Security teams that want a model willing to reason about exploit chains now have a governed route to one, and it comes with paperwork. AWS says Daybreak Red and Daybreak Blue from OpenAI are live for eligible customers on Amazon Bedrock, in a single region, behind an enrollment check rather than a console toggle (AWS Machine Learning blog).
Two tiers, two refusal thresholds
The split matters more than the branding. Daybreak Blue exposes GPT-5.6 Sol with safeguards tuned for defensive work such as vulnerability discovery, detection engineering, and incident response, and AWS positions it as the starting point for most teams. Daybreak Red exposes GPT-5.6 Cyber for vulnerability research, exploit reproduction, and mitigation development, where AWS describes a lower refusal threshold paired with stronger identity verification, monitoring, and access controls (AWS Machine Learning blog).
That is the interesting design choice. General-purpose models cannot tell an authorized red teamer from an attacker, so they decline. Daybreak resolves the ambiguity administratively instead, using who you are and where the work runs as the control surface.
The result AWS is leaning on
According to OpenAI, as relayed by AWS, researchers used GPT-5.6 Cyber through Daybreak Red to find two previously unknown vulnerabilities in V8, the JavaScript engine in Chrome, which chained together could enable memory corruption and a heap sandbox escape; the first was fixed as CVE-2026-15903 and counted as one of only four successful zero-day entries to V8 CTF in 2026 (AWS Machine Learning blog). Read that as a vendor-reported result, not an independent benchmark. It is a real CVE, but it says nothing about how the model performs on your code base.
Where your prompts go
This is the part worth checking before a pilot. AWS states both models run on the Bedrock next-generation inference engine with zero-operator access enforced at the chip, IAM-governed access, CloudTrail logging, VPC endpoints, and no use of inference data for model training (AWS Machine Learning blog).
There is a caveat in the documentation. According to AWS, classifier-flagged traffic for the Daybreak models is retained up to 30 days for automated offline abuse detection, and eligible customers can request full zero data retention through their account team (Amazon Bedrock abuse detection). Bedrock enforces this through a retention mode rather than a toggle, and a request will be blocked if your account or project is set to data_retention_mode: none while the model requires retention (Bedrock data retention). If your unpatched vulnerability details cannot sit anywhere for 30 days, settle the retention question first.
Getting access
Availability is narrow at launch: US East (Ohio) only, and access requires enrollment in Trusted Access for Cyber from OpenAI before an AWS account team can turn it on (AWS Machine Learning blog). Practically, that means a procurement conversation and a residency review, not a same-afternoon experiment.
For background on the wider program, see our earlier coverage of OpenAI adding the Daybreak security models to AWS Bedrock and on why OpenAI is expanding Daybreak as the cyber defense window narrows.
