Who can actually run GPT-5.6-Cyber, and what it costs

OpenAI now sells a model built to write exploits, and almost nobody can buy it. GPT-5.6-Cyber sits inside a tier called Daybreak Red, behind identity checks, legal paperwork and, from September 1, 2026, a hardware security key. The capability got the headlines. The gate is the part that decides whether your team can use it.

What is Daybreak Red, and how is it different from Daybreak Blue?

Daybreak Red is OpenAI's access tier for offensive security work, and it serves the GPT-5.6-Cyber model. Daybreak Blue is the defensive tier, and it serves GPT-5.6 Sol with extra safeguards. Amazon describes Blue as the right choice for most security teams, covering vulnerability discovery, detection work and incident response (AWS machine learning blog).

Red is the narrow one. It targets bug hunting, exploit reproduction and fix development. It pairs a lower refusal rate with stricter identity checks, which is the trade OpenAI is making: the model argues back less, so the paperwork holds more weight.

GPT-5.6-Cyber is the model inside Daybreak Red. VentureBeat reported it completes 95% of hard security tasks in OpenAI's own tests (VentureBeat). Amazon reports that researchers using the model identified two previously unknown V8 vulnerabilities in Chrome.

What does it take to get access to GPT-5.6-Cyber?

You cannot buy Daybreak Red with a credit card. Access runs through Trusted Access for Cyber, and OpenAI approves firms one at a time.

The published rules cover five things:

1. Identity checks of the people who will use the model.
2. Account security controls, including hardware security keys for single-user Daybreak accounts from September 1, 2026 (OpenAI help centre).
3. Approved-use limits, so the work you described is the work you may do.
4. Monitoring of usage, with human oversight on top.
5. Legal attestations that bind the firm to those terms.

The application asks who you are, what security work you plan to do, where you will do it, and which OpenAI surfaces you expect to use. There is a second door through Amazon: eligible customers can request Daybreak Red on Bedrock, but only after OpenAI has already approved them.

That ordering matters for planning. Consider a mid-sized pen-test firm with an existing AWS contract. The AWS relationship buys nothing here, because the vetting happens at OpenAI first and the AWS request comes second.

How much does GPT-5.6-Cyber cost on Amazon Bedrock?

GPT-5.6-Cyber costs $13.75 per million input tokens and $82.50 per million output tokens on the standard tier. Cached input reads cost $1.375 per million. Those figures come from the Bedrock model card, and they sit well above the general model from the same family.

Model	Input per 1M tokens	Output per 1M tokens	Context window
GPT-5.6-Cyber (Daybreak Red)	$13.75	$82.50	272K
GPT-5.6 Sol, 272K context	$5.50	$33.00	272K
GPT-5.6 Sol, 1M context	$11.00	$49.50	1M

The multiple is clean: Daybreak Red costs 2.5 times what GPT-5.6 Sol costs at the same 272K context window (GPT-5.6 Sol model card). Output tokens are where exploit work lands, so a long research session bills at the high rate.

Two more limits shape the budget. GPT-5.6-Cyber does not support fine-tuning, and it is not offered on the Priority or Flex service tiers. You pay standard rates, and you cannot train your own variant on internal findings.

Why European security teams have a residency problem

GPT-5.6-Cyber runs in exactly one AWS region: US East (Ohio). There is no cross-region routing for it, either within a geography or globally.

Compare that with GPT-5.6 Sol, which reaches Frankfurt, Zurich, Stockholm, Milan, Spain, Ireland, London and Paris through global cross-region inference. A German bank can send defensive work to Sol under a data residency policy. The same bank cannot send offensive research to Cyber without shipping the prompts to Ohio. Sending personal data outside the EEA needs a legal basis under Chapter V of the GDPR, such as an adequacy decision or standard clauses (European Commission transfer rules).

That is the practical gap nobody put a number on. Daybreak Blue is on offer across Europe. Daybreak Red is on offer in Ohio. For a European team, the model's refusal rate is not the blocker, and neither is the price. The blocker is a map.

Should your team apply for Daybreak Red now?

Apply now only if offensive research is your actual product, such as a pen-test firm or an in-house red team with a standing brief. For everyone else, Daybreak Blue answers the same questions at 40% of the output price and in a region your lawyers will sign off on.

Three questions decide it:

1. Do you produce exploit code as a deliverable? If not, Blue is the correct tier.
2. Can your legal team sign approved-use attestations? Those are binding, and they name your firm.
3. Can your data leave the EU? If not, Red is off the table today, even with approval.

The September 1, 2026 hardware key deadline is the near-term action item. If anyone on your team already holds a single-user Daybreak account, they need a security key before that date or they lose access.

What this signals about gated AI models

Daybreak Red is the clearest example yet of a frontier lab selling capability by licence rather than by API key. The pattern is spreading, and it has a clear catch: defenders pay to be vetted while attackers do not queue.

That catch shows up elsewhere in security tools. Google's automated bug hunting produced the numbers behind Chrome Security Update AI: 1,072 Bugs, Then 1,442, and the supply chain keeps proving that agents are attack surface, as when a GitHub issue could hijack Claude Code and Gemini CLI. Gating one model does not close those routes. It does decide who gets the strongest tool, and right now that decision belongs to a vendor rather than a regulator, which is the same conclusion behind the question of whether the government has to approve AI models.