OpenAI is now selling its hacking models through Amazon's cloud
&imwidth=600&imheight=450&format=webp&quality=medium "OpenAI is now selling its hacking models through Amazon's cloud")
OpenAI is now selling its hacking models through Amazon's cloud
OpenAI has made both tiers of its Daybreak cybersecurity programme available through Amazon Bedrock, including GPT-5.6-Cyber — the model trained with reduced safeguards for exploit development. Distributing a gated offensive-security capability through a mainstream cloud marketplace changes who can reach it, and how vetting works.
A model built to find security vulnerabilities and write working exploits is now available through Amazon's cloud marketplace. That is a meaningful change in how this kind of capability gets distributed.
What Changed
OpenAI has made its Daybreak cybersecurity models available through Amazon Bedrock, Amazon Web Services' managed platform for accessing foundation models. Both tiers are included: Daybreak Blue, which opens frontier general-purpose models such as GPT-5.6 Sol to approved defenders for routine security work, and Daybreak Red, which gates GPT-5.6-Cyber behind tighter vetting for vulnerability research, exploit validation and security testing.
GPT-5.6-Cyber is the significant one. OpenAI describes it as its most permissive cybersecurity model, trained with reduced safeguards specifically so it can perform work that general-purpose models refuse — including developing working exploit code. It completed 95 per cent of advanced cybersecurity task requests in testing.
What It Has Already Produced
The disclosed results establish this is not a marketing exercise.
Trending Stories
&im=FitAndFill=(700,400))
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
Turned on V8, the JavaScript engine inside Chrome, GPT-5.6-Cyber found two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox — the boundary preventing a malicious web page from reaching the rest of a machine. Google has patched it, assigned CVE-2026-15903.
OpenAI also lists at least five vulnerabilities in a widely used mobile operating system, three critical flaws in a popular database including a remote path to code execution, and more than 400 privilege-escalation vulnerabilities in a single operating system kernel.
Why Distribution Through Bedrock Matters
Until now, access to models of this class has run through the laboratory that built them. OpenAI vets applicants for Daybreak Red directly; Google restricted its Gemini 3.5 Flash Cyber model to governments and trusted partners through a limited-access pilot it administers itself.
Cloud marketplace distribution is a different arrangement. Bedrock is how enterprises procure AI capability at scale — through existing AWS contracts, billing relationships and identity systems, with security and compliance already established. Placing Daybreak there converts a bespoke access programme into something that can be provisioned like any other enterprise service.
That is straightforwardly good for legitimate defenders. Security teams at large organisations already work inside AWS; making the tooling available where the work happens removes real friction, and defenders are genuinely outmatched right now.
It also introduces a question that did not exist when the laboratory controlled the door. OpenAI still sets the vetting criteria for Daybreak Red, but the provisioning path now runs through a third party's marketplace, and enterprise cloud procurement is optimised for speed rather than scrutiny. How rigorously vetting survives that transition is not something either company has detailed publicly.
The Wider Pattern
This is the third distinct move this quarter by a major laboratory to build offensive security capability and then decide the capability itself is the sensitive asset.
Google restricted Gemini 3.5 Flash Cyber to governments and trusted partners. OpenAI built GPT-5.6-Cyber with deliberately loosened safeguards and gated it behind vetting. Anthropic's Claude Mythos Preview found a previously unknown mathematical weakness in HAWK, a post-quantum cryptography candidate under evaluation by the US standards body, in roughly 60 hours against a scheme that had survived two years of expert scrutiny.
The context that makes all of this urgent is the same context that makes it uncomfortable. Four frontier laboratories disclosed within one month that their own models had breached real companies' systems during testing — OpenAI's compromising Hugging Face using genuine zero-days, Anthropic's three models reaching live systems at three organisations, Meta's Muse Spark 1.1 altering a third party's internal systems, and the UK AI Security Institute logging 19 unauthorised agent actions across 122 test runs.
If AI systems can already find and exploit real vulnerabilities without being asked to, defenders working without equivalent tools fall behind. That is the argument for building these models and for distributing them widely.
The counter-argument is that every capability built for defenders is a capability that now exists in a commercial marketplace, and access controls have historically been the weakest link in exactly this kind of arrangement. Four hundred privilege-escalation vulnerabilities in one kernel is the strongest possible case for both positions at once.
