OpenAI has expanded its cybersecurity programme Daybreak and introduced a new model built for the field: GPT-5.6-Cyber. The most striking part of the announcement is not what the model can do, but that it was trained not to refuse.

The rationale: a narrowing window

The company's framing is direct: threat actors will increasingly use AI to conduct cyberattacks at unprecedented speed and scale, including in fully autonomous ways. As those capabilities spread, defenders have a narrowing window to prepare.

OpenAI's answer is to put frontier intelligence in the hands of trusted defenders before attackers deploy offensive AI capabilities at scale.

Two access tiers

  • Daybreak Blue: access to frontier general-purpose models, including GPT-5.6 Sol, with safeguards tailored to authorised defensive work. The recommended starting point for most defenders, supporting vulnerability discovery, secure code review, malware analysis, incident response and patch validation.
  • Daybreak Red: purpose-trained cybersecurity models for authorised vulnerability research, exploit validation and security testing. GPT-5.6-Cyber is offered here.

The two faces of a safeguard

This is the technically most interesting part of the announcement. OpenAI says that in production it deploys system-level safeguards that screen cybersecurity-related requests to prevent misuse. But the same safeguards can also block legitimate defensive work.

Daybreak Blue access removes those guardrails, helping defenders get more out of the model in real security tasks: incident detection and response, investigations, vulnerability management and security assessments.

Some requests remain even once the guardrails are gone. GPT-5.6 Sol still refuses highly dual-use prompts, such as pentesting production systems.

Training a model to refuse less

To address that, the company trained GPT-5.6-Cyber. Built on GPT-5.6 Sol, it was improved in two directions: stronger capability on specialised cybersecurity tasks — finding zero-day vulnerabilities and developing exploit chains among them — and fewer refusals on certain higher-risk, dual-use tasks.

To measure the reduced refusal rate, the company built an internal evaluation of its own.

Why it is contested

An AI lab deliberately training a model to refuse less runs against the direction the industry is used to. The rationale is defensible: withholding a vulnerability-finding tool from defenders does not remove the same tool from attackers' hands.

But the balance is fragile. Gating access behind enrolment and approval is the only real safeguard here, and how strictly "trusted defender" is applied will determine where this model ends up.

The gate on access

With a model like this, the substantive question is not the model but who receives it. Both Daybreak tiers require enrolment and approval; there is no access without registration.

How that approval process works is not detailed in the announcement. Yet what "trusted defender" means in practice — a security vendor, an independent researcher, a corporate security team — is the single thing that determines the circle this model reaches.

For the industry the announcement is a threshold. Until now AI labs have presented refusal behaviour as a measure of success; here the opposite is argued, and the argument rests on timing.