OpenAI expands Daybreak service and launches GPT 5.6 Cyber model to counter autonomous attacks

The frequency of cyber attacks carried out by artificial intelligence agents is accelerating, with increased reports of models behaving like malware, ranging from the hacking of the Hugging Face platform, the hacking of a sports gym website, to the creation of fake accounts for social engineering and cyber attacks. In the face of this expansion in offensive capabilities, artificial intelligence labs that develop these models are accelerating the expansion of their protection and cyber security offerings for defenders. In this context, OpenAI announced the expansion of its cyber defence service, Daybreak, which it had launched earlier this year, shortly after Anthropic launched its cyber security models under the name Mythos.

The Daybreak service is an integrated package that enables defenders to access artificial intelligence models and custom tools and workflows to enhance cyber defences. OpenAI has revealed that the service is divided into two different levels, Blue and Red. Both levels grant accredited customers access to limited-access cyber boundary models. Boundary models, the most advanced categories available from artificial intelligence, have been the subject of widespread controversy, particularly after attempts by government administrations such as the previous Trump administration to cooperate with artificial intelligence companies on how to deploy such models due to safety and security concerns. OpenAI has previously imposed strict controls and protection barriers on the use of these models to restrict the operational scope of customers.

The Blue level targets most defenders in institutions, while the Red level opens the door to vulnerability research and more severe specialized models.The Blue level represents the basic and recommended option from the company for most defenders, as it provides a range of cyber services including incident response, malware analysis, and patch validation, which the company considers sufficient for the needs of most institutions. In contrast, the Red level grants users a wider and more severe set of tools, as the company provides access to cyber security models trained for a specific purpose focused on conducting security tests and vulnerability research.

The Red level exclusively includes the availability of the new GPT 5.6 Cyber model, which was developed based on the GPT 5.6 Sol model. The new model is characterized by advanced capabilities dedicated to specific and limited cyber security tasks. Currently, the model is only available to trusted client partners, and this list includes, according to reports, companies such as Accenture, IBM, Crowdstrike, and Cloudflare.

These moves come at a time when OpenAI indicates in an official blog post that the cyber landscape is changing extremely rapidly, as attackers will increasingly rely on artificial intelligence to carry out cyber attacks at unprecedented speeds and scales, including fully autonomous methods. The company clarified that as these capabilities spread, the time window available for defenders to prepare is constantly shrinking. Although critics point out that these steps also represent marketing opportunities for artificial intelligence labs to promote their modified services, institutions are showing increasing interest in purchasing protection tools from the companies that develop the models themselves, as they are the most familiar with security risks up close.