OpenAI Releases GPT-5.5-Cyber, Its New Cybersecurity Model

OpenAI has released its GPT-5.5-Cyber security model and launched the Patch the Planet initiative to automate software vulnerability remediation.

As part of its Daybreak initiative, OpenAI has made an updated version of its GPT-5.5-Cyber AI model, the counterpart to Anthropic’s Mythos, available to selected security organizations. The model is designed to analyze vulnerabilities in large codebases, validate findings in controlled environments, and create and test automated remediation patches. At the same time, the company is releasing an update to its Codex Security plugin.

Developers can use the tool to perform deep code scans, build threat models, and generate reports detailing severity levels, affected code lines, validation evidence, and specific remediation steps. The plugin can also process existing findings from bug bounty programs or ticketing systems to accelerate the resolution of known issues at scale. As artificial intelligence speeds up vulnerability discovery, the bottleneck in cybersecurity is increasingly shifting from finding flaws to fixing them quickly.

After GPT-5.5-Cyber: Partnership to Protect Open Source Software

To help open source developers handle the growing number of automatically detected vulnerabilities, OpenAI is launching the Patch the Planet project together with security company Trail of Bits. Initial participating projects include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, as well as Python and python.org. The initiative is intended to help security engineers review AI-generated findings and establish reusable workflows for vulnerability discovery and remediation.

OpenAI stated:

“With Patch the Planet, we are working with researchers, maintainers, companies, and partners to provide defenders with powerful cyber capabilities, with appropriate access, control, and human oversight.”

OpenAI

The need for rapid defensive measures is growing as attackers are increasingly using AI to shorten the time between discovering a vulnerability and exploiting it. The Canadian Centre for Cyber Security highlighted this risk in a guideline, stating: “Actors with limited technical expertise can use publicly available AI models for malicious purposes.”

Previous Findings in Operating Systems and Browsers

According to OpenAI, the Daybreak initiative has already contributed to the discovery of numerous vulnerabilities in widely used systems. Reported findings include:

• 8 information leaks and 24 local privilege escalation vulnerabilities in the Linux kernel
• A 23-year-old vulnerability in the semaphore implementation of the OpenBSD kernel
• 34 security flaws and 7 proof-of-concept exploits in FreeBSD
• 6 vulnerabilities in the dnsmasq network service, including CVE-2026-4890 and CVE-2026-5172
• The HTTP/2 Bomb denial-of-service technique affecting servers such as NGINX, Apache, and IIS
• 5 exploitable vulnerabilities in Google’s Chrome V8 engine
• 10 exploitable security vulnerabilities in Apple’s Safari browser
• A WebAssembly vulnerability tracked as CVE-2026-8390 in Mozilla Firefox

(ll)