OpenAI just gave its security AI a significant upgrade

22 June 2026 · 3 minute read

OpenAI today updated GPT-5.5-Cyber, the most permissive model in its Daybreak cybersecurity platform. The updated model scores 85.6% on CyberGym, OpenAI's internal benchmark for measuring whether an AI can reproduce known software vulnerabilities in controlled test environments. The previous version of GPT-5.5 scored 81.8% on the same benchmark.

Daybreak is OpenAI's cybersecurity-focused product line, first launched in May 2026. It is positioned directly against Anthropic's security-focused Project Glasswing, as both companies compete to sell AI-assisted security tooling to enterprise customers.

Three tiers, different access requirements

The platform offers three model variants. Base GPT-5.5 handles general security workflows including threat modelling and documentation. GPT-5.5 with Trusted Access targets verified defensive security teams; individuals accessing this tier must have Advanced Account Security enabled (required from June 2026). GPT-5.5-Cyber is the most capable variant, intended for authorised red-teaming and penetration testing by verified security professionals.

The Codex Security integration is where the practical value sits. It lets security teams automate the scanning of codebases for known vulnerability patterns, generate candidate patches, and validate that patches actually address the underlying issue. This is not a tool for finding novel zero-days. It is a tool that makes existing vulnerability research faster and more repeatable.

What the benchmark actually measures

An 85.6% score on CyberGym means the model successfully reproduced known, previously disclosed vulnerabilities in 85.6% of controlled test cases. Reproducing a known vulnerability in a test environment is different from discovering a new one in a live system. But it is a meaningful measure of how capable the model is as a security research assistant.

The access control design matters here. OpenAI restricts the most capable tier to verified professionals. Whether that holds at scale, and how the capability compares to what well-resourced adversaries can build, are questions the benchmark score does not answer.

The market competition

Enterprise security is one of the clearest immediate business cases for AI. Security teams are short-staffed everywhere. Any tool that credibly multiplies analyst capacity is immediately measurable in business value. Both OpenAI and Anthropic are making direct plays for this market, and today's update is OpenAI's clearest signal yet that the Daybreak competition against Glasswing is serious.