Daybreak and Cyber model cards are live in the official catalog: Blue/Red aliases deprecated, GPT-5.6 Cyber at 400K

Daybreak is OpenAI's cybersecurity model access program for approved security practitioners, and the official changelog entry of 2026-08-07 announced its two access tiers: Daybreak Blue and Daybreak Red. When this site fetched the official model catalog on 2026-11-02, the cards for Daybreak Blue (gpt-daybreak-blue-latest), Daybreak Red (gpt-daybreak-red-latest), and GPT-5.6 Cyber (gpt-5.6-cyber) all loaded in full. In this site's earlier records those IDs appeared only in the pricing-page table (recorded from 2026-11-01) and in Codex's bundled models.json metadata (on file since 2026-09-15 as hidden entries) — the card bodies are a new verification surface as of the 2026-11-02 fetch. This article walks through each card's numbers and status verbatim, then sets the Codex-side hidden entries beside the API-side cards, because the two surfaces use different context figures.

1. The three cards at a glance: one clean, two marked Deprecated

All three cards open with an "An alias for..." self-description — on Blue/Red that line is the card's summary banner, while on Cyber the same phrasing starts the body paragraph — meaning even the un-deprecated GPT-5.6 Cyber is positioned as an alias pointing at purpose-trained cybersecurity models, not as a fixed base model. The catalog also has no gpt-5.5-cyber card: the pricing page's Cyber models section carries a row for it ($12.50/$75, $1.25 cached input), but the model catalog has no matching card page (checked 2026-11-02).

2. Daybreak Blue: the defensive tier, default snapshot gpt-5.6-sol

Core specs from the Blue card (fetched 2026-11-02):

The deprecation note, word for word: "This alias is deprecated, please use the latest cyber model available to you. You can apply to join the Daybreak program here." Both alias cards share this exact sentence. The card keeps the Daybreak program application link (openai.com/daybreak/; this site did not fetch the application page and does not describe it).

Endpoint support: only the Responses API (v1/responses) reads Supported; Chat Completions, Live, Realtime (including transcription and translation), Batch, fine-tuning, embeddings, image generation and edits, speech generation, transcription, translation, moderation, and legacy Completions all read Not supported. Features: streaming, structured_outputs, function_calling, file_search, image_input, web_search, prompt_caching. Tools (under the Responses API): web_search, file_search, image_generation, code_interpreter, hosted_shell, apply_patch, skills, computer_use, mcp, tool_search. The snapshot list holds exactly one entry: gpt-5.6-sol.

Rate limits (Standard table on the card): Build 5,000 RPM / 1,000,000 TPM / 3,000,000 batch queue limit; Launch 10,000 RPM / 4,000,000 TPM / 200,000,000; Grow 15,000 RPM / 40,000,000 TPM / 15,000,000,000.

The snapshot pointing at gpt-5.6-sol matches the 2026-08-07 changelog's positioning of Blue: "Start with Daybreak Blue for most defensive security work. It provides access to general-purpose models such as GPT-5.6 Sol for vulnerability discovery, secure code review, detection engineering, incident response, malware analysis, and patch validation." (The six use cases are the changelog's own enumeration.)

3. Daybreak Red: the authorized-offense tier, default snapshot gpt-5.6-cyber

The Red card mirrors the Blue card and repeats the deprecation wording verbatim. The differences are in specs and snapshot (fetched 2026-11-02):

The endpoint, feature, tool, and rate-limit tables are identical to Blue's (Responses-only, same lists, same three rate-limit tiers). The snapshot list holds exactly one entry: gpt-5.6-cyber — consistent with the 2026-08-07 changelog's positioning of Red: "Daybreak Red provides separately approved access to purpose-trained models such as GPT-5.6 Cyber for authorized vulnerability reproduction, exploit validation, penetration testing, red teaming, and complex system analysis."

4. GPT-5.6 Cyber: approval-gated, every card number recorded

The GPT-5.6 Cyber card carries no deprecation mark. The card's definition reads: "An alias for our most advanced purpose-trained cybersecurity models, for approved defenders conducting advanced, authorized vulnerability research, exploit validation, and security testing." It then sets the access condition: "This model requires separate approval and provisioning," with links to the Daybreak program application and the pricing page.

