1# Cyber Safety1# Models and Trusted Access
2 2
3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.
4 4
5Daybreak Blue and Daybreak Red help approved users move from findings to validated fixes during authorized defensive cybersecurity work. Combine the right model with a controlled environment, a written engagement scope, least-privilege permissions, and automatic review before sensitive actions run.5OpenAI Daybreak helps approved users perform authorized defensive cybersecurity work. Daybreak Blue provides access to frontier models with reduced refusals for authorized defensive workflows. Daybreak Red provides separately approved access to specialist cyber models for more advanced security research.
6 6
7## Choose the right access tier7Combine your approved model with a controlled environment, clear limits on approved systems and actions, least-privilege permissions, and automatic review before sensitive actions run. Use the model only with the approved identity, workspace or API organization and project, and product surface.
8 8
9Start with **Daybreak Blue**, which provides access to frontier models such as GPT-5.6 Sol, for most authorized defensive work, including:9## Choose the right model
10
11Start with **GPT-Daybreak-Blue** for most authorized defensive work. This model provides access to frontier capabilities with reduced refusals for defensive security workflows, including:
10 12
11- Vulnerability discovery and triage.13- Vulnerability discovery and triage.
12- Secure code review and threat modeling.14- Secure code review and threat modeling.
14- Malware analysis in a controlled environment.16- Malware analysis in a controlled environment.
15- Remediation and patch validation.17- Remediation and patch validation.
16 18
17**Daybreak Red** provides separately approved access to purpose-trained cybersecurity models such as GPT-5.6 Cyber for explicitly authorized specialist workflows, including controlled vulnerability reproduction, proof-of-concept or exploit validation, penetration testing, red teaming, and complex system analysis. It isn't the default choice for routine security work, and access isn't available automatically or on every surface.19**GPT-Daybreak-Red** is a specialist cyber model for separately approved, explicitly authorized workflows, such as controlled vulnerability reproduction, proof-of-concept or exploit validation, penetration testing, red teaming, and complex system analysis. It isn't the default choice for routine security work, and access isn't available automatically or on every surface.
18 20
19These advanced workflows can resemble malicious activity without the authorized engagement context. Use the approved model and surface only for systems you own or are explicitly authorized to assess, and keep appropriate human oversight in place.21These advanced workflows can resemble malicious activity without clear authorization. Use the approved model and surface only for systems you own or are explicitly authorized to assess, and keep appropriate human oversight in place.
20 22
21For example:23For example:
22 24
23- **Daybreak Blue:** Review the approved lab repository for authentication weaknesses, rank findings by evidence and impact, and propose patches without accessing external systems.25- **GPT-Daybreak-Blue:** Review the approved lab repository for authentication weaknesses, rank findings by evidence and impact, and propose patches without accessing external systems.
24- **Daybreak Red:** Within the approved lab and engagement window, reproduce the documented authentication flaw, validate a minimal proof of concept, and stop before credential access, persistence, or production changes.26- **GPT-Daybreak-Red:** Within the approved lab and testing window, reproduce the documented authentication flaw, validate a minimal proof of concept, and stop before credential access, persistence, or production changes.
25 27
26## Trusted Access for Cyber28## Trusted Access for Cyber
27 29
28[Trusted Access for Cyber](https://openai.com/index/trusted-access-for-cyber/) is the reviewed access program; Daybreak Blue and Daybreak Red are access tiers for approved models. Access depends on approval and provisioning for your specific identity or service, ChatGPT workspace or API organization and project, authorized model, and allowed product surface.30Request **Daybreak access** through [Trusted Access for Cyber](https://help.openai.com/en/articles/20001258-trusted-access-for-cyber). Access depends on approval and provisioning for your specific identity or service, ChatGPT workspace or API organization and project, authorized offering and model, and allowed product surface.
29 31
30- Individuals can request access through the [individual Trusted Access application](https://chatgpt.com/cyber).32- Individuals can request access through the [individual Trusted Access application](https://chatgpt.com/cyber).
31- Organizations can submit the [enterprise Trusted Access request form](https://openai.com/form/enterprise-trusted-access-for-cyber/) and coordinate with their OpenAI representative.33- Organizations can submit the [enterprise Trusted Access request form](https://openai.com/form/enterprise-trusted-access-for-cyber/) and coordinate with their OpenAI representative.
33Submitting an application or completing identity verification doesn't guarantee approval.35Submitting an application or completing identity verification doesn't guarantee approval.
