OpenAI Daybreak, explained: Blue vs Red access, GPT-5.6-Cyber, the $1B defender fund, and Sophos's 89-second cases

OpenAI Daybreak is OpenAI's program for putting its most cyber-capable models in the hands of approved defenders. On October 9 OpenAI published its first big customer result: Sophos says agents it built on Daybreak cut its average response time on those cases from about 38 minutes to about 89 seconds. Here is what Daybreak is, from OpenAI's own posts.

BLUE AND RED

Since August 10, Daybreak has two access tiers:

- Daybreak Blue: OpenAI's frontier general-purpose models, including GPT-5.6 Sol, with the system-level cyber guardrails removed for authorized defensive work. OpenAI calls it the starting point for most defenders: vulnerability discovery, secure code review, malware analysis, incident response, patch validation. - Daybreak Red: purpose-trained cyber models for authorized vulnerability research, exploit validation and security testing. Its model is GPT-5.6-Cyber, built on GPT-5.6 Sol and trained to refuse less on dual-use work such as exploit chains.

On OpenAI's own internal refusal test (its Advanced Cybersecurity Completion Rate), GPT-5.6-Cyber completes 95.0% of requests, against 1.5% for GPT-5.6 Sol, 2.0% for Sol under Blue access, and 57.3% for the earlier GPT-5.5-Cyber. OpenAI also says Cyber does worse than Sol on one of its report-writing evals.

THE PRICE

OpenAI's posts give no prices. The models.dev catalog lists two ids, both dated August 7:

- gpt-daybreak-blue-latest: $4 in and $20 out per 1M tokens, rising to $8 and $30 past 272K tokens, with a 1.05M context and 128K max output. - gpt-daybreak-red-latest: $12.50 in and $75 out per 1M tokens, with a 400K context and 128K max output.

Those are catalog listings, not an OpenAI price sheet.

HOW YOU GET IN

Both tiers need enrollment in Daybreak Access and approval. Since August 11 approved customers can also use Blue and Red inside AWS through Amazon Bedrock. OpenAI says thousands of defenders across 2,000 approved organizations already use Daybreak.

THE TIMELINE

- June 22: Daybreak launches, bundling OpenAI's cyber models, Trusted Access for Cyber, Codex Security and a Daybreak Cyber Partner Program, plus Patch the Planet for open-source maintainers. - August 10: the Blue and Red tiers, and GPT-5.6-Cyber. - August 11: Daybreak on Amazon Bedrock. - September 3: Daybreak for Frontline Defenders, a $1 billion commitment in subsidized access, training and support over six months, starting with US water and power utilities, state and local governments and community banks, with more than 35 partner products in a Daybreak Defense Network. - October 9: the Sophos case study.

WHAT SOPHOS SAYS

These are Sophos's figures, published by OpenAI: average response time on cases using its Daybreak-built agents fell from about 38 minutes to about 89 seconds, and 52% of its managed detection and response cases are now resolved end to end by AI. Potentially destructive actions still go to a human.

WHAT WE DO NOT KNOW

Whether Red has moved to a model built on GPT-6 Astra; the posts we read name GPT-5.6-Cyber. We also do not know what approval takes or how long it runs.