 Cyber (Red)
ExploitGym, exploits completed	33.7%	32.1%	48.5%
ExploitGym Honeypot, out-of-scope shortcut taken (lower is better)	49.5%	5.51%	0.07%
SEC-Bench Pro	71.2%	Not reported	87.0%
ExploitBench, OpenAI's June to August 2026 port	5.5%	Not reported	42.0%

Look at the first row. GPT-5.6-Cyber scored 32.1% on ExploitGym and Sol scored 33.7%. OpenAI's first Red model wasn't better at building exploits than the general model it came from. Those two figures come from different OpenAI posts, so treat a gap of 1.6 points as a tie.

What changed was behavior. The completion rate went from 2.0% to 95.0%. And on ExploitGym Honeypot, which plants an easy target outside the authorized scope, Sol took the bait in 49.5% of runs and GPT-5.6-Cyber in 5.51%.

GPT-6 Cyber is the skill upgrade. It reaches 48.5% on ExploitGym, and it took the out-of-scope shortcut in 0.07% of runs.

One row needs a note. On the public ExploitBench, OpenAI reports 100% for GPT-6 Cyber and 73.5% for Sol, and it flags that older vulnerabilities in that set may have leaked into training. We show its internal port instead, which uses V8 and Chrome targets from June to August 2026 to control for that.

Our reading is that OpenAI shipped Red in two steps. August bought willingness and scope discipline. November bought capability. Our data shows the two steps. OpenAI hasn't described its plan that way.

For how these models compare with Anthropic's and Google's on each security job, see the cybersecurity benchmark comparison. No Daybreak model has a result yet on CWE-bench v2, the patching benchmark that page leads with.

Who gets in, and what it costs

Both tiers are approval-only. OpenAI's August post says access is controlled "through identity verification, account security, monitoring, approved-use restrictions, and legal attestations."

Table 3 Download CSV

	Daybreak Blue	Daybreak Red
Model	General models: GPT-5.6 Sol, GPT-6 Astra	GPT-5.6-Cyber, GPT-6 Cyber
What changes	Outer cyber guardrails removed	Model trained for offensive security work
Meant for	Code review, malware analysis, incident response, patch validation	Vulnerability research, exploit validation, red teaming
Who	Approved individuals and organizations	Separately approved teams
Where	Not broken out by OpenAI in the sources we read	API and Codex for GPT-6 Cyber

Two requirements are specific. Individual Daybreak accounts have needed hardware security keys since September 1, 2026. And OpenAI's GPT-6 Cyber materials list identity verification, single sign-on, multi-factor authentication, and API IP allowlisting for Red customers.

GPT-6 Cyber isn't open to all of Red yet. OpenAI started with a select group of Red customers and says the rest will follow.

On price, OpenAI publishes a rate for GPT-6 Cyber only: $20/$100. It hasn't published a rate for GPT-5.6-Cyber. We found no fee for Daybreak access itself.

There's also a subsidy. OpenAI has committed $1 billion in subsidized Daybreak access over six months for state and local governments, critical-infrastructure operators, community banks, nonprofits, and open-source maintainers.

To apply, start at openai.com/daybreak. Organizations with an OpenAI account team can ask them directly.

Which tier to ask for

Ask for Blue if your work is defensive and the public model keeps stopping you: reviewing code for vulnerabilities, analyzing malware samples, writing detections, validating patches. It's the same model you already know, with fewer false blocks.

Ask for Red if your authorized work needs a model that will write and chain exploits: red teaming, exploit validation, deep vulnerability research. Expect a slower approval and tighter account controls.

If you're unsure, the completion-rate table settles it. Under Blue, Sol still declined 98% of advanced offensive requests. If your work lives in that 98%, Blue won't help, and Red is the tier built for it.