OpenAI expands Daybreak: GPT-5.5-Cyber 85.6% on CyberGym, Patch the Planet funds maintainers, 30+ open-source projects join
OpenAI announced major expansions to its Daybreak cybersecurity initiative on June 22, 2026. The updated GPT-5.5-Cyber model achieved 85.6% on CyberGym (internal benchmark for AI vulnerability reproduction), up from 81.8% for GPT-5.5, and 69.8% on SEC-Bench Pro vs. 63.1% for GPT-5.5. The full version of GPT-5.5-Cyber is now available through Trusted Access for Cyber to verified defenders only. Codex Security, the applied security plugin, has already scanned over 30 million commits across 30,000+ codebases since launching in research preview in March 2026; human reviewers have marked 70,000+ findings as fixed and 500,000+ have been auto-determined fixed.
Patch the Planet, a new initiative founded with Trail of Bits and in collaboration with HackerOne and Calif, will fund expert security researchers to work directly with open-source maintainers on vulnerability discovery, validation, and patching. More than 30 open-source projects have committed to participate, including initial participants cURL, Go, Python, Sigstore, and pyca/cryptography. Preliminary results include 8 Linux kernel proof-of-concepts, 24 local privilege escalation exploits, over 10 exploitable Safari vulnerabilities, and four of six dnsmasq CVEs flagged before public fixes.
OpenAI also launched the Daybreak Cyber Partner Program, bringing trusted access to GPT-5.5-Cyber into established security products and workflows. Participating partners include Accenture, Akamai, Check Point, Cisco, Cloudflare, CrowdStrike, IBM, Oracle, Palo Alto Networks, Zscaler, and newly announced Darktrace. The partner-tier model ensures customers benefit from frontier cyber models without direct model access, preserving OpenAI's ability to gate dual-use capabilities.
For security teams and open-source maintainers, the Patch the Planet model—providing AI-assisted vulnerability discovery paired with expert human triage—signals an industry shift from "find more vulnerabilities faster" to "remediate at machine speed." Practitioners should expect velocity gains in vulnerability lifecycle management but need to validate governance and least-privilege access for agentic security systems. The benchmarks (85.6% CyberGym vs. Anthropic's Claude Mythos) establish GPT-5.5-Cyber as the frontier offering for authorized defensive security work.