OpenAI Ships Full GPT-5.5-Cyber, Pushing Autonomous Vulnerability Hunting Into Defenders' Hands

OpenAI expanded its Daybreak security program with the full release of GPT-5.5-Cyber, a Codex Security plugin that finds, validates and fixes vulnerabilities, and "Patch the Planet," an initiative aimed at critical open-source projects. The model is restricted to verified defenders, with monitoring and scoped controls rather than open availability.

On the benchmarks OpenAI reports, GPT-5.5-Cyber reached 85.6 percent on CyberGym versus 81.8 percent for GPT-5.5, 39.5 percent on ExploitGym versus 25.95 percent, and 69.8 percent on SEC-bench Pro versus 63.1 percent. The company says its models have already found and generated patches for flaws in major browsers, network infrastructure and operating systems, including FreeBSD and the Linux kernel. A Cyber Partner Program lists Accenture, Akamai, Check Point, Cisco, Cloudflare, CrowdStrike, IBM and Palo Alto Networks, among others.

These numbers are vendor-reported and not yet independently reproduced. The ExploitGym jump from roughly 26 to 39 percent is the figure to scrutinize, because exploit generation is the capability that serves both attackers and defenders. A model good enough to write patches at scale is, by the same design, good at finding the bugs to attack. OpenAI's answer is access gating and defender verification, which is a policy control rather than a technical one. Whether that works depends on enforcement, not on the benchmark.