GPT-5.5-Cyber outperforms Anthropic’s Mythos on security

The main result here is that GPT-5.5-Cyber achieves 85.6% on CyberGym compared to 83.8% from Mythos 5 by Anthropic. But what’s even more exciting is how much improvement the specialized model has over the base GPT-5.5 model. In ExploitGym, where we measure the actual ability to find vulnerabilities, GPT-5.5-Cyber achieves 39.5% compared to 25.95% from the base GPT-5.5 model. Similarly, in SEC-bench Pro, GPT-5.5-Cyber achieves 69.8% compared to 63.1% from the base model. Today, OpenAI launched GPT-5.5-Cyber as part of their Daybreak cybersecurity initiative and the results clearly show that if you have a good general purpose model like GPT-5.5 and then train it specifically on a narrow task, you get significant improvements in performance. This means that instead of using the same model and coming up with better prompting strategies, you should consider using a domain specific model in your field of expertise (e.g. security, healthcare, legal, financial).

The Codex Security plugin that comes with the model has already been deployed in production. It analyzed over 30M commits in 30,000+ repos, automatically closing 500,000 issues and confirming another 70,000 with humans. Note that even with the specialized model, all patches need to be reviewed and approved by humans. So while the AI identifies the issue and suggests a solution, it’s up to humans to decide whether to deploy it or not.

1Who's already in the scanning net

They have quite a few partners: over 25 security vendors (Cisco, Crowdstrike, Cloudflare, Palo Alto Networks, IBM, Fortinet, Wiz, SentinelOne, Palantir) and 8 governments (Australia, Canada, France, Germany, Japan, South Korea, UK, and European Union’s ENISA). They also have several open source projects participating in Patch the Planet such as cURL, Go, Python, and Sigstore. These are the underlying technologies used in most applications and APIs, so if there are vulnerabilities in third party libraries that you depend on, now they’re within reach.

2What the specialization gap means for builders

If you look at the difference between GPT-5.5-Cyber and base GPT-5.5 in ExploitGym (13 points), you see that whenever you have a good general purpose model like GPT-5.5 and then train it specifically on a narrow task, you get significant improvements in performance. This means that if you’re developing products in a specific domain (e.g. security, healthcare, legal, financial), you should consider using a domain specific model instead of just trying to come up with better prompts for a general purpose model.

Lastly, millions of repos are getting continuously scanned. Popular languages and libraries such as Python, cURL, and Go are included in the scanning. OpenAI’s assumption is that if we automate the process and have humans verify all patches, we can keep up with the pace of introducing vulnerabilities and fixing them.