OpenAI released the full version of GPT-5.5-Cyber on June 22, expanding its Daybreak security initiative with a model it calls its “strongest yet for finding and helping patch software vulnerabilities.” The model scores 85.6% on the CyberGym benchmark, up from 81.8% for the base GPT-5.5, according to OpenAI’s announcement.

The release marks a shift from vulnerability discovery toward end-to-end patch automation, a distinction that matters for teams running autonomous security agents in CI/CD pipelines.

What GPT-5.5-Cyber Does

The model sustains deeper analysis across large codebases than its predecessor, according to OpenAI. It can identify security issues, validate them in controlled environments, and develop and test patches autonomously.

Alongside the model, OpenAI updated its Codex Security plugin to integrate directly into development workflows. The plugin lets developers run deep scans, review recent changes, generate severity reports with affected code locations, trace attack paths, build threat models, and generate codebase-specific patches for review, according to The Hacker News.

The numbers from Codex Security’s research preview since March: over 30 million commits scanned across more than 30,000 codebases, with human reviewers marking more than 70,000 findings as fixed and over 500,000 findings automatically determined to be resolved, according to OpenAI.

Patch the Planet: From Bug Reports to Merged Fixes

OpenAI launched Patch the Planet in partnership with Trail of Bits, shifting the focus from filing issues to actually shipping patches. In its first week, the initiative produced 64 pull requests and 51 issues filed across 19 projects, with 37 pull requests already merged, according to Trail of Bits.

Initial participants include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, python.org, urllib3, PyPI, SimpleX, Valkey, and RustCrypto. Over 30 projects have joined so far.

The Trail of Bits team went beyond bug fixes, adding fuzzing harnesses, CI security scanning with zizmor, supply-chain tooling, and correctness fixes. At python.org, they contributed a full CI workflow for GitHub Actions static analysis. In RustCrypto, they submitted correctness fixes to the big-integer library alongside serde encoding support and HPKE DHKEM suite IDs, according to Trail of Bits.

Vulnerabilities Already Found

Daybreak has already surfaced findings across major operating systems and infrastructure. OpenAI’s disclosed results include 8 kernel pointer information leak proofs-of-concept and 24 local privilege escalation exploits in the Linux kernel, a 23-year-old use-after-free in OpenBSD’s kernel implementation of System V semaphores, 34 vulnerabilities and 7 local privilege escalation PoCs in FreeBSD, 6 vulnerabilities in dnsmasq, and a denial-of-service technique called HTTP/2 Bomb, according to The Hacker News and OpenAI.

One notable find: a 29-year-old flaw in the Squid web proxy (CVE-2026-47729, known as Squidbleed) that can leak cleartext HTTP requests under certain conditions.

The Patching Bottleneck for Agent Builders

The core problem GPT-5.5-Cyber addresses is one that the Canadian Centre for Cyber Security flagged in May 2026 guidance: “Organizations should assume that AI-driven exploitation may bypass preventative controls, significantly outpace vendors’ capacity to publish corrective measures and challenge the organization’s ability to deploy.”

Frontier models have inverted the traditional vulnerability timeline. Finding bugs used to be the bottleneck. Now models can navigate codebases and reason through attack paths faster than maintainers can triage and fix the results. For teams running autonomous security agents or integrating AI-powered scanning into their DevSecOps workflows, GPT-5.5-Cyber and Codex Security represent the other half of the equation: not just finding vulnerabilities at machine speed, but generating, testing, and deploying patches at the same pace.

GPT-5.5-Cyber remains in limited release to trusted defenders through OpenAI’s Daybreak Cyber Partner Program.