Pricing (card table, per million tokens):

Two billing notes, transcribed: requests with more than 272K input tokens are "priced at 2x input and 1.5x output for the full request," and cache writes are "billed at 1.25x the uncached input token rate."

Specs and endpoints: 400,000 context, 272,000 max input, 128,000 max output, knowledge cutoff Feb 16, 2026, text + image input with text output, reasoning tokens supported; endpoints again Responses-only, with feature and tool lists identical to the other two cards.

The card also carries a Quick comparison table, transcribed with its own row labels: GPT-5.6 Cyber $12.5 / $1.25 / $75; GPT-5.5 $5 / $0.5 / $30; GPT-5.4 $2.5 / $0.25 / $15. Note the row labels read "GPT-5.5" and "GPT-5.4" — do not swap them for gpt-5.5-cyber / gpt-5.4-cyber when quoting.

Pricing-page cross-check (fetched 2026-11-02): the gpt-5.6-cyber row reads $12.50 / $75.00, $1.25 cached input, $15.625 for the 30-minute and $31.25 for the 12-hour cache-write tier — that is 1.25x and 2.5x the input price, consistent with the card's 1.25x note; every long-context column reads "-", which coexists with the card's 400K window plus the above-272K multiplier note (the pricing page carries no separate long-context tier for this model).

5. How far does the deprecation go: what officials said, and what they did not

What is stated: both alias cards carry Status: Deprecated; the guidance is to use "the latest cyber model available to you"; the application link remains on the card.

What is not stated: when the deprecation takes effect, when the aliases stop working, or any migration deadline. The official deprecations page, fetched 2026-11-02, contains no entry for either alias — the most recent cybersecurity deprecation there is still gpt-5.4-cyber, announced 2026-09-11 (removed from the API on 2026-10-01, with the same "most capable cyber model available to you" replacement guidance).

So the writing constraint is a single line: the smallest safe claim is "the card reads Deprecated, as of 2026-11-02." Do not write that Daybreak Blue is already offline (no date supports that), and do not backdate the deprecation to some announcement (no announcement point is findable).

6. Codex models.json hidden entries vs the API cards: two context scales side by side

The Codex-side record so far: gpt-daybreak-blue-latest / gpt-daybreak-red-latest have existed as visibility=hide entries in Codex's bundled metadata since 2026-09-15. This site re-verified the codex-rs/models-manager/models.json file at the rust-v0.166.0 tag on 2026-11-02: both entries are still there, still hidden (Blue priority 11, Red priority 12).

OpenAI documents no relationship between the two scales. For reference, the GPT-5.6 family shows the same pattern: 272K/872K runtime windows in Codex versus 1.05M on the API side — the Codex context_window is a CLI-side configuration, not a mirror of the API card. When writing about these, cite each scale to its own source; do not convert between them, and do not assert which one is "correct."

7. Constraints for writing and selection

• Approval-gated: all three cards require separate approval and provisioning (the card's own words). General API customers cannot self-serve; whether your account can call these models is answered by your own API responses.
• Responses only: listing Cyber / Daybreak models in any "also works with Chat Completions" roundup is wrong — every other endpoint reads Not supported on all three cards.
• Date-stamp the deprecation status: the card state above is a 2026-11-02 snapshot and may change.
• Do not read the Quick comparison's GPT-5.5 / GPT-5.4 rows as cyber-variant prices: transcribe the row labels as printed.
• Reproducing all of this takes three commands:

curl https://developers.openai.com/api/docs/models.md
curl https://developers.openai.com/api/docs/models/gpt-daybreak-blue-latest.md
curl https://raw.githubusercontent.com/openai/codex/rust-v0.166.0/codex-rs/models-manager/models.json

8. Next steps

• OpenAI's October changelog, backfilled: GPT-6 Rosalind, ChatGPT subscription API credits, and 12-hour prompt caching — the previous stop for the pricing page's Cyber models section and the 08-07 entry.
• GPT-6.1 Terra lands in the API: the model card, official pricing, and the GPT-6 family price table — the same model-card-plus-pricing-page verification workflow applied to another model.
• The GPT-6 family grows: gpt-6-sol, gpt-6-luna, gpt-6.1-sol land in the official SDKs — an earlier case of metadata surfacing ahead of official pages.
• The complete guide to GPT models (2026-07): GPT-5.6 Sol, Terra, Luna — the selection landscape for the current flagship family.