OpenAI launches Daybreak for enterprise cyber defence

OpenAI has unveiled Daybreak, a cybersecurity platform aimed at defenders who need help finding software flaws, writing patches, and checking whether fixes actually work inside enterprise codebases. The company said the system is designed to compress security work that can take hours into minutes, while returning audit-ready evidence to enterprise tools.

The launch puts OpenAI into direct competition with Anthropic’s Mythos, which has become a reference point in AI-assisted cyber defence over the past few months. According to the source article, Mythos has surfaced thousands of zero-day vulnerabilities across major operating systems and browsers, but Anthropic has kept it in a tightly controlled rollout with roughly a dozen partner organisations under a $100 million defensive programme.

OpenAI says Daybreak is built around three model variants. GPT-5.5 is the general-purpose version and operates under standard safeguards. GPT-5.5 with Trusted Access for Cyber is reserved for verified defenders and is meant for tasks such as secure code review, vulnerability triage, malware analysis, and patch validation.

A third model, GPT-5.5-Cyber, is described as a more permissive variant for authorised red teaming, penetration testing, and controlled validation. Red teaming means simulating attacker behaviour to test whether systems can be broken in realistic ways. Penetration testing is a structured security exercise to find weaknesses before real attackers do.

OpenAI says Daybreak starts by threat modelling a repository, then identifies and tests vulnerabilities in an isolated environment, and finally proposes and validates fixes. In practice, that means the system is not just spotting possible bugs, but also checking whether a proposed patch actually closes the issue.

The company is rolling out Daybreak with a set of enterprise security partners, including Akamai, Cisco, Cloudflare, CrowdStrike, Fortinet, Oracle, Palo Alto Networks, and Zscaler. Those companies are integrating Daybreak capabilities under OpenAI’s Trusted Access for Cyber initiative, according to OpenAI.

Access is tightly controlled at launch. Organisations are being asked to request scans or speak with OpenAI sales, rather than signing up freely. That limited rollout suggests OpenAI is treating Daybreak as a managed enterprise service, not a public tool.

The timing of the launch adds pressure. Yesterday, Google’s Threat Intelligence Group disclosed the first documented case of a criminal threat actor using an AI model to discover and weaponise a zero-day exploit. According to GTIG analyst John Hultquist, that case is “the tip of the iceberg.” The exploit was designed to bypass two-factor authentication on a widely used admin tool, and it was caught before deployment.

OpenAI’s broader pitch is that Daybreak gives it a stronger enterprise security position than it has had so far. The company is pairing GPT-5.5 variants with Codex Security and its enterprise partner network in an attempt to give security teams a faster workflow for vulnerability discovery and validation.

Whether Daybreak closes the gap with Anthropic’s Mythos will depend on how the partner integrations work in production, and how many of the named launch partners have something to show in the next quarterly results. For now, OpenAI has made its move in a market where AI defenders and AI attackers are advancing at the same time.