Codex Security Cloud includes Daybreak Blue by default

OpenAI said on September 29, 2026 that Codex Security Cloud is getting a major upgrade, with access to cyber-capable models through Daybreak Blue included by default.

In that post, OpenAI said the product scans entire GitHub repositories, continuously reviews new commits, investigates and deduplicates findings, and prepares fixes for review. The post does not say whether that Daybreak Blue access extends beyond Codex Security Cloud, including through the API.

OpenAI's Help Center describes Codex Security as a research preview for ChatGPT Enterprise, Edu, Business, and Pro. It is meant to identify, validate, and review fixes for vulnerabilities in connected code repositories, and to work more like a security researcher than a traditional scanner. The Help Center article does not mention Daybreak Blue.

What it does document is a GitHub workflow. After a repository is enabled, Codex Security builds a codebase-specific threat model, scans commit history in reverse chronological order, and uses that model to focus on attacker entry points, trust boundaries, sensitive data, and high-impact code paths. Teams can inspect and edit the model so it matches their deployment assumptions. Potential issues are checked in an isolated environment before a finding is surfaced. For a validated issue, Codex Security proposes a minimal patch aimed at the root cause. The patch does not change the repository on its own; a person reviews it and can raise a pull request. After a confirmed fix is merged, the product can revalidate it.

OpenAI says this uses language-model reasoning, test-time compute, tool use, and large context, rather than fuzzing or signature-based scanning. The first scan, which builds the threat model and reviews repository history, can take longer on large projects. Scans of new code are faster.

On Enterprise and Edu workspaces, admins control Codex Security in workspace permissions. Both Codex Cloud and Codex Security access must be enabled, and access can be limited to roles or groups, including SCIM-synced groups. A separate permission covers who may administer scan configurations.

OpenAI's rollout note is conservative: start with a small set of repositories and a dedicated group of reviewers, refine the threat model as you learn, and run generated patch pull requests through ordinary review. Teams that are not on GitHub Cloud are advised to begin with lower-risk or non-production repositories.

If your ChatGPT plan is one of the eligible tiers, open the Help Center's Codex Security get-started steps, connect only the GitHub repositories you intend to scan, and wait for the initial threat-model scan before treating findings as ready for review. Enterprise and Edu admins should confirm Codex Cloud and Codex Security permissions before a wider rollout.

Sources