OpenAI expands Daybreak cyber-defense service with new model

AI models are increasingly behaving like bad actors — compromising Hugging Face, hacking a gym website, or creating fake profiles to socially engineer intrusions — and the labs that build those models are expanding their own cyber-defense offerings in response. This week, OpenAI announced an expansion of Daybreak, its cyber-defense service, not long after Anthropic released its own cyber-focused model, Mythos.

Daybreak bundles access to models, tools, and workflows for defenders. OpenAI said Monday that the service now consists of two tiers: Blue and Red. Both grant approved customers access to OpenAI’s limited-access frontier cyber models — models that have drawn controversy after the Trump administration reportedly sought to collaborate with AI companies on their rollout, purportedly over safety concerns. OpenAI had previously deployed significant guardrails limiting what customers could do with them.

Blue, described as the more basic tier, offers services including incident response, malware analysis, and patch validation; OpenAI calls it the “recommended starting point for most defenders.” Red offers a broader, potentially more dangerous toolkit: “purpose-trained cybersecurity models” designed to carry out security testing and vulnerability research.

Red is also where the new model lives. GPT-5.6-Cyber, built off GPT-5.6 Sol, offers enhanced capabilities for specialized cybersecurity tasks, the company said. It is currently only being made available to “trusted customer partners,” reportedly including Accenture, IBM, Crowdstrike, Cloudflare, and others.

Critics have pointed out that these defensive tools double as marketing opportunities for the AI labs building them — a dynamic OpenAI’s own framing leaned into. “The cybersecurity world is rapidly changing—threat actors will increasingly use AI to conduct cyberattacks at unprecedented speed and scale, including in fully autonomous ways,” the company said in a blog post. “As these capabilities spread, defenders have a narrowing window to prepare.”

Why it matters

As AI labs position themselves as both the source of AI-driven attack capability and its defense, enterprises are increasingly turning to the same companies that built the underlying models to protect against them.