Daybreak Red arrived in AWS GovCloud (US-East) on November 4: OpenAI's official blog confirmed that approved customers can now call GPT-5.6 Cyber, a model trained for cybersecurity, inside a government cloud environment through Amazon Bedrock, for authorized vulnerability research and defensive testing.
Both gates have to open
GPT-5.6 Cyber is built on GPT-5.6 Sol and trained specifically for cybersecurity work: investigating complex software weaknesses, reproducing vulnerabilities in controlled settings, and developing mitigations, with lower refusal rates for some high-risk, dual-use requests. Daybreak Red is not a public API but a gated service. The first gate is OpenAI's Daybreak Red approval, covering identity verification, account security checks, and usage restrictions; the second is contacting the AWS account team to enable Bedrock access. OpenAI states clearly that Daybreak Red approval alone does not automatically enable access on AWS. The service is available only in the GovCloud (US-East) region, with no cross-region inference. Inference data is not used to train models, and customers do not need to share their Daybreak Red data with OpenAI; traffic flagged by classifiers is retained for up to 30 days for automated abuse detection, and eligible customers can request zero data retention from AWS.
Where the boundary of this change lies
Daybreak Red already reached Bedrock in US East (Ohio) in August; this move brings the same capability into a government cloud with stricter compliance requirements. What changes is the operating environment and the governance boundary, not the model itself: access is still limited to approved government security teams and security practitioners, not ordinary developers or enterprise users, and the service only supports authorized vulnerability research, exploit validation, and security testing — not unauthorized testing. OpenAI is tightening the other side of Daybreak at the same time: Daybreak Blue sessions may be used for training from November 29, so one side loosens while the other tightens, and the line between them is drawn more clearly.
Teams that need it can first check the eligibility requirements, then go through approval and AWS provisioning; those not yet approved should not stake project timelines on the GovCloud option just yet.
