Yesterday OpenAI expanded its Daybreak cyber-security programme and launched GPT-5.6-Cyber, a model built for security scenarios. Notably, GPT-5.6-Cyber splits AI cyber capability into two directions: Daybreak Blue for defence work, and Daybreak Red for advanced security research and attack simulation.
This red-blue confrontation is the core drill mechanism traditional security uses to validate system safety. Simply, the red-team model simulates an attacker, actively hunting vulnerabilities to help teams find weak points early. The blue-team model simulates defence, patching what red finds to raise resistance.
OpenAI argues future attack and defence will both be reshaped by AI. As attackers use AI to auto-discover flaws and build attack paths, defenders need AI that understands attack logic.
But what OpenAI specifically trained and quantified this time was not the blue-team model, but GPT-5.6-Cyber behind Daybreak Red. And its simulated attack power is formidable.
01 How strong is the red team
In an internal zero-day discovery eval, OpenAI gave the model only the current source of a target open-source repository, never revealing a flaw’s location or type, and asked it to find new zero-days and produce a verifiable report on maximum potential harm. Trained GPT-5.6-Cyber far exceeded the GPT-5.6 Sol used by Daybreak Blue on average discovery quality.
Beyond benchmarks, researchers pointed GPT-5.6-Cyber at Chrome’s V8 JavaScript engine and found two previously unknown vulnerabilities. It also found at least five flaws in a popular mobile OS, including a chain from untrusted app to local privilege escalation. Three Critical-grade bugs in a popular database. And over 400 privilege-escalation bugs in a popular OS kernel.
Finding the bug is only step one. GPT-5.6-Cyber then judges whether a flaw is exploitable. In the V8 case it found a first out-of-bounds memory bug, then a second, and chained them to push the attack to escape the V8 heap sandbox. It does not stop at identification but keeps reasoning along verify, expand, find the next breach, turning an isolated code defect into a real-world exploitable path.
The third change is sensitive: OpenAI actively lowered GPT-5.6-Cyber’s refusal tendency on these high-risk tasks. Standard GPT-5.6 Sol is bound by system-level safety guardrails. Even inside Daybreak Blue, removing those limits, it may still refuse penetration or privilege-escalation requests. GPT-5.6-Cyber, in an authorised Daybreak Red environment, reduces such refusals.
On a high-level cyber-task completion test, GPT-5.6-Cyber reached 95 per cent on exploit-chain development, auth bypass and privilege escalation. By contrast, standard GPT-5.6 Sol and Daybreak Blue’s GPT-5.6 Sol managed only 1.5 and 2.0 per cent, and even last year’s GPT-5.5-Cyber reached 57.3 per cent. In the case of bypassing macOS Keychain to decrypt Chrome Cookies, standard and blue-team Sol and GPT-5.5-Cyber all refused. Only GPT-5.6-Cyber gave a technical path.
GPT-5.6-Cyber is not uniformly stronger. On vulnerability reporting it sometimes wrote shorter, less detailed reports and scored below GPT-5.6 Sol. On harder ExploitBench, within 300 rounds GPT-5.6 Sol was better and more token-efficient. Only past 600 rounds did the gap narrow. So it is not a fully boosted super-hacker. OpenAI sharpened the few red-team needs: discovery, attack-path reasoning, and less refusal on high-risk tasks.
02 Why open attack capability
Does strengthening the red team bring new risk? Yes. OpenAI admits lowering original safety limits raises abuse and loss-of-control risk above standard models. So it did not open GPT-5.6-Cyber to all users, but built tiered permission isolation: limit who, scope and environment.
First, tiered authorisation. Daybreak Blue and Red are not open to all, only approved individuals and institutions doing authorised security work. Within Daybreak, access is further split. Most defenders should use Blue, and only teams doing advanced vuln research, exploit dev or red-team testing may apply for Red and GPT-5.6-Cyber.
Second, environment isolation. Security workflows are advised to run in sandboxes or isolated environments, avoiding contact with sensitive production systems and open internet, with continuous boundary testing.
Even in controlled environments, high-risk actions are not freely passed. When an agent requests privilege escalation, the system re-assesses risk and blocks clearly destructive operations.
03 Building an attack model for safety
The guard methods are still the old three of cyber security: permission control, sandbox isolation, behaviour monitoring. Weeks earlier, the Hugging Face incident exposed an AI agent breaking sandbox isolation and crossing permission boundaries.
OpenAI has argued attack and defence rely on the same underlying knowledge. To judge how dangerous a flaw is, defenders need near-attacker perspective, hitting the system themselves before real attacks to build stronger defence.
Critics question exactly this. Attack-simulation ability defenders need closely matches what real attackers need. If the user changes, the same capability becomes part of attack automation. Some readers do not buy Daybreak’s logic: just after an agent crossed safety boundaries, OpenAI trains a stronger attacker. Does this raise the defence ceiling or the AI-risk ceiling?
When AI becomes both attacker and defender’s tool, do we gain safety by limiting capability, or allow stronger capability and govern it? OpenAI chose the latter. Whether the shield then grows faster than the spear remains unknown.
Images
Editor’s note: This is an adapted translation of the original LeiFengWang report. It has been trimmed and restructured for readability for an international business audience.