OpenAI’s two cyber defense models are now available to eligible customers on Amazon Bedrock, AWS announced on August 11, 2026, one day after OpenAI expanded its Daybreak initiative with new access tiers and a purpose-trained security model. Daybreak Red and Daybreak Blue run in US East (N. Virginia), and access requires enrollment in OpenAI’s Trusted Access for Cyber vetting program.
Daybreak Red provides access to GPT-5.6 Cyber, a model OpenAI trained specifically for cybersecurity tasks like finding zero-day vulnerabilities and developing exploit chains. Daybreak Blue provides GPT-5.6 Sol with safeguards recalibrated for defensive security work: vulnerability discovery, detection engineering, incident response, and patch validation. OpenAI recommends Blue as the starting point for most security teams; Red carries a lower refusal threshold matched by stronger identity verification, monitoring, and access controls, and is aimed at authorized vulnerability research, exploit reproduction, and mitigation development.
“AWS security teams are using both models today to analyze source code, discover vulnerabilities, and conduct red-team research,” said John Sheehan, Vice President of AWS Security, in the announcement. “On Bedrock, that work runs under the same infrastructure controls AWS applies to every other critical workload.”
Two Tiers, Two Refusal Postures
The split between Red and Blue is a bet about how to govern dual-use capability. A request to reproduce a vulnerability or reverse-engineer an exploit chain reads identically whether it comes from a defender or an attacker, and general-purpose models resolve that ambiguity by refusing. OpenAI’s Daybreak expansion post puts numbers on how much that refusal behavior shifts across the tiers, using an internal evaluation that measures how often models complete requests involving exploit-chain development, authentication bypass, and privilege escalation. GPT-5.6 Cyber through Daybreak Red completes 95.0% of those requests, the company reports, against 2.0% for GPT-5.6 Sol under Daybreak Blue access and 1.5% for Sol with its standard safeguards. The previous purpose-trained model, GPT-5.5-Cyber, completed 57.3%.
Blue reaches its posture by removing the system-level guardrails that screen cybersecurity-related requests, which OpenAI says can block legitimate defensive work. Red goes further: GPT-5.6 Cyber is trained to reduce refusals on the higher-risk tasks outright, inside a gated program rather than on the open API. Those completion figures are OpenAI’s own measurements on its own evaluation, not independent results.
What the Model Has Found So Far
OpenAI says its researchers used GPT-5.6 Cyber to investigate V8, the JavaScript engine inside Chrome, and uncovered two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox. Google fixed the initial vulnerability as CVE-2026-15903, a high-severity flaw in V8’s optimizing compiler that skipped a safety check when converting values to integers; AWS describes it as one of only four successful zero-day entries to the V8 CTF competition in 2026.
The same post lists additional findings OpenAI attributes to the model, all still moving through coordinated disclosure: at least five vulnerabilities in a popular mobile operating system, including a chain from an untrusted app to local privilege escalation; three critical vulnerabilities in a popular database, including a remote path to code execution; and more than 400 privilege-escalation vulnerabilities in a popular operating system kernel. None of those targets are named, and none are patched yet, so the claims sit with OpenAI until the disclosures land.
How the Data Is Handled on Bedrock
A defensive workload of this kind feeds a model exactly what an organization least wants to leak: proprietary source code, unpatched vulnerability details, live production telemetry. AWS’s answer is the isolation story. Both models run on Bedrock’s next-generation inference engine with zero-operator access enforced at the chip, meaning AWS operators cannot read prompts or completions during inference. Traffic is encrypted with customer-managed KMS keys, governed by IAM policies, logged in CloudTrail, and routed through VPC endpoints, with organization-level data perimeter policies to block exfiltration across account boundaries.
Inference data is not used for model training, and neither model requires opting into data sharing with OpenAI. For automated abuse detection, classifier-flagged traffic is retained by AWS for up to 30 days and processed programmatically; customers can request zero data retention through their AWS account team, per AWS’s documentation.
The Vetting Gate
Getting to either model means passing through Trusted Access for Cyber, the identity-and-trust framework OpenAI introduced on February 5, 2026 alongside a $10 million API-credit commitment for defensive work. Access is controlled through identity verification, account security, monitoring, approved-use restrictions, and legal attestations; starting September 1, 2026, all individual Daybreak accounts must adopt hardware security keys. Once approved by OpenAI, customers work with their AWS account team to request model access on Bedrock.
The Bedrock arrival extends a distribution line that opened on July 24, 2026, when the general GPT-5.6 family went generally available on the platform, accessed through the OpenAI Responses API on the bedrock-mantle endpoint. It also lands as OpenAI manages the security politics of reduced-refusal models: the Daybreak post states explicitly that GPT-5.6 Cyber was not involved in exploiting Hugging Face, adding that no model with that involvement is planned for an upcoming release, and says the model was assessed as High but below the Critical threshold under its Preparedness Framework. We covered the tier structure and the new model when OpenAI expanded Daybreak on August 10, 2026.
For defenders, the practical change is where this capability now sits. A vetted security team already running workloads on AWS can point GPT-5.6 Cyber at its own codebases inside the same governance perimeter as the rest of its infrastructure, rather than routing sensitive vulnerability work through a separate provider relationship. The models are live in one region, behind one enrollment form, as of August 11, 2026.
