OpenAI expands Daybreak cybersecurity platform with Codex Security update, full GPT-5.5-Cyber launch, and Patch the Planet open-source initiative

OpenAI on Monday expanded its Daybreak cybersecurity platform with three simultaneous additions: an updated Codex Security plugin, the full launch of the GPT-5.5-Cyber model for vetted defenders, and Patch the Planet, a new initiative co-founded with security firm Trail of Bits to help open-source maintainers find and fix vulnerabilities at scale.

What's new

Codex Security update: The Codex Security plugin now automates the full vulnerability management pipeline — discovery, validation, severity review, disclosure, patch development, testing, and deployment — directly inside the Codex coding environment. Since the cloud version launched in research preview in March, it has scanned over 30 million commits across more than 30,000 codebases, with human reviewers marking more than 70,000 findings as fixed and over 500,000 automatically resolved.

GPT-5.5-Cyber full launch: Following an initial permissive-only preview, the full version of GPT-5.5-Cyber is now available to vetted defenders through the Daybreak Cyber Partner Program. Security firm Sophos is among the confirmed partners.

Patch the Planet: Co-founded with Trail of Bits, in collaboration with HackerOne, the initiative pairs expert security engineers with maintainers of widely used open-source projects. Initial participants include cURL, Python, the Go project, Sigstore, aiohttp, freenginx, and python.org. As of launch, the program has filed 64 pull requests and 51 issues across 19 projects, with 37 patches already merged and more in coordinated disclosure. Over 30 additional projects have committed to join.

The initiative addresses a specific problem: AI-assisted scanners are generating more vulnerability reports than maintainers can process. "Patch the Planet is built to reduce that burden, not add to it: security engineers review findings before they reach maintainers, work with projects to develop patches and tests, and build reusable workflows that help teams continue improving security after the first fixes land."

Context

Daybreak launched earlier in 2026 as OpenAI's dedicated security initiative. GPT-5.5-Cyber was originally introduced as a specialized model for defensive cybersecurity work; its permissive-only preview was limited to a small set of trusted organizations. The June 22 expansion moves Daybreak beyond vulnerability discovery into what OpenAI describes as end-to-end patch automation.

The Patch the Planet name is a deliberate reference to the "Hack the Planet" ethos from 1990s hacker culture, reframing the movement as defensive rather than offensive. The program differs from existing bug bounty platforms in that it provides human expert review at each stage, rather than routing raw AI findings directly to maintainers.

Why it matters

Open-source maintainers underpin much of the internet's critical infrastructure but typically operate with volunteer hours and minimal resources. Routing AI-assisted vulnerability discovery through professional security engineers before anything reaches a maintainer's inbox closes a dangerous gap — and the early numbers (37 merged patches across curl, Python, and other foundational projects) suggest the program can produce real remediation, not just scan reports.

The full GPT-5.5-Cyber launch is equally significant: it gives a broader set of defenders access to a model purpose-built for cybersecurity analysis, at a moment when the offense-defense AI arms race is accelerating. OpenAI is positioning security as a serious long-term product line — not a compliance checkbox.