OpenAI expands Daybreak with code security tools and partner access

OpenAI says its Codex Security plugin update is intended to accelerate vulnerability discovery and patching, and help prevent new vulnerabilities from reaching production.[1] The company says the tool can understand a team’s code and threat model, identify plausible vulnerabilities, check whether affected code is reachable, gather validation evidence, develop a targeted patch and verify it.[1] Developers can scan an entire codebase, a portion of it, or a specific change or commit.[1] Codex Security can also triage and validate findings from scanners, advisories, bug-bounty reports and ticketing systems, then automate patch generation at scale.[1]

Since its cloud research preview began in March, OpenAI says Codex Security has scanned more than 30 million commits across more than 30,000 codebases.[1] Human reviewers manually marked more than 70,000 findings as fixed, while automated checks determined that more than 500,000 findings were fixed.[1] OpenAI also released the full version of GPT-5.5-Cyber through a continued limited release to trusted defenders, following an initial permissive-only preview.[1] The company describes it as more permissive and more capable for advanced, authorized cybersecurity work.[1]

OpenAI says updated GPT-5.5-Cyber scored 85.6% in single-model evaluations, compared with 81.8% for GPT-5.5.[1] It also reports scores of 69.8% for GPT-5.5-Cyber and 63.1% for GPT-5.5.[1] OpenAI launched the Daybreak Cyber Partner Program with security software and services providers.[1] Customers of participating partners can benefit from the model’s defensive capabilities, while direct model access remains with the partners.[1] The initial partner group includes Accenture, Cisco, CrowdStrike, IBM, Okta, Palo Alto Networks and Wiz.[2]

OpenAI introduced Patch the Planet with Trail of Bits to help maintainers strengthen critical open-source software; more than 30 projects committed to participate.[3][1] Participants include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, Go, freenginx, Python and python.org.[3] OpenAI says a five-day initial sprint surfaced hundreds of issues for review and merged dozens of patches, with more patches underway; Trail of Bits security engineers manually reviewed every issue before it reached a maintainer.[1][3] OpenAI also reported Linux kernel, FreeBSD, Chrome V8 and Safari WebKit research that produced or identified vulnerabilities and proof-of-concepts.[3]