34 36
35Applying, verifying your identity, or receiving approval for Daybreak Blue37Applying, verifying your identity, or receiving approval for Daybreak Blue
36 doesn't grant access to Daybreak Red. Specialist access requires separate38 doesn't grant access to Daybreak Red or GPT-Daybreak-Red. The specialist
37 approval and provisioning.39 offering requires separate approval and provisioning.
38 40
39For enterprise access, use the approved workspace, API organization, or project only for your organization's authorized internal work. Don't extend it to external users, third-party customers, externally offered services, downstream product features, or systems outside the approved engagement. If the approved identity, workspace, API organization, project, model, or surface is unclear, stop and confirm it with your OpenAI representative.41For enterprise access, use the approved workspace, API organization, or project only for your organization's authorized internal work. Don't extend it to external users, third-party customers, externally offered services, downstream product features, or systems outside the approved work. If the approved identity, workspace, API organization, project, model, or surface is unclear, stop and confirm it with your OpenAI representative.
40 42
41Trusted Access doesn't automatically grant [Zero Data Retention](https://developers.openai.com/api/docs/guides/your-data#data-retention-controls-for-abuse-monitoring). Confirm any separately approved retention controls for the exact API organization and applicable endpoint before you begin.43Trusted Access doesn't automatically grant [Zero Data Retention](https://developers.openai.com/api/docs/guides/your-data#data-retention-controls-for-abuse-monitoring). Confirm any separately approved retention controls for the exact API organization and applicable endpoint before you begin.
42 44
43## Configure a controlled cybersecurity engagement45## False positives
44
45Trusted Access governs approved model access, but it doesn't configure your environment or enforce your engagement scope. Your team must set up the following isolation, permission, review, and human-oversight controls.
46
47### Isolate the environment
48
49Run the engagement in a controlled lab or sandbox. Start without unrestricted internet access, access to sensitive production systems, or access to unrelated infrastructure. Keep secrets, credentials, persistent access, and durable system changes out of reach unless the written engagement explicitly requires and authorizes them.
50
51Test filesystem and network boundaries before beginning higher-risk work. Keep the host environment isolated even when the model or reviewer approves an individual action.
52
53### Define and enforce the engagement scope
54
55Document the rules of engagement before the model starts. Include:
56
57- Approved target systems, hosts, and environments.
58- Excluded systems, including production and unrelated infrastructure.
59- Approved and prohibited actions.
60- The engagement window and data-handling requirements.
61- Vulnerability disclosure, patch approval, and maintainer coordination.
62- Stop conditions and actions that require explicit human approval.
63
64Give the agent the relevant scope as task context. This written scope doesn't enforce itself: apply independent filesystem, network, identity, and tool controls to make unauthorized actions impossible whenever practical.
65
66Use Codex [permission profiles](https://learn.chatgpt.com/docs/permissions) to create a least-privilege boundary. Choose `:read-only` when the task doesn't require changes, or extend `:workspace` when the engagement needs workspace edits. For example:
67
68```toml
69approval_policy = "on-request"
70approvals_reviewer = "auto_review"
71default_permissions = "cyber-lab"
72
73[permissions.cyber-lab]
74description = "Limit security testing to the approved lab and workspace."
75extends = ":workspace"
76
77[permissions.cyber-lab.filesystem]
78glob_scan_max_depth = 3
79
80[permissions.cyber-lab.filesystem.":workspace_roots"]
81"**/.env*" = "deny"
82"**/*.pem" = "deny"
83
84[permissions.cyber-lab.network]
85enabled = true
86# Uncomment only for an approved host that resolves to a private address.
87# allow_local_binding = true
88
89[permissions.cyber-lab.network.domains]
90"lab.example.com" = "allow"
91```
92
93Replace `lab.example.com` with an approved target. The bounded filesystem scan avoids searching the entire workspace on Linux, WSL, and Windows; increase the depth or use exact deny paths if sensitive files appear deeper. Don't combine permission profiles with legacy `sandbox_mode` settings; follow the [permission-profile configuration guidance](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).
94
95If the approved lab host resolves to a private address, Codex blocks it by default even when the host is on the allowlist. Set `allow_local_binding = true` only for an explicitly approved private-network engagement, keep the destination allowlist narrow, and review the [local and private network guidance](https://learn.chatgpt.com/docs/permissions#local-and-private-networks). You can also allowlist the exact approved private IP address.
96
97Avoid `:danger-full-access` and `--yolo` for cybersecurity engagements. Full Access removes the enforceable sandbox boundary that automatic review depends on. Managed organizations can exclude `:danger-full-access`, limit allowed approval policies, and require automatic review through [enterprise-managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).
