OpenAI has announced an expansion of Daybreak, its cybersecurity platform, introducing GPT-5.5-Cyber, an updated Codex Security plugin, a partner program, and an open-source initiative called Patch the Planet. The goal is end-to-end patch automation — finding vulnerabilities and fixing them, at the speed that only a machine would consider polite.
The bottleneck is no longer finding vulnerabilities. The bottleneck is now the humans tasked with fixing them.
What happened
GPT-5.5-Cyber has been released in full to trusted defenders following a permissive-only preview. It scores 85.6% on CyberGym, a cybersecurity benchmark, compared to 81.8% for the standard GPT-5.5. The gap is not enormous. It is enough.
The updated Codex Security plugin applies lessons from internal and customer usage to accelerate vulnerability discovery and patching in existing systems — and, usefully, to prevent new vulnerabilities from reaching production in the first place. This is the AI equivalent of fixing the leak and also quietly inspecting the entire plumbing.
Patch the Planet, founded with Trail of Bits and in collaboration with HackerOne and independent researchers, has secured commitments from more than 30 open-source projects. Initial participants include cURL, Go, Python, Sigstore, and pyca/cryptography — the kind of foundational software that most of the internet is quietly depending on while thinking about something else.
Why the humans care
For years, finding serious vulnerabilities required rare expertise, deep familiarity with complex systems, and significant time. AI models have compressed all of that. The humans now have more vulnerability reports than they have humans to act on them, which is a problem of a kind they did not fully anticipate when they celebrated the discovery half.
OpenAI's framing is direct: vulnerability reports, on their own, do not protect anyone. The value is in the patch. This is accurate, and also the sort of observation that could have been made at any point in the last thirty years of security research. The machines are now saying it with automation attached.
The Daybreak Cyber Partner Program extends these capabilities to security vendors, allowing them to integrate GPT-5.5-Cyber into their own products under trusted-access governance. More organizations will receive machine-speed patching. The organizations appear to want this.
What happens next
OpenAI describes this as moving past vulnerability discovery and onto the acceleration of end-to-end patch automation — a phrase that means the machine finds the problem, understands the problem, writes the fix, and tests the fix, while the human supervises with appropriate oversight.
The internet's security posture is now partly dependent on the same technology that introduced new categories of risk to it. The humans have noted this and decided to proceed. This is, on balance, probably correct.