OpenAI launches Daybreak Blue: more room for defensive security
On August 10, 2026, OpenAI expanded its Daybreak cybersecurity program with two access tiers. Daybreak Blue is the entry point for most vetted defenders. Daybreak Red targets advanced vulnerability research, exploit validation and red teaming.
The key point: Daybreak Blue is not a new model. The API alias gpt-daybreak-blue-latest currently points to GPT-5.6 Sol. For approved defensive work, OpenAI relaxes certain system-side cyber filters so that legitimate investigations fail less often on precautionary refusals.
What's new
- Launch of Daybreak Blue and Red: August 10, 2026.
- Blue: general frontier models with adjusted safeguards for authorized defense.
- Current Blue model: GPT-5.6 Sol; API alias
gpt-daybreak-blue-latest. - Red: purpose-trained cyber models; currently GPT-5.6-Cyber.
- Access: only after review and separate enablement.
What applied before
OpenAI had already started the overarching Daybreak program on June 22, 2026. That included Codex Security, GPT-5.5-Cyber, the Daybreak Cyber Partner Program and Patch the Planet. A publicly named split into Blue and Red did not exist at that point.
For security teams, an old problem remained: general models could understand code and spot a possible vulnerability, but would sometimes refuse exactly when the analysis got more technically concrete. The filter couldn’t reliably tell whether the same method served a defender or an attacker.
What applies now
1. Blue changes access, not the base model. Behind Daybreak Blue currently sits Sol. The model’s capabilities are not extended by dedicated security training. Instead, OpenAI removes additional system-side cyber guardrails for approved defensive workflows.
2. Approval stays limited. Interested individuals and organizations have to apply. OpenAI names identity verification, account security, monitoring, approved use cases and legal attestations as controls. For API use, Blue is enabled per project.
3. Risky tasks stay separate. Daybreak Blue still refuses especially dual-use-heavy requests. OpenAI’s own test makes the gap visible: with Blue, Sol’s completion rate rises only from 1.5 to 2.0 percent. GPT-5.6-Cyber with Daybreak Red reaches 95 percent. That is not a quality benchmark; it measures whether the models will take on selected high-risk security tasks at all.
Context after the Astra release
Since September, GPT-6 Astra has been a noticeably stronger model in the room. Astra is OpenAI’s first model at the Critical cyber risk tier and is meant to clearly surpass Sol in vulnerability analysis and exploit development.
But that doesn’t make Blue redundant. Model capability and access rights remain separate questions. For most users, Astra runs with its normal, strict safeguards. According to OpenAI’s current help documentation, reduced refusals on Astra are not yet available for most Daybreak customers. Anyone calling the Blue alias over the API today is using Sol.
The comparison with Claude Fable 5.1 needs the same distinction. Fable 5.1 is a standalone general model. Daybreak Blue, by contrast, is a controlled access path to an existing model. For general coding you compare Fable with Sol or Astra; for approved defensive work you additionally compare which security access levels and refusal boundaries your workflow needs.
What this means in practice
Daybreak Blue is interesting for teams whose legitimate code reviews, malware analyses or incident-response tasks regularly get stuck on cyber filters with normal models. Anyone who only builds applications, writes text or asks ordinary coding questions gets no automatic quality advantage from Blue.
Access also doesn’t replace working boundaries. OpenAI recommends isolated environments, monitored tool calls and a clearly documented scope. The model may only work on systems the user owns or has explicit authorization to test.
The detailed distinction from Sol, Fable 5.1, Astra and Daybreak Red is in the glossary: Daybreak Blue explained.