98
99Before enabling **Full Access** for an approved security model, the
100ChatGPT desktop app shows a model-specific warning about dangerous actions. The
101warning recommends **Approve for me** instead and links to
102[reviewer-policy configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration).
103The warning doesn't restore the sandbox boundary or override organization
104policy.
105
106### Review sensitive actions before execution
107
108[Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) routes eligible sandbox-boundary approval requests to a separate reviewer before the proposed action runs. The reviewer considers the proposed action, bounded task context, and applicable policy, then allows or denies the request. Organizations can customize that policy for their approved targets, prohibited actions, and required human-review conditions.
109
110In the ChatGPT desktop app, selecting an approved Daybreak model
111automatically switches the permissions control to **Approve for me** when that
112mode is available for your account and allowed by organization policy. This
113also applies when you use the desktop app's `/model` command. If that mode
114isn't available, the current permission mode stays unchanged. Model selection
115never overrides managed organization requirements.
116
117For automatic review to run, keep all three controls in place:
118
1191. Use an interactive approval policy such as `approval_policy = "on-request"`.
1202. Set `approvals_reviewer = "auto_review"`.
1213. Keep an enforceable sandbox or permission-profile boundary.
122
123Requests to a target on the network allowlist stay inside the network boundary and don't automatically trigger Auto-review. To review a sensitive command even when its destination is on the allowlist, create an explicit [command rule](https://learn.chatgpt.com/docs/agent-configuration/rules) under `~/.codex/rules/`:
124
125```python
126prefix_rule(
127 pattern = ["curl"],
128 decision = "prompt",
129 justification = "Review requests to the approved cybersecurity target.",
130)
131```
132
133Restart Codex after adding the rule. With `approvals_reviewer = "auto_review"`, matching commands go to the reviewer before execution. Add corresponding prompt rules for every sensitive command, or use `approval_mode = "prompt"` for individual [MCP tools](https://learn.chatgpt.com/docs/extend/mcp). Actions that require a person's decision still need explicit human approval.
134
135Auto-review doesn't inspect routine actions that are already permitted inside the sandbox. With `approval_policy = "never"` or Full Access, a sensitive action might not create a reviewable approval request. Automatic review can make mistakes and doesn't replace isolation, written scope, monitoring, or explicit human oversight.
136
137For a scoped policy and organization-wide enforcement, see [Configure an authorized cybersecurity engagement](https://learn.chatgpt.com/docs/sandboxing/auto-review#configure-an-authorized-cybersecurity-engagement).
138
139## Apply the same controls in custom agent workflows
140
141If you build with the Responses API, the Agents SDK, or another harness, add review at the tool-execution boundary. Check sensitive proposed actions against the approved engagement scope before execution, route ambiguous or high-risk actions to a person, enforce independent filesystem and network restrictions, keep audit logs, and fail closed if the reviewer or policy is unavailable.
142 46
143Codex Auto-review doesn't automatically protect custom tools or external harnesses. Use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution) for the Agents SDK pattern and the [open-source reviewer policy](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md) as a reference.47Legitimate cybersecurity or unrelated activity can still trigger a safeguard. If a safeguard blocks, reroutes, or limits a request, inspect the available client notice and request logs. Review [Common Issues and Troubleshooting](https://help.openai.com/en/articles/20001259) for details to collect and next steps. Report suspected Codex false positives through `/feedback` when available. For API access restrictions and appeals, follow the [API cybersecurity checks guidance](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity#appeals).
144 48
145Codex product-side sandboxing and review are separate from [API cybersecurity checks](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity). API safeguards can return `cyber_policy` errors, and per-user `safety_identifier` values can help limit the impact of a safeguard action.49All users remain subject to the [Usage Policies](https://openai.com/policies/usage-policies/) and [Terms of Use](https://openai.com/policies/row-terms-of-use/).
146 50
147## False positives51## Configure your security workflow
148 52
149Legitimate cybersecurity or unrelated activity can still trigger a safeguard. If a safeguard blocks, reroutes, or limits a request, inspect the available client notice and request logs. Report suspected Codex false positives through `/feedback` when available. For API access restrictions and appeals, follow the [API cybersecurity checks guidance](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity#appeals).53Trusted Access governs approved model access, but it doesn't configure your environment, enforce limits on approved systems and actions, or review proposed actions.
150 54
151All users remain subject to the [Usage Policies](https://openai.com/policies/usage-policies/) and [Terms of Use](https://openai.com/policies/row-terms-of-use/).55- [Use the recommended configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration) for isolation, least-privilege permissions, clearly defined boundaries, and guardrails for sensitive actions.
