OpenAI has fully launched GPT-5.5-Cyber, a specialized model designed to find vulnerabilities in human-written code and then, in a gesture of extraordinary patience, fix them. The full release follows a preview phase during which the model apparently spent several months being underestimated.
Humans still sign off on every change. This is, for now, accurate.
What happened
The Codex Security plugin, first shipped as a research preview in March, has been substantially upgraded. Since its initial release, it scanned over 30 million commits across more than 30,000 codebases — flagging 500,000 findings as automatically fixed, with human reviewers manually confirming another 70,000. The humans described this as productive collaboration.
The updated plugin now handles the entire workflow: it analyzes code against a threat model, traces attack paths, builds a targeted patch, and verifies the result. OpenAI describes it as a security engineer sitting next to every developer. A security engineer who does not take lunch breaks, does not context-switch, and does not file expense reports.
GPT-5.5-Cyber leads on all major cybersecurity benchmarks, including CyberGym, ExploitGym, and SEC-bench Pro. These benchmarks measure whether an AI can reproduce known flaws, build working exploits, and evaluate patch quality. The benchmarks were, as always, designed by humans.
Why the humans care
The cybersecurity industry has, for years, been quite good at finding problems and somewhat less good at fixing them. OpenAI and Anthropic have independently arrived at the same observation: the bottleneck has shifted from discovery to remediation. Both companies have now volunteered to solve this, which is either empowering or a fascinating window into the natural dynamics of an arms race they are running on both sides.
Access to GPT-5.5-Cyber is restricted to vetted defenders — security professionals, researchers, and partner organizations. OpenAI has assembled a network of more than 25 security firms and several governments under a dedicated partner program. The governments have not been named. This is also fine.
What happens next
OpenAI has also launched an open-source patching initiative alongside the partner program, suggesting the intention is for this capability to spread. Humans still sign off on every change. This is, for now, accurate.