OpenAI Unveils GPT-5.5-Cyber to Patch Vulnerabilities at Scale

OpenAI has announced an expansion of its Daybreak cybersecurity initiative, introducing new tools, partnerships, and the full version of GPT-5.5-Cyber, a model to help organisations identify and patch software vulnerabilities.

The company said the initiative aims to address a growing challenge in cybersecurity: while AI has accelerated vulnerability discovery, organisations are struggling to keep pace with patching and remediation.

As part of the announcement, OpenAI released an updated version of its Codex Security plugin, which can scan codebases, validate vulnerabilities, generate patches, and help developers prevent new security issues from reaching production.

Since its research preview launch in March, Codex Security has scanned more than 30 million commits across over 30,000 repositories, with more than 5,00,000 findings automatically determined to be fixed, according to the company.

OpenAI also launched the full version of GPT-5.5-Cyber through a limited release program for verified defenders. The model achieved 85.6% on CyberGym, a benchmark that measures whether AI agents can reproduce known vulnerabilities, compared with 81.8% for GPT-5.5. It also outperformed GPT-5.5 on ExploitGym and SEC-bench Pro, two security-focused benchmarks.

“We are releasing an update to GPT-5.5-Cyber, our model that is both more permissive and more capable for advanced, authorised cybersecurity work,” OpenAI said.

The new GPT-5.5-Cyber model also outperformed Mythos 5 on the CyberGym benchmark.

The company said GPT-5.5-Cyber is designed to help security teams move beyond identifying vulnerabilities and support the full remediation process, including validating issues, developing patches, and preparing evidence for human review.

OpenAI also launched the Daybreak Cyber Partner Program, allowing security vendors to integrate GPT-5.5 with Trusted Access for Cyber into their products and services. Initial partners include Accenture, Cisco, Cloudflare, CrowdStrike, IBM, Okta, Palo Alto Networks, SentinelOne, Sophos, Wiz, and Zscaler, among others.

In a separate initiative called Patch the Planet, OpenAI is working with Trail of Bits, HackerOne, Calif, security researchers, and open-source maintainers to help projects move from vulnerability discovery to remediation. More than 30 open-source projects, including Python, Go, cURL, Sigstore, and pyca/cryptography, have committed to participating.

“Finding vulnerabilities is important, but it's landing the fix that protects the world," the company said.

OpenAI said it is also collaborating with governments and critical infrastructure operators to strengthen cybersecurity defences. Over the past month, the company established Trusted Access for Cyber partnerships with Australia, Canada, France, Germany, Japan, South Korea, and the European Union Agency for Cybersecurity (ENISA).

The expansion of Daybreak reflects a broader shift in cybersecurity, where AI-assisted vulnerability discovery is becoming increasingly common, and organisations are focusing more on validating, prioritising, and patching security flaws before they can be exploited.