OpenAI launches Daybreak to hunt vulnerabilities with GPT-5.5
OpenAI announced Daybreak on Monday, a cybersecurity initiative that uses GPT-5.5 and Codex Security to find and patch software flaws before attackers exploit them. It is a direct response to Anthropic’s Project Glasswing and the restricted Claude Mythos model, and it signals that the frontier AI labs are now competing aggressively in cyber defense.
Daybreak combines three model tiers. The standard GPT-5.5 handles general secure code review. A “Trusted Access for Cyber” variant serves verified defensive teams in authorized environments. The most permissive tier, GPT-5.5-Cyber, supports red teaming and penetration testing. Codex Security acts as the agentic harness that builds threat models, isolates vulnerabilities for testing, and proposes fixes.
Access is gated. OpenAI is requiring organizations to request vulnerability scans or go through sales. That tight control mirrors Anthropic’s approach with Mythos, which the company has refused to release publicly because the model can discover zero-days that humans missed for decades.
Several major security vendors are already integrating the capabilities. Akamai, Cisco, Cloudflare, CrowdStrike, Fortinet, Oracle, Palo Alto Networks, and Zscaler are listed as partners under the Trusted Access for Cyber program. OpenAI said it is working with industry and government partners to deploy more cyber-capable models in the future.
The timing is not random. AI-assisted research has flooded open-source maintainers with vulnerability reports. In March, HackerOne paused its bug bounty program citing the shift in balance between discovery and remediation. AI models can now turn a patch diff into a working exploit in minutes, which compresses the classic 90-day disclosure window to near zero. Security researcher Himanshu Anand argued last week that the 90-day policy is effectively dead.
That creates a new problem: triage fatigue. Project maintainers must sort through a flood of AI-generated reports, some of which are plausible-sounding but hallucinated. Daybreak aims to automate not just the finding, but the validation and patching, so defenders can keep pace.
The broader context is an AI cybersecurity race. Anthropic’s Mythos helped Mozilla find and patch 271 vulnerabilities in Firefox in April. OpenAI’s counter-offer now gives enterprise and government customers an alternative stack. Both companies are betting that AI security agents will become a standard operational layer inside development pipelines, not just a research tool.
OpenAI CEO Sam Altman framed Daybreak as an effort to “accelerate cyber defense and continuously secure software.” The company wants security teams to move at the speed of AI-assisted attackers. Whether it works at scale depends on how well the automated patch validation holds up against real-world code complexity.