OpenAI Expands Daybreak to Automate End-to-End Vulnerability Patching at Scale

OpenAI Launches Full GPT-5.5-Cyber and Updated Codex Security to Accelerate Remediation

OpenAI has expanded its Daybreak initiative with new tools, partnerships, and the full release of GPT-5.5-Cyber to move beyond vulnerability discovery toward automated, end-to-end patch generation. The company says the bottleneck in cybersecurity has shifted from finding flaws to fixing them before attackers can exploit them.

Key Announcements

• GPT-5.5-Cyber (full version): Now available through a continued limited release to verified defenders. The model scores 85.6% on CyberGym (vs. 81.8% for GPT-5.5), 39.5% on ExploitGym (vs. 25.95%), and 69.8% on SEC-bench Pro (vs. 63.1%).
• Codex Security plugin update: Integrates directly into developer workflows to scan code, build threat models, validate findings, generate targeted patches, and export results via SARIF, CodeQL, and vulnerability management systems.
• Daybreak Cyber Partner Program: Enables security vendors to embed GPT-5.5 with Trusted Access for Cyber into their products and services for customer use.
• Patch the Planet: A new initiative with Trail of Bits, HackerOne, and Calif to help open-source maintainers turn findings into fixes. Over 30 projects have committed, including cURL, Go, Python, Sigstore, and pyca/cryptography.

Codex Security at Scale

Since its research preview in March, Codex Security has:

• Scanned over 30 million commits across 30,000+ codebases
• Had 70,000+ findings manually marked as fixed by human reviewers
• Automatically determined 500,000+ findings as fixed

The plugin now supports deep scans, recent-change reviews, attack-path tracing, threat-model generation, and automated patch generation for backlog remediation.

GPT-5.5-Cyber: Capability with Permissiveness

The updated model is described as OpenAI's strongest yet for finding and patching software vulnerabilities while retaining general-purpose intelligence. It can:

• Sustain deeper analysis across large codebases
• Identify security-relevant components and trace reachability
• Validate issues in controlled environments
• Develop and test patches
• Prepare evidence for human review

OpenAI emphasizes that benchmarks are only part of the story; real-world performance on complex repositories and coordinated disclosures is under ongoing evaluation.

Government and Ecosystem Collaboration

OpenAI reports dialogue with the U.S. government (CAISI, ONCD, OSTP) on pre-deployment testing and Executive Order implementation. Trusted Access for Cyber partnerships have been established with Australia, Canada, France, Germany, Japan, South Korea, EU institutions (ENISA), and the UK.

The company plans to work directly with eligible critical-infrastructure operators, including government networks, to develop tailored safeguards.

Practical Implications for Defenders

• Developers and maintainers can run Codex Security on their own codebases, review findings, and integrate patches.
• Security professionals and partners can use frontier models to strengthen defensive tooling and reach more organizations.
• Open-source projects gain funded expert researchers, Codex Security access, and API credits through Patch the Planet.

How to Verify

• Visit the Daybreak announcement page for official details.
• Review Codex Security documentation and plugin release notes.
• Monitor CyberGym, ExploitGym, and SEC-bench Pro benchmark publications for independent verification.
• Track Patch the Planet progress via Trail of Bits blog and participating project repositories.

Unknowns and Reported Claims

• Claimed: GPT-5.5-Cyber is the highest single-model CyberGym score measured by OpenAI.
• Claimed: The model outperforms GPT-5.5 on real-world benchmarks.
• Not independently verified: Benchmark scores and real-world remediation outcomes.
• Access-limited: GPT-5.5-Cyber remains in limited release to trusted defenders; broader availability timeline unspecified.
• Partnership expansion: Daybreak Cyber Partner Program launched with an initial group; further expansion planned in coming months.