OpenAI Daybreak Moves GPT-5.5-Cyber From Bug Discovery to Patch Automation
OpenAI is moving its cyber program from finding vulnerabilities to landing fixes.
Daybreak now bundles three pieces: the full GPT-5.5-Cyber release for trusted defenders, a Codex Security plugin update for finding and validating vulnerabilities inside existing codebases, and Patch the Planet, an open-source remediation program run with Trail of Bits and maintainers of critical projects.
The model score is the least interesting part, but it anchors the release. GPT-5.5-Cyber reaches 85.6% on CyberGym, up from 81.8% for GPT-5.5. On ExploitGym, the cyber-tuned model posts 39.5% versus 25.95% for the base model. SEC-bench Pro moves to 69.8% from 63.1%.
The Product Shift
Codex Security has already scanned more than 30 million commits across over 30,000 codebases. Users have marked more than 70,000 findings as fixed, with over 500,000 automatically remediated.
That is the real product line: not a red-team chatbot, but a security workflow that can inspect code, validate a finding, draft a patch, and prove the remediation works. GPT-5.5-Cyber remains access-controlled. Codex Security is the distribution surface for ordinary application security teams.
Patch the Planet
Patch the Planet shows where the pressure point has moved. The first week covered 19 open-source projects across cryptography, networking, language infrastructure, and software supply chain. The public tally includes 64 pull requests and 51 issues, with 37 patches already merged. More than 30 projects have joined the program.
The named targets include cURL, NATS, pyca, Sigstore, aiohttp, Go, freenginx, Python and python.org, urllib3, PyPI, SimpleX, Valkey, and RustCrypto. The work is not just bug filing. It includes fuzzing harnesses, CI security scanning, supply-chain hardening, correctness fixes, and release-process improvements.
Why It Matters
The scarce resource in security is no longer just exploit discovery. Frontier models can produce findings faster than maintainers can triage them. The expensive work is confirmation, severity correction, deduplication, disclosure coordination, and patches that maintainers will actually merge.
Daybreak is OpenAI’s attempt to own that workflow end to end. The risk is equally clear: if every frontier lab can create a flood of plausible bug reports, maintainers need filtering and patch capacity more than they need another inbox full of CVEs.