If GPT 5.5 Cyber stronger than Mythos, why no Ban? (OpenAI Daybreak)

OpenAI shipped GPT-5.5 Cyber at 85.6% on CyberGym — 2 points above Mythos 5 — while Mythos and Fable 5 remain under US government access restrictions.

What OpenAI released

Four pieces, all landing the same week: a Codex Security plugin that plugs into existing CI/CD workflows, the full GPT-5.5 Cyber model gated to "trusted defenders," a cyber partner program, and Patch the Planet for critical open-source infra. Sam Altman posted the CyberGym SOTA claim directly: 85.6% vs Mythos 5's 83.6%.

Production numbers, not a demo

Since March, Aardvark (called "break" in the transcript) has scanned 30M+ commits across 30,000+ codebases, generated 70,000 reviewer-marked fixes, and detected 500,000+ additional fixes automatically. Projects in scope include curl, Go, Python, Sigstore — the literal foundation of the internet.

The closed loop

The plugin does deep scan → threat model → patch generation → export to your pipeline → human review → ship. The creator calls this "remediation as a feature, not just detection as a report." Expect your coding agent (Cursor, Claude Code) to start suggesting security fixes pre-commit once this capability standardizes.

The policy contradiction

The NSA confirmed Mythos 5 "exploited systems in hours, not weeks" during red-team exercises where initial access was assumed — and even those red teams have since lost Mythos access. Andrej Karpathy can't use Fable 5 either; US restrictions extend to foreign nationals inside Anthropic. OpenAI promised an update 24 hours after Mythos access was paused — 10 days later, nothing. The creator's framing: "if GPT-5.5 Cyber is stronger, why is it not under equivalent controls?"

What this means for you

Frontier cyber models now operate with inconsistent governance across providers. As an AI-integrity question, the blast radius is societal: a poisoned patch to Python or curl ships to every device you own.