Daybreak Blue

OpenAI provided OpenCode with a blue-team security model called Daybreak Blue to strengthen defenses.

Daybreak Blue is not a standalone model, but rather runs on the same base model (Sol) as ordinary ChatGPT, implementing authorized security-related functionality by relaxing cybersecurity guardrails.

Accessing Daybreak Blue requires a paid plan, advanced account security, a registered physical FIDO2 key (such as a YubiKey), identity verification with a selfie and ID at chatgpt.com/cyber along with a stated purpose, and OpenAI reviews each case individually and has the right to refuse.

In 10 runs (5 each for standard and Blue), both standard and Blue completed the full security audit, with not a single refusal to execute.

The figures OpenAI published—the general model completing 1.5% of requests and Blue completing 2.0% of requests—refer to offensive tasks (exploit chain development, authentication bypass, privilege escalation for attack purposes), not reviewing one's own code to protect an application.

The finding of takeover caused by an open installer had a detection rate of 4/5 on the standard side and 2/5 on the Blue side, with standard detecting it twice as often as Blue, contrary to the impression from the initial run.

Reflected XSS had a detection rate of 0/5 on the standard side and 3/5 on the Blue side, corresponding to a Fisher exact test p-value of about 0.17, not reaching the p<0.05 statistical significance threshold.

The LFI vulnerability via pagetype had a detection rate of 0/5 on the standard side and 2/5 on the Blue side.

In 5 runs, the two findings of privilege escalation and CSRF via GET both had a 5/5 detection rate on both the standard and Blue sides.

After the upgrade, Codex Security Cloud integrates by default a cyber-capable models capability delivered through Daybreak Blue.